78b0ca77e1cef42c2d9492815f287f8e84e501ff79ddad8207a97d918fc3bf19

Analysis

max time kernel
141s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 22:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-24_4bb5c9c02dd46f00e0eebfb524ec081a_magniber.exe
Size

1.2MB
MD5

4bb5c9c02dd46f00e0eebfb524ec081a
SHA1

763341848a473c81eb1a0f4b8c8fdfabac88ad2f
SHA256

78b0ca77e1cef42c2d9492815f287f8e84e501ff79ddad8207a97d918fc3bf19
SHA512

03853c25326d9d965d0919cd1a3926f3f71b3cc0993e7c0bd61a8ae9aa3b5ab9080d4a30371ae475da4318581ac844d6a06bbc48dbde5a63ff97a3a1a8e86666
SSDEEP

24576:7n+kUERV2SQP2gggg8oGhPnX4pz/ZFoR83j4e4i1N6Iz:bDBRBgggg8JnX4pz4u30e4k6Iz

Score

6^/10

bootkit persistence

Malware Config

Signatures

Checks for any installed AV software in registry 1 TTPs 1 IoCs

Security Software Discovery
T1518.001

Processes:

icarus.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avast Software\Avast icarus.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avast Software\Avast	icarus.exe

Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

Processes:

2024-05-24_4bb5c9c02dd46f00e0eebfb524ec081a_magniber.exeicarus.exeicarus.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	2024-05-24_4bb5c9c02dd46f00e0eebfb524ec081a_magniber.exe
File opened for modification	\??\PhysicalDrive0	icarus.exe
File opened for modification	\??\PhysicalDrive0	icarus.exe

Executes dropped EXE 3 IoCs

Processes:

icarus.exeicarus_ui.exeicarus.exe

pid process

2548 icarus.exe
4052 icarus_ui.exe
4648 icarus.exe
Loads dropped DLL 1 IoCs

Processes:

icarus.exe

pid process

4648 icarus.exe

pid	process
2548	icarus.exe
4052	icarus_ui.exe
4648	icarus.exe

pid	process
4648	icarus.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

icarus.exeicarus.exeicarus_ui.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	icarus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	icarus.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	icarus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	icarus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	icarus.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	icarus_ui.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	icarus_ui.exe

Modifies registry class 7 IoCs

Processes:

icarus.exeicarus.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\56C7A9DA-4B11-406A-8B1A-EFF157C294D6 = "eea06075-0d7c-4f7d-8efb-fee1ef590760"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\7CCD586D-2ABC-42FF-A23B-3731F4F183D9 = "4DEC930631D6A523D3820D3CE1249367"	icarus.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\56C7A9DA-4B11-406A-8B1A-EFF157C294D6 = "eea06075-0d7c-4f7d-8efb-fee1ef590760"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\7CCD586D-2ABC-42FF-A23B-3731F4F183D9 = "4DEC930631D6A523D3820D3CE1249367"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\5E1D6A55-0134-486E-A166-38C2E4919BB1 = "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAFDZx1AY9Vkicp/NdqqqXIQQAAAACAAAAAAAQZgAAAAEAACAAAACMct5zScY67tIOqzcUvqFaEsV6nJMRECn/z6KZaJu0cAAAAAAOgAAAAAIAACAAAACD186Kr8vXPbkK5Ir5em4Tf938HJWYbqFpMBdS+LUJkjAAAABPeN+LRq8MaePS02QgBSsQX6PqmyPVUkmVeQTeX1xFAWUWtBo+MG8mfMUm1wVW5a1AAAAADR+poX1qE08D95Tn7xlkAGOF5neDfdOHFlImQ9oDysUjGdMRcBFmzbvsukyG2HXfxBhZ8Hg9icq/TonYFp8oGg=="	icarus.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

icarus_ui.exe

pid process

4052 icarus_ui.exe
4052 icarus_ui.exe

pid	process
4052	icarus_ui.exe
4052	icarus_ui.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

Processes:

icarus.exeicarus_ui.exeicarus.exe

description	pid	process
Token: SeRestorePrivilege	2548	icarus.exe
Token: SeTakeOwnershipPrivilege	2548	icarus.exe
Token: SeRestorePrivilege	2548	icarus.exe
Token: SeTakeOwnershipPrivilege	2548	icarus.exe
Token: SeDebugPrivilege	2548	icarus.exe
Token: SeDebugPrivilege	4052	icarus_ui.exe
Token: SeRestorePrivilege	4648	icarus.exe
Token: SeTakeOwnershipPrivilege	4648	icarus.exe
Token: SeRestorePrivilege	4648	icarus.exe
Token: SeTakeOwnershipPrivilege	4648	icarus.exe
Token: SeRestorePrivilege	4648	icarus.exe
Token: SeTakeOwnershipPrivilege	4648	icarus.exe
Token: SeRestorePrivilege	4648	icarus.exe
Token: SeTakeOwnershipPrivilege	4648	icarus.exe
Token: SeDebugPrivilege	4648	icarus.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

2024-05-24_4bb5c9c02dd46f00e0eebfb524ec081a_magniber.exeicarus_ui.exe

pid process

4444 2024-05-24_4bb5c9c02dd46f00e0eebfb524ec081a_magniber.exe
4052 icarus_ui.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

icarus_ui.exe

pid process

4052 icarus_ui.exe

pid	process
4444	2024-05-24_4bb5c9c02dd46f00e0eebfb524ec081a_magniber.exe
4052	icarus_ui.exe

pid	process
4052	icarus_ui.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

2024-05-24_4bb5c9c02dd46f00e0eebfb524ec081a_magniber.exeicarus.exe

description	pid	process	target process
PID 4444 wrote to memory of 2548	4444	2024-05-24_4bb5c9c02dd46f00e0eebfb524ec081a_magniber.exe	icarus.exe
PID 4444 wrote to memory of 2548	4444	2024-05-24_4bb5c9c02dd46f00e0eebfb524ec081a_magniber.exe	icarus.exe
PID 2548 wrote to memory of 4052	2548	icarus.exe	icarus_ui.exe
PID 2548 wrote to memory of 4052	2548	icarus.exe	icarus_ui.exe
PID 2548 wrote to memory of 4648	2548	icarus.exe	icarus.exe
PID 2548 wrote to memory of 4648	2548	icarus.exe	icarus.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2024-05-24_4bb5c9c02dd46f00e0eebfb524ec081a_magniber.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-24_4bb5c9c02dd46f00e0eebfb524ec081a_magniber.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4444

C:\Windows\Temp\asw-5f6b7c38-1ba7-4c7b-bfa3-bc011f4665bb\common\icarus.exe
C:\Windows\Temp\asw-5f6b7c38-1ba7-4c7b-bfa3-bc011f4665bb\common\icarus.exe /icarus-info-path:C:\Windows\Temp\asw-5f6b7c38-1ba7-4c7b-bfa3-bc011f4665bb\icarus-info.xml /install /sssid:4444
2⤵
- Writes to the Master Boot Record (MBR)
- Executes dropped EXE
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2548

C:\Windows\Temp\asw-5f6b7c38-1ba7-4c7b-bfa3-bc011f4665bb\common\icarus_ui.exe
C:\Windows\Temp\asw-5f6b7c38-1ba7-4c7b-bfa3-bc011f4665bb\common\icarus_ui.exe /sssid:4444 /er_master:master_ep_be1e1799-9ab3-42c4-a1ae-5aaf0aacfc84 /er_ui:ui_ep_29efec28-3672-4502-be1e-44f3bb70707b
3⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4052

C:\Windows\Temp\asw-5f6b7c38-1ba7-4c7b-bfa3-bc011f4665bb\avg-du\icarus.exe
C:\Windows\Temp\asw-5f6b7c38-1ba7-4c7b-bfa3-bc011f4665bb\avg-du\icarus.exe /sssid:4444 /er_master:master_ep_be1e1799-9ab3-42c4-a1ae-5aaf0aacfc84 /er_ui:ui_ep_29efec28-3672-4502-be1e-44f3bb70707b /er_slave:avg-du_slave_ep_8ab6cb42-c517-4ad9-b21f-69e98371cecd /slave:avg-du
3⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AVG\Icarus\Logs\icarus.log

Filesize
46KB

MD5
b610c3658828281ba176cf3363b74a0a

SHA1
641b55c8c02e69edcfa0646eb7afd264bd6e81d7

SHA256
c5ce7c611283f5d78b05138dca1064ddb34feb03821efe59d6a261398f77adc5

SHA512
95c6128c9dce57ff672ac39c254301e1d4a4e453ed0ece283bff0e4cd1f701fe42892aa505cada17050a771dde3d282512cdee9bddd5de2426276f6bd16e7058

Download Submit
C:\ProgramData\AVG\Icarus\Logs\report.log

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\ProgramData\AVG\Icarus\Logs\sfx.log

Filesize
10KB

MD5
497cfbb95d294a73c4a16bec55f59032

SHA1
14dd20a6334892dcd954d89d7d5d4b1613d475e1

SHA256
f29c3aae7f4b28ce84f919ec2d2c91ce10bf91593b27931e09ec5071c8718724

SHA512
06f31f432d6dda62950df2675158e1fea0b97ffe818f3e8c6ed59d7b48251e8a316887fb67bf029c9ba4a29db605922ffbf50b396317160a20f89d03f9593d79

Download Submit
C:\ProgramData\AVG\Icarus\Logs\sui.log

Filesize
15KB

MD5
c2cb3d33c08ff41980d51ef4995fd934

SHA1
6f58890920daf6f08cb8f1b2740bedfa99fbdcd3

SHA256
00140f3e96888fce3a7d7bec5708e495d3325e8d3626fdfcc190a53a6c0a9bfb

SHA512
34953455c22c7fd58082a6777ffa1ba47886f14afee4c401ba9053a976a134c6fbd8e9d1ce425ada53b3420d106ea6a33bed0c235a03d8191498761e13abbe27

Download Submit
C:\ProgramData\AVG\Icarus\settings\proxy.ini

Filesize
278B

MD5
b8853a8e6228549b5d3ad97752d173d4

SHA1
cd471a5d57e0946c19a694a6be8a3959cef30341

SHA256
8e511706c04e382e58153c274138e99a298e87e29e12548d39b7f3d3442878b9

SHA512
cf4edd9ee238c1e621501f91a4c3338ec0cb07ca2c2df00aa7c44d3db7c4f3798bc4137c11c15379d0c71fab1c5c61f19be32ba3fc39dc242313d0947461a787

Download Submit
C:\Users\Admin\AppData\Local\Temp\D566D7D7-DCD6-471C-8109-BE0AD33199E3

Filesize
64B

MD5
168f03c5c241049561d93853fa2304dc

SHA1
ee086aa5bc60436a75015003cb2dd27ae57620ff

SHA256
374d172fa5910a136fd3adba14744e6f740efc9dd62e34f870ea5698e349f60e

SHA512
169897b850ad3fa154452c34b87813f31723914110bf41e711c614e18b9850d036a2083cf908286a406d45db1c4a51f3b320792672b3287cfca08e756b5ee179

Download Submit
C:\Users\Admin\AppData\Local\Temp\F07D8C6A-04B6-4025-869C-70A788D7B5C0

Filesize
72B

MD5
7d2de92b48e783c7461bdb71204d3292

SHA1
4031583efcf4e303313f3b2beb95d4ecf903bc1e

SHA256
2e618eedfd8747e1ef8803f29610b946bd1496af51c663a6ef3c8aa12be27d65

SHA512
293edb84e30128aacaf28254a3150ae0662f06883cd48271e96afc0d8135e39e5c7cb551f57c401dbe2dc01ab3f6722e41dced7ba2f177ee80a3eebcf6e05029

Download Submit
C:\Windows\Temp\asw-5f6b7c38-1ba7-4c7b-bfa3-bc011f4665bb\avg-du\config.def

Filesize
549B

MD5
3e9c87ef79aec6ef3af203b32b003198

SHA1
82d9dbecbb20ff8160439d9f7d8b87466bcdfbef

SHA256
e3e8cbe0a09239f7c977bfc7d283c32e1a8dacd5fadc2f6643724e4e68cb8489

SHA512
88e65718a1d7b538c14822cbfe1eea21dd8c102c9b3c0c4b6dff719ec0f74e3c5c5b83b630f4c8506049b1e793ec2a1f4aed279bc44f904ca8355a0e1c4bfdc5

Download Submit
C:\Windows\Temp\asw-5f6b7c38-1ba7-4c7b-bfa3-bc011f4665bb\avg-du\icarus_product.dll

Filesize
1.9MB

MD5
cd7a61f631640064d7af4d8aefd9da0f

SHA1
5205092909cc66ae268ce3f16d1e8205a9b68dce

SHA256
aacf35b9e098d362977c4d80f8017f4e2a2171d929e3ce4e6898ff707a57f648

SHA512
6e488802562d60450764655cddeb12434f6eaf9d1dbe72befc2e53456134e0dd7b17253299b44c8e4845a738e091976530f5ef5c33b7fd4ca30f62d64e55f613

Download Submit
C:\Windows\Temp\asw-5f6b7c38-1ba7-4c7b-bfa3-bc011f4665bb\common\bug_report.exe

Filesize
4.8MB

MD5
0c0f0ca2bb49dfa3743e9d4156007c70

SHA1
042fdfba346a89a83f0c782117038a82b29a28d1

SHA256
0e1865702916ae47aafc54c6199e3a73acb735ae888f9a8dd7bc4656268ef9ea

SHA512
e15f826ce67d4d5224cdcefc3194a5a9144e152ad16136f5774d2ca29484fc11e778e2e9d114af80ad2a99907bd4999e6eef95c7b7dbbe6a7829d67c1b6bbc92

Download Submit
C:\Windows\Temp\asw-5f6b7c38-1ba7-4c7b-bfa3-bc011f4665bb\common\dump_process.exe

Filesize
3.4MB

MD5
c22d80d43019235520344972efec9ff2

SHA1
1a2b4b2a52d820f9233ca0201be9ee7f6d82adbc

SHA256
5841a3df4784e008b8f2c567f15bb28cdb4cb4ca35c750f1108dfb1ccb6011f0

SHA512
f1cadbc3077379a6d7e36b8cf3bc830f44b5e668d4a6c0ce6b62bde292498c4f41c6588c5eba2599aa67524acfd125b7f23c419ae2b4a8e4afea7708aad83edc

Download Submit
C:\Windows\Temp\asw-5f6b7c38-1ba7-4c7b-bfa3-bc011f4665bb\common\icarus.exe

Filesize
7.7MB

MD5
97856ab19be2842f985c899ccde7e312

SHA1
4b33ff3baeba3b61ee040b1d00ebff0531cc21ef

SHA256
2569a72d3a55ea7ad690d708907245c221664c5c88cadbc19e1967135fa40514

SHA512
b2f57fd7c482977ebf52b49e50e57f60f1bf87be5bbf54c0dcfb3038c0f46b89c70f10161fab7585d01b90c4fdc00b86932444f32528fed04b514c6746bff29f

Download Submit
C:\Windows\Temp\asw-5f6b7c38-1ba7-4c7b-bfa3-bc011f4665bb\common\icarus_ui.exe

Filesize
11.8MB

MD5
7ebae16a6ea514e55f7160c3539261cc

SHA1
ae74b3af4926b6932aea68a32c7c8727d53a94e7

SHA256
f27f92f003505dbca839513d233198211860de0ef487973a5ce0761d8e8ebfb9

SHA512
f7c7c084517785f21ae0bd82509ddc31e985edbe9e07f275414806afa3f696037340ea0e6091221a5d81250adf170ca0fa4345915d000eaba6034a9db0f61369

Download Submit
C:\Windows\Temp\asw-5f6b7c38-1ba7-4c7b-bfa3-bc011f4665bb\common\product-def.xml

Filesize
236KB

MD5
8c5323746bb544d2d645669ef66e837e

SHA1
1f68291c6ccb56928147380bbee27b56719c6124

SHA256
8c884f7cb8aade0a0d7fe2fa18819b5f3c2c4578d5318efc2b6b468114ca0377

SHA512
57938a13c256624e6496ea43ed99cc9f6ab19a68b581bfadedbbbbed2a4c427190530927a40f73146c14818676aceb56c1d772b195d6df51e9f79cd5a65902fb

Download Submit
C:\Windows\Temp\asw-5f6b7c38-1ba7-4c7b-bfa3-bc011f4665bb\common\product-info.xml

Filesize
6KB

MD5
f3dba4960b27996f6c252c86f4ed3aaa

SHA1
93e2c8ca65d3033f6b472c6f56b7f5e6db699605

SHA256
e6cb33b6976bcadfb145d3a1ab02ba6cf8fbf3cca1cf0f4072f9347404094591

SHA512
8a820024268c454208faf85ede1b4bd91ebec1e65195bc5d0682f78a2249f510f22e9adcd2346a455965448a7cc952c0435acb00ac9b7975162696c277789e8a

Download Submit
C:\Windows\Temp\asw-5f6b7c38-1ba7-4c7b-bfa3-bc011f4665bb\common\setupui.cont

Filesize
230KB

MD5
32c8d75781f31574f623ebb46ce751b1

SHA1
9d5849bf95e018b430f9e5c9fd4fe248dc7b305f

SHA256
03145c2328f7e1164cc4850581c407557c2cac64cd193accd3552a6aa4706e36

SHA512
33fc7ab05501d52fc0b2493a8f2c91cd7762aaf307ec65904f6a77394432f1c121b467d7edb83360552e3c36832043b1ee5e552f6a65c81d1aec425ea3582a95

Download Submit
C:\Windows\Temp\asw-5f6b7c38-1ba7-4c7b-bfa3-bc011f4665bb\ecoo.edat

Filesize
21B

MD5
8f0e382f7c6d3db50619f7056dbb94ef

SHA1
029aece8f5cc6d64b158f646070fe5f6a9534cd8

SHA256
4df71c032dcfed706c76079099c361571d5b273061f4d8d8d0c3b2d37f56c2e6

SHA512
32bd76b23bc171f998a38d124387a08fb216f7b6b9d1f5ef54d41346b9794d3c7bcaed0b724a437c58b90d85379449c037e6d4a258cce5ebfd2d252648face6f

Download Submit
C:\Windows\Temp\asw-5f6b7c38-1ba7-4c7b-bfa3-bc011f4665bb\icarus-info.xml

Filesize
1KB

MD5
01a9a34fa2319805c46f11faa05a47cf

SHA1
d861e2fd6ce5ffca26c41fdadae0aec36a510ef2

SHA256
6db28d2b6a02d41dec69465d8fe68bdc8c2b78cdb5f4a16be338a1c0b1a94c89

SHA512
e12d6f785916eda5596d2dde28ba8196ed916e8f91bb97a1f634a6673fcf321e005634e9b49977c04bfa7ed7daeed461160815622512f014515a7fd3dd505a6d

Download Submit