Analysis
- max time kernel
161s - max time network
170s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
29/06/2026, 12:18
General
- Target tera-term-5.6.1-installer.exe
- Size 2.0MB
- Sample260629-pgr61ac131
- SHA256 a8f2282b699ea8fce47fdc55619e0d14ef3fc76d8b4eb11675bfbf47bbdcc20b
Malware Config
Signatures
- Uses Session Manager for persistence 2 TTPs 1 IoCs
Creates Session Manager registry key to run executable early in system boot.
- Executes dropped EXE 11 IoCs
- Loads dropped DLL 3 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks for any installed AV software in registry 1 TTPs 14 IoCs
- Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 2 IoCs
- Drops file in Program Files directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Checks processor information in registry 2 TTPs 9 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 4 IoCs
- Modifies registry class 4 IoCs
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of AdjustPrivilegeToken 27 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tera-term-5.6.1-installer.exe"C:\Users\Admin\AppData\Local\Temp\tera-term-5.6.1-installer.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-IRVS8H7B39.tmp\tera-term-5.6.1-installer.tmp"C:\Users\Admin\AppData\Local\Temp\is-IRVS8H7B39.tmp\tera-term-5.6.1-installer.tmp" /SL5="$501FE,847735,840192,C:\Users\Admin\AppData\Local\Temp\tera-term-5.6.1-installer.exe"2⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-3XHO84ARA0.tmp\component0_extract\OperaSetup.exe"C:\Users\Admin\AppData\Local\Temp\is-3XHO84ARA0.tmp\component0_extract\OperaSetup.exe" --silent --allusers=0 --otd=utm.medium:apb,utm.source:ais,utm.campaign:a,utm.id:agiSfNdDBTmgUn7w1FusFRdm8MNJ0EmScVrxvP38IV0mS0isWHVcT4nRzg4TkPTL2LoyPaGDh15706zzpl3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC302B349\installer.exeC:\Users\Admin\AppData\Local\Temp\7zSC302B349\installer.exe --silent --allusers=0 --otd=utm.medium:apb,utm.source:ais,utm.campaign:a,utm.id:agiSfNdDBTmgUn7w1FusFRdm8MNJ0EmScVrxvP38IV0mS0isWHVcT4nRzg4TkPTL2LoyPaGDh15706zzpl --server-tracking-blob=MjBjMWJlMDYyMGM3YzZjYmNkNTE2NjU1YWRiYWEwNzE0OWQzM2JkZjk3MjI1MWZiZDZiYjcxNTJkOWM2ZTdlODp7ImNvdW50cnkiOiJVUyIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cyIsInRpbWVzdGFtcCI6IjE3ODI3MzA4MTIuMzI0NCIsInVzZXJhZ2VudCI6InB5dGhvbi1yZXF1ZXN0cy8yLjMyLjMiLCJ1dG0iOnt9LCJ1dWlkIjoiOGFhNGYyMWQtMDE2Yy00NmFkLWE5NzctMWNkN2NmMzQ1ZjY5In0=4⤵
- Executes dropped EXE
- Enumerates connected drives
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC302B349\installer.exeC:\Users\Admin\AppData\Local\Temp\7zSC302B349\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=133.0.5932.10 --initial-client-data=0x2b4,0x2b8,0x2bc,0x294,0x2c0,0x7ff76a1cad88,0x7ff76a1cad94,0x7ff76a1cada05⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\5bb0808d-289f-486c-bcd9-52bf2c5501df Opera Installer Temp\installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\5bb0808d-289f-486c-bcd9-52bf2c5501df Opera Installer Temp\installer.exe" --version5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\7zSC302B349\installer.exe"C:\Users\Admin\AppData\Local\Temp\7zSC302B349\installer.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=6404 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\5bb0808d-289f-486c-bcd9-52bf2c5501df Opera Installer Temp\opera_package_20260629132110" --session-guid=f0f05a8e-17cb-4946-a003-1add6039f24a --server-tracking-blob=NTc5Zjg1N2I1MTk0NTQ2YzU4ZjgxN2I1YjE1OWY2OGE0ZTMwMmVjZjdiMmU1OTQ0NDZkNTY1MjY3MzRmY2UwNzp7ImNvdW50cnkiOiJVUyIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cyIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjExIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTc4MjczMDgxMi4zMjQ0IiwidXNlcmFnZW50IjoicHl0aG9uLXJlcXVlc3RzLzIuMzIuMyIsInV0bSI6eyJjYW1wYWlnbiI6ImEiLCJpZCI6ImFnaVNmTmREQlRtZ1VuN3cxRnVzRlJkbThNTkowRW1TY1ZyeHZQMzhJVjBtUzBpc1dIVmNUNG5Semc0VGtQVEwyTG95UGFHRGgxNTcwNnp6cGwiLCJtZWRpdW0iOiJhcGIiLCJzb3VyY2UiOiJhaXMifSwidXVpZCI6IjhhYTRmMjFkLTAxNmMtNDZhZC1hOTc3LTFjZDdjZjM0NWY2OSJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=B0080000000000005⤵
- Executes dropped EXE
- Enumerates connected drives
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC302B349\installer.exeC:\Users\Admin\AppData\Local\Temp\7zSC302B349\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=133.0.5932.10 --initial-client-data=0x2ac,0x2b0,0x2c0,0x288,0x2c4,0x7ff76a1cad88,0x7ff76a1cad94,0x7ff76a1cada06⤵
- Executes dropped EXE
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-3XHO84ARA0.tmp\component1_extract\cookie_mmm_irs_ppi_008_585.exe"C:\Users\Admin\AppData\Local\Temp\is-3XHO84ARA0.tmp\component1_extract\cookie_mmm_irs_ppi_008_585.exe" /silent /ws /psh:agiSfNdDBTmgUn7w1FusElj6uN58eAnENAxPFiCpAQhjXjFmBUkzJZx71xT5vOa66hU7teGckjiGEjCkyH /cookie:mmm_irs_ppi_008_585_a3⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\asw-1f0ae1bc-2ddc-4081-b937-13c72d7cf8f8\common\icarus.exeC:\Windows\Temp\asw-1f0ae1bc-2ddc-4081-b937-13c72d7cf8f8\common\icarus.exe /icarus-info-path:C:\Windows\Temp\asw-1f0ae1bc-2ddc-4081-b937-13c72d7cf8f8\icarus-info.xml /install /silent /ws /psh:agiSfNdDBTmgUn7w1FusElj6uN58eAnENAxPFiCpAQhjXjFmBUkzJZx71xT5vOa66hU7teGckjiGEjCkyH /cookie:mmm_irs_ppi_008_585_a4⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\asw-1f0ae1bc-2ddc-4081-b937-13c72d7cf8f8\avast-av-vps\icarus.exeC:\Windows\Temp\asw-1f0ae1bc-2ddc-4081-b937-13c72d7cf8f8\avast-av-vps\icarus.exe /silent /ws /psh:agiSfNdDBTmgUn7w1FusElj6uN58eAnENAxPFiCpAQhjXjFmBUkzJZx71xT5vOa66hU7teGckjiGEjCkyH /cookie:mmm_irs_ppi_008_585_a /er_master:master_ep_d552064f-e8e9-4b70-b1bd-92681d86bdae /er_slave:avast-av-vps_slave_ep_7475f7c2-40bc-40f9-896e-1b3164a45b86 /slave:avast-av-vps5⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Temp\asw-1f0ae1bc-2ddc-4081-b937-13c72d7cf8f8\avast-suite\icarus.exeC:\Windows\Temp\asw-1f0ae1bc-2ddc-4081-b937-13c72d7cf8f8\avast-suite\icarus.exe /silent /ws /psh:agiSfNdDBTmgUn7w1FusElj6uN58eAnENAxPFiCpAQhjXjFmBUkzJZx71xT5vOa66hU7teGckjiGEjCkyH /cookie:mmm_irs_ppi_008_585_a /er_master:master_ep_d552064f-e8e9-4b70-b1bd-92681d86bdae /er_slave:avast-suite_slave_ep_aa0a048d-be36-4149-b85b-d99e9299828e /slave:avast-suite5⤵
- Uses Session Manager for persistence
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe" /select,"C:\Users\Admin\Downloads\tera-term-5.6.1-installer.exe"3⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 20363⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 20363⤵
- Program crash
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4232 -ip 42321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4232 -ip 42321⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
ICU.txt
aswRvrt.dll
diskCleanup.js
doNotDisturb.js
driverUpdater.js
dsMetadata.json
feedbackForm.js
firewall.js
genAi.js
i18n.js
kin.js
libs.js
locale-ar.json
locale-be.json
hns_tools.dll
networks.xml.ipending.b15af381
icarus.log
icarus.log
icarus.log
icarus.log
sfx.log
icarus.ini
temporary_proxy.ini
installer.exe
100.png
101.png
SUCCESS.png
component0.zip
OperaSetup.exe
component1.zip
cookie_mmm_irs_ppi_008_585.exe
image.png
tera-term-5.6.1-installer.tmp
settings.dat
config.def
icarus_product.dll
product-def.xml
product-info.xml
policy.def
policy.def
policy.def
config.def
icarus_product.dll
icarus_rvrt.exe
bug_report.exe
dump_process.exe
icarus.exe
icarus_mod.dll
icarus_ui.exe
product-def.xml
product-info.xml
setupui.cont
epps.edat
giet.edat
icarus-info.xml
memory/4080-0-0x0000000000780000-0x000000000085C000-memory.dmp
memory/4080-22-0x0000000000780000-0x000000000085C000-memory.dmp
memory/4080-3183-0x0000000000780000-0x000000000085C000-memory.dmp
memory/4232-3182-0x00000000066E0000-0x0000000006820000-memory.dmp
memory/4232-34-0x00000000066E0000-0x0000000006820000-memory.dmp
memory/4232-2873-0x0000000000B00000-0x0000000000F36000-memory.dmp
memory/4232-3181-0x0000000000B00000-0x0000000000F36000-memory.dmp
memory/4232-154-0x0000000000B00000-0x0000000000F36000-memory.dmp
memory/4232-159-0x0000000000B00000-0x0000000000F36000-memory.dmp
memory/4232-133-0x00000000066E0000-0x0000000006820000-memory.dmp
memory/4232-122-0x0000000000B00000-0x0000000000F36000-memory.dmp
memory/4232-70-0x00000000066E0000-0x0000000006820000-memory.dmp
memory/4232-38-0x00000000066E0000-0x0000000006820000-memory.dmp
memory/4232-37-0x0000000000B00000-0x0000000000F36000-memory.dmp
memory/4232-152-0x0000000000B00000-0x0000000000F36000-memory.dmp
memory/4232-35-0x00000000066E0000-0x0000000006820000-memory.dmp
memory/4232-30-0x00000000066E0000-0x0000000006820000-memory.dmp
memory/4232-29-0x00000000066E0000-0x0000000006820000-memory.dmp
memory/4232-28-0x00000000066E0000-0x0000000006820000-memory.dmp
memory/4232-23-0x0000000000B00000-0x0000000000F36000-memory.dmp
memory/4232-206-0x0000000000B00000-0x0000000000F36000-memory.dmp
memory/4232-21-0x00000000032D0000-0x00000000032D1000-memory.dmp
memory/4232-20-0x00000000066E0000-0x0000000006820000-memory.dmp
memory/4232-19-0x00000000066E0000-0x0000000006820000-memory.dmp
memory/4232-6-0x00000000032D0000-0x00000000032D1000-memory.dmp