Malware Analysis Report

2025-01-02 09:19

Sample ID 230222-m6abdaba53
Target 16953811f51327a0fe686114254f292d.exe
SHA256 5f41ff61fd5b5b8596e8912be5299f855251ec7af961740a752f09cf4a6cb67a
Tags
lgoogloader rhadamanthys downloader stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

5f41ff61fd5b5b8596e8912be5299f855251ec7af961740a752f09cf4a6cb67a

Threat Level: Known bad

The file 16953811f51327a0fe686114254f292d.exe was found to be: Known bad.

Malicious Activity Summary

lgoogloader rhadamanthys downloader stealer

LgoogLoader

Rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess

Detect rhadamanthys stealer shellcode

Detects LgoogLoader payload

Loads dropped DLL

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Checks SCSI registry key(s)

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-02-22 11:04

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-02-22 11:04

Reported

2023-02-22 11:06

Platform

win7-20230220-en

Max time kernel

30s

Max time network

33s

Command Line

"C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe

"C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 cslvkney.yu8hyvfgwlgs udp

Files

memory/1108-54-0x0000000002450000-0x00000000025C3000-memory.dmp

memory/1108-55-0x000000000B850000-0x000000000BB4D000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-02-22 11:04

Reported

2023-02-22 11:06

Platform

win10v2004-20230221-en

Max time kernel

109s

Max time network

112s

Command Line

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

Signatures

Detect rhadamanthys stealer shellcode

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects LgoogLoader payload

Description Indicator Process Target
N/A N/A N/A N/A

LgoogLoader

downloader lgoogloader

Rhadamanthys

stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 3408 created 2420 N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe C:\Windows\system32\taskhostw.exe

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\fontview.exe N/A
N/A N/A C:\Windows\SysWOW64\fontview.exe N/A
N/A N/A C:\Windows\SysWOW64\fontview.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3408 set thread context of 4640 N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe

Checks SCSI registry key(s)

Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\SysWOW64\fontview.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\SysWOW64\fontview.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Windows\SysWOW64\fontview.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID C:\Windows\SysWOW64\fontview.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\SysWOW64\fontview.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\fontview.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\fontview.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3408 wrote to memory of 4472 N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
PID 3408 wrote to memory of 4472 N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
PID 3408 wrote to memory of 4472 N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
PID 3408 wrote to memory of 4648 N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
PID 3408 wrote to memory of 4648 N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
PID 3408 wrote to memory of 4648 N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
PID 3408 wrote to memory of 4640 N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
PID 3408 wrote to memory of 4640 N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
PID 3408 wrote to memory of 4640 N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
PID 3408 wrote to memory of 4640 N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
PID 3408 wrote to memory of 4640 N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
PID 3408 wrote to memory of 5060 N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe C:\Windows\SysWOW64\fontview.exe
PID 3408 wrote to memory of 5060 N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe C:\Windows\SysWOW64\fontview.exe
PID 3408 wrote to memory of 5060 N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe C:\Windows\SysWOW64\fontview.exe
PID 3408 wrote to memory of 5060 N/A C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe C:\Windows\SysWOW64\fontview.exe

Processes

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe

"C:\Users\Admin\AppData\Local\Temp\16953811f51327a0fe686114254f292d.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"

C:\Windows\SysWOW64\fontview.exe

"C:\Windows\SYSWOW64\fontview.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 14.110.152.52.in-addr.arpa udp
US 8.8.8.8:53 15.89.54.20.in-addr.arpa udp
US 8.8.8.8:53 cslvkney.yu8hyvfgwlgs udp
US 20.42.73.25:443 tcp
US 8.8.8.8:53 203.151.224.20.in-addr.arpa udp
NL 173.223.113.164:443 tcp
NL 173.223.113.131:80 tcp
US 204.79.197.203:80 tcp

Files

memory/3408-134-0x000000000C5C0000-0x000000000C8BD000-memory.dmp

memory/4640-135-0x0000000000400000-0x0000000000437000-memory.dmp

memory/4640-137-0x0000000000400000-0x0000000000437000-memory.dmp

memory/4640-138-0x0000000000400000-0x0000000000437000-memory.dmp

memory/4640-140-0x00000000015B0000-0x00000000015BD000-memory.dmp

memory/4640-139-0x0000000001190000-0x0000000001199000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\240559703.dll

MD5 8596736c157f4e9d597e640b5fd272c2
SHA1 52c13d50177761027cf834200909cb8871e2bfc0
SHA256 7788d59ce9a3935ac67aadd1d6da93feb8a6c2c4ee8b53fba51b93a8f42b3a7a
SHA512 ceb67ced3657617fbe6485642e92c44e672fc39f4c1770a92323bccee636aebeea3b788b9297787db1bb0945e194f2aa245e7f02743207577eca160488ca7d37

memory/5060-145-0x0000000000ED0000-0x0000000000F03000-memory.dmp

memory/5060-148-0x00000000011D0000-0x00000000011EC000-memory.dmp

memory/5060-150-0x00000000011D0000-0x00000000011EC000-memory.dmp

memory/5060-151-0x00000000011B0000-0x00000000011B2000-memory.dmp

memory/5060-152-0x00000000011B0000-0x00000000011B3000-memory.dmp

memory/5060-153-0x00000000011D0000-0x00000000011EC000-memory.dmp

memory/5060-154-0x0000000000ED0000-0x0000000000F03000-memory.dmp