Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
15-11-2022 11:32
Behavioral task
behavioral1
Sample
0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe
Resource
win10v2004-20221111-en
General
-
Target
0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe
-
Size
348KB
-
MD5
96bdd68cfa84ba3d7390b4e172837370
-
SHA1
f3f5908c8138881e04db463a78172ca510073788
-
SHA256
0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9
-
SHA512
17775d7dbf6776620f59a0a2f4ea2753a4ddf39a9b05e7f2d28dae2e48a809c8aa30382d5fdddff70c76d948f6a1991a1585271e3b820576feb18825b178f4b0
-
SSDEEP
6144:cbslI7IBoZ1jMYORbxV9b+WvHfyVQhAyPl//2:cbvII1MtD+WffyVQhAyPl//2
Malware Config
Extracted
icexloader
http://stealthelite.one/magnumopus/Script.php
Signatures
-
Detects IceXLoader v3.0 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\Opus.exe family_icexloader_v3 C:\Users\Admin\AppData\Roaming\Opus.exe family_icexloader_v3 -
icexloader
IceXLoader is a downloader used to deliver other malware families.
-
Executes dropped EXE 1 IoCs
Processes:
Opus.exepid process 2552 Opus.exe -
Drops startup file 1 IoCs
Processes:
0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Opus.exe 0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Opus = "\"C:\\Users\\Admin\\AppData\\Roaming\\Opus.exe\"" 0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run 0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Opus = "\"C:\\Users\\Admin\\AppData\\Roaming\\Opus.exe\"" 0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe -
Delays execution with timeout.exe 2 IoCs
Processes:
timeout.exetimeout.exepid process 4328 timeout.exe 4160 timeout.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exepowershell.exepowershell.exepid process 3372 powershell.exe 3372 powershell.exe 1912 powershell.exe 1912 powershell.exe 1680 powershell.exe 1680 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exeOpus.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 3372 powershell.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeDebugPrivilege 1912 powershell.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeDebugPrivilege 1680 powershell.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.execmd.execmd.exeOpus.execmd.exedescription pid process target process PID 4940 wrote to memory of 4636 4940 0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe cmd.exe PID 4940 wrote to memory of 4636 4940 0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe cmd.exe PID 4940 wrote to memory of 4636 4940 0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe cmd.exe PID 4940 wrote to memory of 4248 4940 0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe cmd.exe PID 4940 wrote to memory of 4248 4940 0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe cmd.exe PID 4940 wrote to memory of 4248 4940 0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe cmd.exe PID 4636 wrote to memory of 4328 4636 cmd.exe timeout.exe PID 4636 wrote to memory of 4328 4636 cmd.exe timeout.exe PID 4636 wrote to memory of 4328 4636 cmd.exe timeout.exe PID 4248 wrote to memory of 4160 4248 cmd.exe timeout.exe PID 4248 wrote to memory of 4160 4248 cmd.exe timeout.exe PID 4248 wrote to memory of 4160 4248 cmd.exe timeout.exe PID 4636 wrote to memory of 2552 4636 cmd.exe Opus.exe PID 4636 wrote to memory of 2552 4636 cmd.exe Opus.exe PID 4636 wrote to memory of 2552 4636 cmd.exe Opus.exe PID 2552 wrote to memory of 2248 2552 Opus.exe cmd.exe PID 2552 wrote to memory of 2248 2552 Opus.exe cmd.exe PID 2552 wrote to memory of 2248 2552 Opus.exe cmd.exe PID 2248 wrote to memory of 3372 2248 cmd.exe powershell.exe PID 2248 wrote to memory of 3372 2248 cmd.exe powershell.exe PID 2248 wrote to memory of 3372 2248 cmd.exe powershell.exe PID 2248 wrote to memory of 1912 2248 cmd.exe powershell.exe PID 2248 wrote to memory of 1912 2248 cmd.exe powershell.exe PID 2248 wrote to memory of 1912 2248 cmd.exe powershell.exe PID 2248 wrote to memory of 1680 2248 cmd.exe powershell.exe PID 2248 wrote to memory of 1680 2248 cmd.exe powershell.exe PID 2248 wrote to memory of 1680 2248 cmd.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe"C:\Users\Admin\AppData\Local\Temp\0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c timeout 2 & "C:\Users\Admin\AppData\Roaming\Opus.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 23⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\Opus.exe"C:\Users\Admin\AppData\Roaming\Opus.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\file.bat"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-MpPreference -DisableRealtimeMonitoring $true5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionExtension "C:\Users\Admin\AppData\Roaming\Opus\.exe"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath "C:\Users\Admin"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /c timeout 1 & del /F "C:\Users\Admin\AppData\Local\Temp\0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD57c604ca851157e8fbfb71e6d9d0453e4
SHA1b65656e92f2972cc30912680d28519bfc0dafed0
SHA256506e866bc771ed3b27deb43ca9fe505667550371a3845e601eeb439a85ed37a1
SHA5127da0ac1cf5895a6192c327c5c884f5ceadb658951ea7a280e971fa8f8c8228b8538b195e8757b6ad9036f48e50d2c8173ed0e416339b80d6b9aaeca859b7b968
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5bfbcc7211b1b0de439202fb3834771a5
SHA183e5856c4b58bec651d0463c30778695fd5db00f
SHA25619ed7bdadd7fbffad418e69350c699584eb9084303898f6716ea261d46d3681f
SHA512dae3b84b1709e1c489ec8a585ef12e8af580958195ed0a5feb704809e58e334237209931b58f481107ee14c5fe97d57d5d45a40a9fb188a302f843b6c79cc077
-
C:\Users\Admin\AppData\Local\Temp\file.batFilesize
238B
MD5fdb5554346e7388c6bc358c16c448995
SHA117957bbe381d434574e1fc15ed5c74084fda26fe
SHA256898bc3e85e09e353a36612b5911aa2636c06a94443dbec4e62c6b8cf2412640c
SHA5123eec1e0dab21861bcb73cbfe3ea7234768443dd02c62a55919ad7e693501ff886946d74a8f75b7f580fa5251472a13ff55d187396c8d65fe9c2220f2f6da0674
-
C:\Users\Admin\AppData\Roaming\Opus.exeFilesize
348KB
MD596bdd68cfa84ba3d7390b4e172837370
SHA1f3f5908c8138881e04db463a78172ca510073788
SHA2560911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9
SHA51217775d7dbf6776620f59a0a2f4ea2753a4ddf39a9b05e7f2d28dae2e48a809c8aa30382d5fdddff70c76d948f6a1991a1585271e3b820576feb18825b178f4b0
-
C:\Users\Admin\AppData\Roaming\Opus.exeFilesize
348KB
MD596bdd68cfa84ba3d7390b4e172837370
SHA1f3f5908c8138881e04db463a78172ca510073788
SHA2560911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9
SHA51217775d7dbf6776620f59a0a2f4ea2753a4ddf39a9b05e7f2d28dae2e48a809c8aa30382d5fdddff70c76d948f6a1991a1585271e3b820576feb18825b178f4b0
-
memory/1680-164-0x0000000070390000-0x00000000703DC000-memory.dmpFilesize
304KB
-
memory/1680-162-0x0000000000000000-mapping.dmp
-
memory/1912-158-0x0000000000000000-mapping.dmp
-
memory/1912-161-0x0000000070390000-0x00000000703DC000-memory.dmpFilesize
304KB
-
memory/2248-139-0x0000000000000000-mapping.dmp
-
memory/2552-136-0x0000000000000000-mapping.dmp
-
memory/3372-148-0x0000000006D70000-0x0000000006DA2000-memory.dmpFilesize
200KB
-
memory/3372-155-0x00000000070B0000-0x00000000070BE000-memory.dmpFilesize
56KB
-
memory/3372-146-0x0000000005410000-0x0000000005476000-memory.dmpFilesize
408KB
-
memory/3372-147-0x0000000005B80000-0x0000000005B9E000-memory.dmpFilesize
120KB
-
memory/3372-141-0x0000000000000000-mapping.dmp
-
memory/3372-149-0x0000000070390000-0x00000000703DC000-memory.dmpFilesize
304KB
-
memory/3372-150-0x0000000006120000-0x000000000613E000-memory.dmpFilesize
120KB
-
memory/3372-151-0x00000000074E0000-0x0000000007B5A000-memory.dmpFilesize
6.5MB
-
memory/3372-152-0x0000000006E80000-0x0000000006E9A000-memory.dmpFilesize
104KB
-
memory/3372-153-0x0000000006EE0000-0x0000000006EEA000-memory.dmpFilesize
40KB
-
memory/3372-154-0x0000000007110000-0x00000000071A6000-memory.dmpFilesize
600KB
-
memory/3372-145-0x00000000053A0000-0x0000000005406000-memory.dmpFilesize
408KB
-
memory/3372-156-0x00000000071D0000-0x00000000071EA000-memory.dmpFilesize
104KB
-
memory/3372-157-0x0000000007100000-0x0000000007108000-memory.dmpFilesize
32KB
-
memory/3372-144-0x0000000005300000-0x0000000005322000-memory.dmpFilesize
136KB
-
memory/3372-143-0x0000000004CA0000-0x00000000052C8000-memory.dmpFilesize
6.2MB
-
memory/3372-142-0x0000000004630000-0x0000000004666000-memory.dmpFilesize
216KB
-
memory/4160-135-0x0000000000000000-mapping.dmp
-
memory/4248-133-0x0000000000000000-mapping.dmp
-
memory/4328-134-0x0000000000000000-mapping.dmp
-
memory/4636-132-0x0000000000000000-mapping.dmp