Analysis
-
max time kernel
28s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
15-11-2022 11:32
Behavioral task
behavioral1
Sample
0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe
Resource
win10v2004-20221111-en
General
-
Target
0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe
-
Size
348KB
-
MD5
96bdd68cfa84ba3d7390b4e172837370
-
SHA1
f3f5908c8138881e04db463a78172ca510073788
-
SHA256
0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9
-
SHA512
17775d7dbf6776620f59a0a2f4ea2753a4ddf39a9b05e7f2d28dae2e48a809c8aa30382d5fdddff70c76d948f6a1991a1585271e3b820576feb18825b178f4b0
-
SSDEEP
6144:cbslI7IBoZ1jMYORbxV9b+WvHfyVQhAyPl//2:cbvII1MtD+WffyVQhAyPl//2
Malware Config
Extracted
icexloader
http://stealthelite.one/magnumopus/Script.php
Signatures
-
Detects IceXLoader v3.0 4 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\Opus.exe family_icexloader_v3 C:\Users\Admin\AppData\Roaming\Opus.exe family_icexloader_v3 C:\Users\Admin\AppData\Roaming\Opus.exe family_icexloader_v3 \Users\Admin\AppData\Roaming\Opus.exe family_icexloader_v3 -
icexloader
IceXLoader is a downloader used to deliver other malware families.
-
Executes dropped EXE 1 IoCs
Processes:
Opus.exepid process 380 Opus.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2040 cmd.exe -
Drops startup file 1 IoCs
Processes:
0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Opus.exe 0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe -
Loads dropped DLL 2 IoCs
Processes:
cmd.exepid process 1536 cmd.exe 1536 cmd.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run 0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\Opus = "\"C:\\Users\\Admin\\AppData\\Roaming\\Opus.exe\"" 0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Opus = "\"C:\\Users\\Admin\\AppData\\Roaming\\Opus.exe\"" 0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe -
Delays execution with timeout.exe 2 IoCs
Processes:
timeout.exetimeout.exepid process 560 timeout.exe 572 timeout.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 1168 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1168 powershell.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.execmd.execmd.exeOpus.execmd.exedescription pid process target process PID 1180 wrote to memory of 1536 1180 0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe cmd.exe PID 1180 wrote to memory of 1536 1180 0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe cmd.exe PID 1180 wrote to memory of 1536 1180 0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe cmd.exe PID 1180 wrote to memory of 1536 1180 0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe cmd.exe PID 1180 wrote to memory of 2040 1180 0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe cmd.exe PID 1180 wrote to memory of 2040 1180 0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe cmd.exe PID 1180 wrote to memory of 2040 1180 0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe cmd.exe PID 1180 wrote to memory of 2040 1180 0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe cmd.exe PID 1536 wrote to memory of 560 1536 cmd.exe timeout.exe PID 1536 wrote to memory of 560 1536 cmd.exe timeout.exe PID 1536 wrote to memory of 560 1536 cmd.exe timeout.exe PID 1536 wrote to memory of 560 1536 cmd.exe timeout.exe PID 2040 wrote to memory of 572 2040 cmd.exe timeout.exe PID 2040 wrote to memory of 572 2040 cmd.exe timeout.exe PID 2040 wrote to memory of 572 2040 cmd.exe timeout.exe PID 2040 wrote to memory of 572 2040 cmd.exe timeout.exe PID 1536 wrote to memory of 380 1536 cmd.exe Opus.exe PID 1536 wrote to memory of 380 1536 cmd.exe Opus.exe PID 1536 wrote to memory of 380 1536 cmd.exe Opus.exe PID 1536 wrote to memory of 380 1536 cmd.exe Opus.exe PID 380 wrote to memory of 536 380 Opus.exe cmd.exe PID 380 wrote to memory of 536 380 Opus.exe cmd.exe PID 380 wrote to memory of 536 380 Opus.exe cmd.exe PID 380 wrote to memory of 536 380 Opus.exe cmd.exe PID 536 wrote to memory of 1168 536 cmd.exe powershell.exe PID 536 wrote to memory of 1168 536 cmd.exe powershell.exe PID 536 wrote to memory of 1168 536 cmd.exe powershell.exe PID 536 wrote to memory of 1168 536 cmd.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe"C:\Users\Admin\AppData\Local\Temp\0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c timeout 2 & "C:\Users\Admin\AppData\Roaming\Opus.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 23⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\Opus.exe"C:\Users\Admin\AppData\Roaming\Opus.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\file.bat"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-MpPreference -DisableRealtimeMonitoring $true5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /c timeout 1 & del /F "C:\Users\Admin\AppData\Local\Temp\0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\file.batFilesize
238B
MD5fdb5554346e7388c6bc358c16c448995
SHA117957bbe381d434574e1fc15ed5c74084fda26fe
SHA256898bc3e85e09e353a36612b5911aa2636c06a94443dbec4e62c6b8cf2412640c
SHA5123eec1e0dab21861bcb73cbfe3ea7234768443dd02c62a55919ad7e693501ff886946d74a8f75b7f580fa5251472a13ff55d187396c8d65fe9c2220f2f6da0674
-
C:\Users\Admin\AppData\Roaming\Opus.exeFilesize
348KB
MD596bdd68cfa84ba3d7390b4e172837370
SHA1f3f5908c8138881e04db463a78172ca510073788
SHA2560911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9
SHA51217775d7dbf6776620f59a0a2f4ea2753a4ddf39a9b05e7f2d28dae2e48a809c8aa30382d5fdddff70c76d948f6a1991a1585271e3b820576feb18825b178f4b0
-
C:\Users\Admin\AppData\Roaming\Opus.exeFilesize
348KB
MD596bdd68cfa84ba3d7390b4e172837370
SHA1f3f5908c8138881e04db463a78172ca510073788
SHA2560911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9
SHA51217775d7dbf6776620f59a0a2f4ea2753a4ddf39a9b05e7f2d28dae2e48a809c8aa30382d5fdddff70c76d948f6a1991a1585271e3b820576feb18825b178f4b0
-
\Users\Admin\AppData\Roaming\Opus.exeFilesize
348KB
MD596bdd68cfa84ba3d7390b4e172837370
SHA1f3f5908c8138881e04db463a78172ca510073788
SHA2560911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9
SHA51217775d7dbf6776620f59a0a2f4ea2753a4ddf39a9b05e7f2d28dae2e48a809c8aa30382d5fdddff70c76d948f6a1991a1585271e3b820576feb18825b178f4b0
-
\Users\Admin\AppData\Roaming\Opus.exeFilesize
348KB
MD596bdd68cfa84ba3d7390b4e172837370
SHA1f3f5908c8138881e04db463a78172ca510073788
SHA2560911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9
SHA51217775d7dbf6776620f59a0a2f4ea2753a4ddf39a9b05e7f2d28dae2e48a809c8aa30382d5fdddff70c76d948f6a1991a1585271e3b820576feb18825b178f4b0
-
memory/380-62-0x0000000000000000-mapping.dmp
-
memory/536-65-0x0000000000000000-mapping.dmp
-
memory/560-57-0x0000000000000000-mapping.dmp
-
memory/572-58-0x0000000000000000-mapping.dmp
-
memory/1168-67-0x0000000000000000-mapping.dmp
-
memory/1168-69-0x0000000073780000-0x0000000073D2B000-memory.dmpFilesize
5.7MB
-
memory/1168-70-0x0000000073780000-0x0000000073D2B000-memory.dmpFilesize
5.7MB
-
memory/1180-54-0x0000000075A31000-0x0000000075A33000-memory.dmpFilesize
8KB
-
memory/1536-55-0x0000000000000000-mapping.dmp
-
memory/2040-56-0x0000000000000000-mapping.dmp