Analysis
- max time kernel
146s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
15/11/2022, 11:32
Behavioral task
behavioral1
Sample
0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe
Resource
win7-20221111-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe
- Size 348KB
- Sample221115-nnqfbadf73
- SHA256 0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9
- MD5 96bdd68cfa84ba3d7390b4e172837370
- SHA1 f3f5908c8138881e04db463a78172ca510073788
- SHA512 17775d7dbf6776620f59a0a2f4ea2753a4ddf39a9b05e7f2d28dae2e48a809c8aa30382d5fdddff70c76d948f6a1991a1585271e3b820576feb18825b178f4b0
- SSDEEP 6144:cbslI7IBoZ1jMYORbxV9b+WvHfyVQhAyPl//2:cbvII1MtD+WffyVQhAyPl//2
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
icexloader
C2
-
http://stealthelite.one/magnumopus/Script.php
Signatures
- Detects IceXLoader v3.0 2 IoCs
resource yara_rule behavioral2/files/0x000a000000022dda-137.dat family_icexloader_v3 behavioral2/files/0x000a000000022dda-138.dat family_icexloader_v3 - icexloader
IceXLoader is a downloader used to deliver other malware families.
- Executes dropped EXE 1 IoCs
pid Process 2552 Opus.exe - Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Opus.exe 0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Opus = "\"C:\\Users\\Admin\\AppData\\Roaming\\Opus.exe\"" 0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run 0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Opus = "\"C:\\Users\\Admin\\AppData\\Roaming\\Opus.exe\"" 0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe - Delays execution with timeout.exe 2 IoCs
pid Process 4328 timeout.exe 4160 timeout.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3372 powershell.exe 3372 powershell.exe 1912 powershell.exe 1912 powershell.exe 1680 powershell.exe 1680 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3372 powershell.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeDebugPrivilege 1912 powershell.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeDebugPrivilege 1680 powershell.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe Token: SeRemoteShutdownPrivilege 2552 Opus.exe - Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 4940 wrote to memory of 4636 4940 0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe 83 PID 4940 wrote to memory of 4636 4940 0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe 83 PID 4940 wrote to memory of 4636 4940 0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe 83 PID 4940 wrote to memory of 4248 4940 0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe 84 PID 4940 wrote to memory of 4248 4940 0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe 84 PID 4940 wrote to memory of 4248 4940 0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe 84 PID 4636 wrote to memory of 4328 4636 cmd.exe 87 PID 4636 wrote to memory of 4328 4636 cmd.exe 87 PID 4636 wrote to memory of 4328 4636 cmd.exe 87 PID 4248 wrote to memory of 4160 4248 cmd.exe 88 PID 4248 wrote to memory of 4160 4248 cmd.exe 88 PID 4248 wrote to memory of 4160 4248 cmd.exe 88 PID 4636 wrote to memory of 2552 4636 cmd.exe 89 PID 4636 wrote to memory of 2552 4636 cmd.exe 89 PID 4636 wrote to memory of 2552 4636 cmd.exe 89 PID 2552 wrote to memory of 2248 2552 Opus.exe 90 PID 2552 wrote to memory of 2248 2552 Opus.exe 90 PID 2552 wrote to memory of 2248 2552 Opus.exe 90 PID 2248 wrote to memory of 3372 2248 cmd.exe 92 PID 2248 wrote to memory of 3372 2248 cmd.exe 92 PID 2248 wrote to memory of 3372 2248 cmd.exe 92 PID 2248 wrote to memory of 1912 2248 cmd.exe 93 PID 2248 wrote to memory of 1912 2248 cmd.exe 93 PID 2248 wrote to memory of 1912 2248 cmd.exe 93 PID 2248 wrote to memory of 1680 2248 cmd.exe 94 PID 2248 wrote to memory of 1680 2248 cmd.exe 94 PID 2248 wrote to memory of 1680 2248 cmd.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe"C:\Users\Admin\AppData\Local\Temp\0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Windows\SysWOW64\cmd.execmd /c timeout 2 & "C:\Users\Admin\AppData\Roaming\Opus.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\SysWOW64\timeout.exetimeout 23⤵
- Delays execution with timeout.exe
PID:4328
-
-
C:\Users\Admin\AppData\Roaming\Opus.exe"C:\Users\Admin\AppData\Roaming\Opus.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\file.bat"4⤵
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-MpPreference -DisableRealtimeMonitoring $true5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3372
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionExtension "C:\Users\Admin\AppData\Roaming\Opus\.exe"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1912
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath "C:\Users\Admin"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1680
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c timeout 1 & del /F "C:\Users\Admin\AppData\Local\Temp\0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:4160
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
- Size 2KB
- SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
- MD5 968cb9309758126772781b83adb8a28f
- SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
- SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 18KB
- SHA256 506e866bc771ed3b27deb43ca9fe505667550371a3845e601eeb439a85ed37a1
- MD5 7c604ca851157e8fbfb71e6d9d0453e4
- SHA1 b65656e92f2972cc30912680d28519bfc0dafed0
- SHA512 7da0ac1cf5895a6192c327c5c884f5ceadb658951ea7a280e971fa8f8c8228b8538b195e8757b6ad9036f48e50d2c8173ed0e416339b80d6b9aaeca859b7b968
- SSDEEP 384:Gsf+Be9i+y90Az/NJk+o9oJOThK6seYUFgi/L03Kowhf+W2NE/gpQ0gD+tkKh1:Dfq6ArcjoJOThNPt4KZPmE/IIQZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 18KB
- SHA256 19ed7bdadd7fbffad418e69350c699584eb9084303898f6716ea261d46d3681f
- MD5 bfbcc7211b1b0de439202fb3834771a5
- SHA1 83e5856c4b58bec651d0463c30778695fd5db00f
- SHA512 dae3b84b1709e1c489ec8a585ef12e8af580958195ed0a5feb704809e58e334237209931b58f481107ee14c5fe97d57d5d45a40a9fb188a302f843b6c79cc077
- SSDEEP 384:osf+Bn91Kjsfyq/Jglo9oVPAFNY12U/rDQGrLfkYfcyelnL+nUokkK0cvO1:lfsFgGoVPAFNHUXx7kYfcSU7kK0J
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\file.bat
- Size 238B
- SHA256 898bc3e85e09e353a36612b5911aa2636c06a94443dbec4e62c6b8cf2412640c
- MD5 fdb5554346e7388c6bc358c16c448995
- SHA1 17957bbe381d434574e1fc15ed5c74084fda26fe
- SHA512 3eec1e0dab21861bcb73cbfe3ea7234768443dd02c62a55919ad7e693501ff886946d74a8f75b7f580fa5251472a13ff55d187396c8d65fe9c2220f2f6da0674
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Opus.exe
- Size 348KB
- SHA256 0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9
- MD5 96bdd68cfa84ba3d7390b4e172837370
- SHA1 f3f5908c8138881e04db463a78172ca510073788
- SHA512 17775d7dbf6776620f59a0a2f4ea2753a4ddf39a9b05e7f2d28dae2e48a809c8aa30382d5fdddff70c76d948f6a1991a1585271e3b820576feb18825b178f4b0
- SSDEEP 6144:cbslI7IBoZ1jMYORbxV9b+WvHfyVQhAyPl//2:cbvII1MtD+WffyVQhAyPl//2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Opus.exe
- Size 348KB
- SHA256 0911819d0e050ddc5884ea40b4b39a716a7ef8de0179d0dfded9f043546cede9
- MD5 96bdd68cfa84ba3d7390b4e172837370
- SHA1 f3f5908c8138881e04db463a78172ca510073788
- SHA512 17775d7dbf6776620f59a0a2f4ea2753a4ddf39a9b05e7f2d28dae2e48a809c8aa30382d5fdddff70c76d948f6a1991a1585271e3b820576feb18825b178f4b0
- SSDEEP 6144:cbslI7IBoZ1jMYORbxV9b+WvHfyVQhAyPl//2:cbvII1MtD+WffyVQhAyPl//2
- MD5 SHA1 SHA512 SSDEEP