File name:

icarus_sfx.exe

Full analysis: https://app.any.run/tasks/c81d9561-0909-4401-ada2-afceed09fff7
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: November 05, 2023, 03:39:58
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
lumma
stealer
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

0943D1D429A98057DBD293BD3E25ACC3

SHA1:

5CEC545B9061CA87F2556409EBB965930B51CECB

SHA256:

DCF250DC8A9683CF5A3E7DFDB441B06E15B391A8C5D97B31431C650A715432A6

SSDEEP:

98304:RmEw6FCbOPjO3oq+e2+Q1hBnNd2pLMlz73HfRL6zv/VN3EH4aK2UCC44CY1jRpL1:hD2NqKsD+txgY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to the CnC server

      • icarus_sfx.exe (PID: 3440)

    • LUMMA has been detected (SURICATA)

      • icarus_sfx.exe (PID: 3440)

    • Drops the executable file immediately after the start

      • icarus_sfx.exe (PID: 3440)
      • dihrnfduekdao.exe (PID: 3276)

    • Changes the autorun value in the registry

      • Utsysc.exe (PID: 3632)

    • Uses Task Scheduler to run other applications

      • Utsysc.exe (PID: 3632)

    • Actions looks like stealing of personal data

      • icarus_sfx.exe (PID: 3440)

  • SUSPICIOUS

    • Reads the Internet Settings

      • icarus_sfx.exe (PID: 3440)
      • dihrnfduekdao.exe (PID: 3276)
      • Utsysc.exe (PID: 3632)

    • Reads browser cookies

      • icarus_sfx.exe (PID: 3440)

    • Process requests binary or script from the Internet

      • icarus_sfx.exe (PID: 3440)

    • Searches for installed software

      • icarus_sfx.exe (PID: 3440)

    • The process executes via Task Scheduler

      • Utsysc.exe (PID: 3952)
      • Utsysc.exe (PID: 4020)

    • Starts itself from another location

      • dihrnfduekdao.exe (PID: 3276)

  • INFO

    • Checks supported languages

      • icarus_sfx.exe (PID: 3440)
      • wmpnscfg.exe (PID: 3472)
      • dihrnfduekdao.exe (PID: 3276)
      • Utsysc.exe (PID: 3632)
      • Utsysc.exe (PID: 3952)
      • Utsysc.exe (PID: 4020)

    • Reads the computer name

      • icarus_sfx.exe (PID: 3440)
      • wmpnscfg.exe (PID: 3472)
      • dihrnfduekdao.exe (PID: 3276)
      • Utsysc.exe (PID: 3632)

    • Checks proxy server information

      • icarus_sfx.exe (PID: 3440)
      • Utsysc.exe (PID: 3632)

    • Reads the machine GUID from the registry

      • icarus_sfx.exe (PID: 3440)
      • wmpnscfg.exe (PID: 3472)
      • Utsysc.exe (PID: 3632)
      • dihrnfduekdao.exe (PID: 3276)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3472)

    • Create files in a temporary directory

      • icarus_sfx.exe (PID: 3440)
      • dihrnfduekdao.exe (PID: 3276)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:10:29 15:34:23+01:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 433664
InitializedDataSize: 199680
UninitializedDataSize: -
EntryPoint: 0x9e2ec9
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 20.5.1460.0
ProductVersionNumber: 5.2.5137.722
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Privax Limited
FileDescription: Privax Self-Extract Package
FileVersion: 20.5.1460.0
InternalName: icarus_sfx
LegalCopyright: 2023 Privax Limited
OriginalFileName: icarus_sfx.exe
ProductId: privax-icarus
ProductName: Privax Installer
ProductVersion: 5.2.5137.722
Vpnincluded: 5.2.5137.722
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
7
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #LUMMA icarus_sfx.exe wmpnscfg.exe no specs dihrnfduekdao.exe no specs utsysc.exe schtasks.exe no specs utsysc.exe no specs utsysc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3276"C:\Users\admin\AppData\Local\Temp\dihrnfduekdao.exe"C:\Users\admin\AppData\Local\Temp\dihrnfduekdao.exe—icarus_sfx.exe
User:
admin
Company:
ESTsoft Corp.
Integrity Level:
MEDIUM
Description:
ALZip
Exit code:
0
Version:
23.3.9.1
Modules
Images
c:\users\admin\appdata\local\temp\dihrnfduekdao.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
3440"C:\Users\admin\Desktop\icarus_sfx.exe" C:\Users\admin\Desktop\icarus_sfx.exe
explorer.exe
User:
admin
Company:
Privax Limited
Integrity Level:
MEDIUM
Description:
Privax Self-Extract Package
Exit code:
0
Version:
20.5.1460.0
Modules
Images
c:\users\admin\desktop\icarus_sfx.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3472"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
3632"C:\Users\admin\AppData\Local\Temp\b64c58644b\Utsysc.exe" C:\Users\admin\AppData\Local\Temp\b64c58644b\Utsysc.exe
dihrnfduekdao.exe
User:
admin
Company:
ESTsoft Corp.
Integrity Level:
MEDIUM
Description:
ALZip
Exit code:
0
Version:
23.3.9.1
Modules
Images
c:\users\admin\appdata\local\temp\b64c58644b\utsysc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
3644"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\admin\AppData\Local\Temp\b64c58644b\Utsysc.exe" /FC:\Windows\System32\schtasks.exe—Utsysc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
3952C:\Users\admin\AppData\Local\Temp\b64c58644b\Utsysc.exe C:\Users\admin\AppData\Local\Temp\b64c58644b\Utsysc.exe—taskeng.exe
User:
admin
Company:
ESTsoft Corp.
Integrity Level:
MEDIUM
Description:
ALZip
Exit code:
0
Version:
23.3.9.1
Modules
Images
c:\users\admin\appdata\local\temp\b64c58644b\utsysc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
4020C:\Users\admin\AppData\Local\Temp\b64c58644b\Utsysc.exe C:\Users\admin\AppData\Local\Temp\b64c58644b\Utsysc.exe—taskeng.exe
User:
admin
Company:
ESTsoft Corp.
Integrity Level:
MEDIUM
Description:
ALZip
Exit code:
0
Version:
23.3.9.1
Modules
Images
c:\users\admin\appdata\local\temp\b64c58644b\utsysc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
Total events
1 766
Read events
1 717
Write events
46
Delete events
3

Modification events

(PID) Process:(3440) icarus_sfx.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3440) icarus_sfx.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3440) icarus_sfx.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3440) icarus_sfx.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000059010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3472) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{8CD3BD46-74A9-42EF-B0FD-2640DDCEBB59}\{09036BC1-3CBF-4510-B1F9-9178937B8F73}
Operation:delete keyName:(default)
Value:
(PID) Process:(3472) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{8CD3BD46-74A9-42EF-B0FD-2640DDCEBB59}
Operation:delete keyName:(default)
Value:
(PID) Process:(3472) wmpnscfg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Health\{7AF6DC3E-CFA4-476A-8AB9-707507DA58CB}
Operation:delete keyName:(default)
Value:
(PID) Process:(3276) dihrnfduekdao.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3276) dihrnfduekdao.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3276) dihrnfduekdao.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
Executable files
2
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3440icarus_sfx.exeC:\Users\admin\AppData\Local\Temp\dihrnfduekdao.exeexecutable
MD5:3E478DCC2A01B6115012627F06045690
SHA256:06DE55C057B8778E494903B3DA7588E4C9D1CEC766F969000D7986ED31F213CB
3276dihrnfduekdao.exeC:\Users\admin\AppData\Local\Temp\b64c58644b\Utsysc.exeexecutable
MD5:3E478DCC2A01B6115012627F06045690
SHA256:06DE55C057B8778E494903B3DA7588E4C9D1CEC766F969000D7986ED31F213CB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
34
TCP/UDP connections
41
DNS requests
3
Threats
42

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3440
icarus_sfx.exe
POST
200
172.67.142.161:80
http://oluaskaz.pw/api
unknown
text
2 b
unknown
3440
icarus_sfx.exe
POST
200
172.67.142.161:80
http://oluaskaz.pw/api
unknown
text
8.60 Kb
unknown
3440
icarus_sfx.exe
POST
200
172.67.142.161:80
http://oluaskaz.pw/api
unknown
text
2 b
unknown
3440
icarus_sfx.exe
POST
200
172.67.142.161:80
http://oluaskaz.pw/api
unknown
text
2 b
unknown
3440
icarus_sfx.exe
POST
200
172.67.142.161:80
http://oluaskaz.pw/api
unknown
text
2 b
unknown
3440
icarus_sfx.exe
POST
200
172.67.142.161:80
http://oluaskaz.pw/api
unknown
text
2 b
unknown
3440
icarus_sfx.exe
POST
200
172.67.142.161:80
http://oluaskaz.pw/api
unknown
text
2 b
unknown
3440
icarus_sfx.exe
POST
200
172.67.142.161:80
http://oluaskaz.pw/api
unknown
text
2 b
unknown
3440
icarus_sfx.exe
POST
200
172.67.142.161:80
http://oluaskaz.pw/api
unknown
text
2 b
unknown
3440
icarus_sfx.exe
POST
200
172.67.142.161:80
http://oluaskaz.pw/api
unknown
text
2 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
3440
icarus_sfx.exe
172.67.142.161:80
oluaskaz.pw
CLOUDFLARENET
US
unknown
3440
icarus_sfx.exe
77.95.113.11:80
thehighestinstitut.com
—
GB
unknown
3632
Utsysc.exe
185.172.128.100:80
—
OOO Nadym Svyaz Service
RU
unknown

DNS requests

Domain
IP
Reputation
oluaskaz.pw
  • 172.67.142.161
  • 104.21.95.30
malicious
thehighestinstitut.com
  • 77.95.113.11
unknown
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

PID
Process
Class
Message
1080
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.pw domain - Likely Hostile
3440
icarus_sfx.exe
Misc activity
ET INFO HTTP Request to a *.pw domain
3440
icarus_sfx.exe
Malware Command and Control Activity Detected
ET MALWARE [ANY.RUN] Win32/Lumma Stealer Check-In
—
—
Malware Command and Control Activity Detected
STEALER [ANY.RUN] Win32/Lumma Stealer Check-In
3440
icarus_sfx.exe
Misc activity
ET INFO HTTP Request to a *.pw domain
3440
icarus_sfx.exe
Malware Command and Control Activity Detected
ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration
3440
icarus_sfx.exe
Malware Command and Control Activity Detected
STEALER [ANY.RUN] Win32/Lumma Stealer Exfiltration
3440
icarus_sfx.exe
Misc activity
ET INFO HTTP Request to a *.pw domain
3440
icarus_sfx.exe
Misc activity
ET INFO HTTP Request to a *.pw domain
3440
icarus_sfx.exe
Misc activity
ET INFO HTTP Request to a *.pw domain
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
icarus_sfx.exe