Resubmissions

27/11/2024, 10:04

241127-l3zw7awjam 10

03/08/2023, 17:57

230803-wjqvaagd2s 10

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-1703_x64
  • resource
    win10-20230703-en
  • resource tags

    arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
  • submitted
    03/08/2023, 17:57

General

  • Target

    8763813113.exe

  • Size

    448KB

  • MD5

    9efdb9b9eb70d34702b4b30cf8f5bb7d

  • SHA1

    76eb914250cc4a75232744827d3f9751ff634a21

  • SHA256

    cd30eb3dd9b99f4a7a39e3608e1e50ae2333870c93c59c8e7bcfb898040bbffa

  • SHA512

    d55a0c001778dc6b3d71bc393b98a3c961b16dcf6c117f4397cafa2ac23b5f9fda90e4dd3e3d90cd67a593092bc128b8995e50e436f97313aac7bc9f6189e361

  • SSDEEP

    6144:L/E8DIpjK28t4snQTlp3z/pSZ+pDKpf9EkQbKxVK+PXItNOapG8RuzRiRh3Zi:dEpj7snkv/cgu4VGn6OaM+ucj

Malware Config

Signatures

  • Detect rhadamanthys stealer shellcode 5 IoCs
  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 8 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 2 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3188
      • C:\Users\Admin\AppData\Local\Temp\8763813113.exe
        "C:\Users\Admin\AppData\Local\Temp\8763813113.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3532
      • C:\Windows\system32\certreq.exe
        "C:\Windows\system32\certreq.exe"
        2⤵
        • Deletes itself
        • Suspicious behavior: EnumeratesProcesses
        PID:924
      • C:\Windows\System32\cmd.exe
        C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4880
        • C:\Windows\System32\powercfg.exe
          powercfg /x -hibernate-timeout-ac 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3468
        • C:\Windows\System32\powercfg.exe
          powercfg /x -hibernate-timeout-dc 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:400
        • C:\Windows\System32\powercfg.exe
          powercfg /x -standby-timeout-ac 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3764
        • C:\Windows\System32\powercfg.exe
          powercfg /x -standby-timeout-dc 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2148
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#eoddjntm#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -RunLevel 'Highest' -Force; }
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4376
      • C:\Windows\System32\schtasks.exe
        C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
        2⤵
          PID:5104
        • C:\Windows\System32\cmd.exe
          C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4744
          • C:\Windows\System32\powercfg.exe
            powercfg /x -hibernate-timeout-ac 0
            3⤵
              PID:2076
            • C:\Windows\System32\powercfg.exe
              powercfg /x -hibernate-timeout-dc 0
              3⤵
                PID:3160
              • C:\Windows\System32\powercfg.exe
                powercfg /x -standby-timeout-ac 0
                3⤵
                  PID:4748
                • C:\Windows\System32\powercfg.exe
                  powercfg /x -standby-timeout-dc 0
                  3⤵
                    PID:3936
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#eoddjntm#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -RunLevel 'Highest' -Force; }
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3040
                • C:\Windows\System32\conhost.exe
                  C:\Windows\System32\conhost.exe
                  2⤵
                    PID:2344
                  • C:\Windows\explorer.exe
                    C:\Windows\explorer.exe
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4512
                • C:\Users\Admin\AppData\Local\Microsoft\]V(SZ~OEm.exe
                  "C:\Users\Admin\AppData\Local\Microsoft\]V(SZ~OEm.exe"
                  1⤵
                  • Suspicious use of NtCreateUserProcessOtherParentProcess
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4144
                • C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe
                  C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe
                  1⤵
                  • Suspicious use of NtCreateUserProcessOtherParentProcess
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:2448

                Network

                MITRE ATT&CK Matrix

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                  Filesize

                  3KB

                  MD5

                  91897de07fcb115c5f42cf4c7a984982

                  SHA1

                  4903ea814fed6c31b62b394cc9eb024d107b1834

                  SHA256

                  bb34e4a3e0dd9623e77f569dbd0093b19dd43e91bb911dc7758e09fb4a53f789

                  SHA512

                  54fbd604758c7bc66151018d18bdb140d26e8dcc5d03e974197b0f3b63946eb338bf323f80b4a3e02fd109337cc1c7c8389eb15b17e0d55fced35a0398efcf4b

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                  Filesize

                  1KB

                  MD5

                  8cb4bbdfc748ca5c6a523d35ddd32af7

                  SHA1

                  1210eab7fd183e8db5165b0e04f1608c0238fe71

                  SHA256

                  474dcbca2194069b614f52a85455ab5b9d0759c7f48c97738922991255390462

                  SHA512

                  1e5ffc09b5950868196e315eafa453aa941eeebddb1c192e99e738a970999e8032252bd57f6cbfb72637773f0539f1478e2c6f9e93282e4ce3f8a792cdc22d1e

                • C:\Users\Admin\AppData\Local\Microsoft\]V(SZ~OEm.exe

                  Filesize

                  11.4MB

                  MD5

                  c20b9ea19f248767189aab29e9691385

                  SHA1

                  11ba355b56728dfed08d6dc04b11f62ebff45052

                  SHA256

                  da49e4f08991b86db99741942e8b5a252e7757a5080b10e9c82922ab25372cf0

                  SHA512

                  1ac09be7e521623f0cb6c2a5079d7db2153f85e085e44fb9228f38ed472f9392bf9b5136e0fc8955353a206e2a2aaea76db9343cd2a2e28a2b5f5de2a081f3ac

                • C:\Users\Admin\AppData\Local\Microsoft\]V(SZ~OEm.exe

                  Filesize

                  11.4MB

                  MD5

                  c20b9ea19f248767189aab29e9691385

                  SHA1

                  11ba355b56728dfed08d6dc04b11f62ebff45052

                  SHA256

                  da49e4f08991b86db99741942e8b5a252e7757a5080b10e9c82922ab25372cf0

                  SHA512

                  1ac09be7e521623f0cb6c2a5079d7db2153f85e085e44fb9228f38ed472f9392bf9b5136e0fc8955353a206e2a2aaea76db9343cd2a2e28a2b5f5de2a081f3ac

                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_do2y1uw3.5h0.ps1

                  Filesize

                  1B

                  MD5

                  c4ca4238a0b923820dcc509a6f75849b

                  SHA1

                  356a192b7913b04c54574d18c28d46e6395428ab

                  SHA256

                  6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

                  SHA512

                  4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

                • C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe

                  Filesize

                  11.4MB

                  MD5

                  c20b9ea19f248767189aab29e9691385

                  SHA1

                  11ba355b56728dfed08d6dc04b11f62ebff45052

                  SHA256

                  da49e4f08991b86db99741942e8b5a252e7757a5080b10e9c82922ab25372cf0

                  SHA512

                  1ac09be7e521623f0cb6c2a5079d7db2153f85e085e44fb9228f38ed472f9392bf9b5136e0fc8955353a206e2a2aaea76db9343cd2a2e28a2b5f5de2a081f3ac

                • C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe

                  Filesize

                  11.4MB

                  MD5

                  c20b9ea19f248767189aab29e9691385

                  SHA1

                  11ba355b56728dfed08d6dc04b11f62ebff45052

                  SHA256

                  da49e4f08991b86db99741942e8b5a252e7757a5080b10e9c82922ab25372cf0

                  SHA512

                  1ac09be7e521623f0cb6c2a5079d7db2153f85e085e44fb9228f38ed472f9392bf9b5136e0fc8955353a206e2a2aaea76db9343cd2a2e28a2b5f5de2a081f3ac

                • memory/924-146-0x00007FF7D74D0000-0x00007FF7D75FD000-memory.dmp

                  Filesize

                  1.2MB

                • memory/924-154-0x00007FF7D74D0000-0x00007FF7D75FD000-memory.dmp

                  Filesize

                  1.2MB

                • memory/924-139-0x0000029CD43C0000-0x0000029CD43C3000-memory.dmp

                  Filesize

                  12KB

                • memory/924-142-0x0000029CD6460000-0x0000029CD6467000-memory.dmp

                  Filesize

                  28KB

                • memory/924-143-0x00007FF7D74D0000-0x00007FF7D75FD000-memory.dmp

                  Filesize

                  1.2MB

                • memory/924-144-0x00007FF7D74D0000-0x00007FF7D75FD000-memory.dmp

                  Filesize

                  1.2MB

                • memory/924-145-0x00007FF7D74D0000-0x00007FF7D75FD000-memory.dmp

                  Filesize

                  1.2MB

                • memory/924-163-0x00007FFBAFF40000-0x00007FFBB011B000-memory.dmp

                  Filesize

                  1.9MB

                • memory/924-147-0x00007FF7D74D0000-0x00007FF7D75FD000-memory.dmp

                  Filesize

                  1.2MB

                • memory/924-150-0x00007FF7D74D0000-0x00007FF7D75FD000-memory.dmp

                  Filesize

                  1.2MB

                • memory/924-152-0x00007FF7D74D0000-0x00007FF7D75FD000-memory.dmp

                  Filesize

                  1.2MB

                • memory/924-181-0x0000029CD6460000-0x0000029CD6465000-memory.dmp

                  Filesize

                  20KB

                • memory/924-153-0x00007FF7D74D0000-0x00007FF7D75FD000-memory.dmp

                  Filesize

                  1.2MB

                • memory/924-155-0x00007FFBAFF40000-0x00007FFBB011B000-memory.dmp

                  Filesize

                  1.9MB

                • memory/924-156-0x00007FF7D74D0000-0x00007FF7D75FD000-memory.dmp

                  Filesize

                  1.2MB

                • memory/924-157-0x00007FF7D74D0000-0x00007FF7D75FD000-memory.dmp

                  Filesize

                  1.2MB

                • memory/924-158-0x00007FF7D74D0000-0x00007FF7D75FD000-memory.dmp

                  Filesize

                  1.2MB

                • memory/924-159-0x00007FF7D74D0000-0x00007FF7D75FD000-memory.dmp

                  Filesize

                  1.2MB

                • memory/924-160-0x00007FF7D74D0000-0x00007FF7D75FD000-memory.dmp

                  Filesize

                  1.2MB

                • memory/924-182-0x00007FFBAFF40000-0x00007FFBB011B000-memory.dmp

                  Filesize

                  1.9MB

                • memory/924-127-0x0000029CD43C0000-0x0000029CD43C3000-memory.dmp

                  Filesize

                  12KB

                • memory/2448-261-0x0000017C1FCB0000-0x0000017C203DE000-memory.dmp

                  Filesize

                  7.2MB

                • memory/2448-272-0x00007FFBAD5F0000-0x00007FFBAD68D000-memory.dmp

                  Filesize

                  628KB

                • memory/2448-355-0x00007FF7B9180000-0x00007FF7B9D2F000-memory.dmp

                  Filesize

                  11.7MB

                • memory/2448-354-0x00007FF7B9180000-0x00007FF7B9D2F000-memory.dmp

                  Filesize

                  11.7MB

                • memory/2448-257-0x00007FF7B9180000-0x00007FF7B9D2F000-memory.dmp

                  Filesize

                  11.7MB

                • memory/2448-260-0x00007FF7B9180000-0x00007FF7B9D2F000-memory.dmp

                  Filesize

                  11.7MB

                • memory/2448-267-0x0000017C1FCB0000-0x0000017C203DE000-memory.dmp

                  Filesize

                  7.2MB

                • memory/2448-271-0x00007FFBAE850000-0x00007FFBAE8FE000-memory.dmp

                  Filesize

                  696KB

                • memory/2448-273-0x0000017C1E370000-0x0000017C1E371000-memory.dmp

                  Filesize

                  4KB

                • memory/2448-275-0x00007FFBAFF40000-0x00007FFBB011B000-memory.dmp

                  Filesize

                  1.9MB

                • memory/2448-277-0x00007FFBACC60000-0x00007FFBACEA9000-memory.dmp

                  Filesize

                  2.3MB

                • memory/2448-278-0x00007FFBAD5F0000-0x00007FFBAD68D000-memory.dmp

                  Filesize

                  628KB

                • memory/2448-279-0x00007FF7B9180000-0x00007FF7B9D2F000-memory.dmp

                  Filesize

                  11.7MB

                • memory/2448-280-0x00007FF7B9180000-0x00007FF7B9D2F000-memory.dmp

                  Filesize

                  11.7MB

                • memory/2448-281-0x0000017C1FCB0000-0x0000017C203DE000-memory.dmp

                  Filesize

                  7.2MB

                • memory/3040-315-0x00000193CA0C0000-0x00000193CA0D0000-memory.dmp

                  Filesize

                  64KB

                • memory/3040-296-0x00007FFB93DD0000-0x00007FFB947BC000-memory.dmp

                  Filesize

                  9.9MB

                • memory/3040-297-0x00000193CA0C0000-0x00000193CA0D0000-memory.dmp

                  Filesize

                  64KB

                • memory/3040-299-0x00000193CA0C0000-0x00000193CA0D0000-memory.dmp

                  Filesize

                  64KB

                • memory/3040-337-0x00007FFB93DD0000-0x00007FFB947BC000-memory.dmp

                  Filesize

                  9.9MB

                • memory/3040-334-0x00000193CA0C0000-0x00000193CA0D0000-memory.dmp

                  Filesize

                  64KB

                • memory/3532-125-0x00000000024D0000-0x00000000028D0000-memory.dmp

                  Filesize

                  4.0MB

                • memory/3532-130-0x00000000031D0000-0x0000000003206000-memory.dmp

                  Filesize

                  216KB

                • memory/3532-123-0x00000000024D0000-0x00000000028D0000-memory.dmp

                  Filesize

                  4.0MB

                • memory/3532-124-0x00000000024D0000-0x00000000028D0000-memory.dmp

                  Filesize

                  4.0MB

                • memory/3532-122-0x0000000000480000-0x0000000000487000-memory.dmp

                  Filesize

                  28KB

                • memory/3532-137-0x00000000024D0000-0x00000000028D0000-memory.dmp

                  Filesize

                  4.0MB

                • memory/3532-126-0x00000000024D0000-0x00000000028D0000-memory.dmp

                  Filesize

                  4.0MB

                • memory/3532-136-0x00000000031D0000-0x0000000003206000-memory.dmp

                  Filesize

                  216KB

                • memory/4144-190-0x0000023792900000-0x000002379302E000-memory.dmp

                  Filesize

                  7.2MB

                • memory/4144-179-0x00007FFBAD5F0000-0x00007FFBAD68D000-memory.dmp

                  Filesize

                  628KB

                • memory/4144-254-0x00007FF7BBE60000-0x00007FF7BCA0F000-memory.dmp

                  Filesize

                  11.7MB

                • memory/4144-253-0x00007FFBAD5F0000-0x00007FFBAD68D000-memory.dmp

                  Filesize

                  628KB

                • memory/4144-252-0x00007FFBACC60000-0x00007FFBACEA9000-memory.dmp

                  Filesize

                  2.3MB

                • memory/4144-251-0x00007FFBAE850000-0x00007FFBAE8FE000-memory.dmp

                  Filesize

                  696KB

                • memory/4144-250-0x00007FFBAFF40000-0x00007FFBB011B000-memory.dmp

                  Filesize

                  1.9MB

                • memory/4144-168-0x00007FF7BBE60000-0x00007FF7BCA0F000-memory.dmp

                  Filesize

                  11.7MB

                • memory/4144-172-0x0000023792900000-0x000002379302E000-memory.dmp

                  Filesize

                  7.2MB

                • memory/4144-174-0x0000023792900000-0x000002379302E000-memory.dmp

                  Filesize

                  7.2MB

                • memory/4144-178-0x00007FFBAE850000-0x00007FFBAE8FE000-memory.dmp

                  Filesize

                  696KB

                • memory/4144-255-0x00007FF7BBE60000-0x00007FF7BCA0F000-memory.dmp

                  Filesize

                  11.7MB

                • memory/4144-180-0x0000023792860000-0x0000023792861000-memory.dmp

                  Filesize

                  4KB

                • memory/4144-184-0x00007FFBAFF40000-0x00007FFBB011B000-memory.dmp

                  Filesize

                  1.9MB

                • memory/4144-186-0x00007FFBACC60000-0x00007FFBACEA9000-memory.dmp

                  Filesize

                  2.3MB

                • memory/4144-166-0x00007FF7BBE60000-0x00007FF7BCA0F000-memory.dmp

                  Filesize

                  11.7MB

                • memory/4144-189-0x00007FF7BBE60000-0x00007FF7BCA0F000-memory.dmp

                  Filesize

                  11.7MB

                • memory/4144-188-0x00007FF7BBE60000-0x00007FF7BCA0F000-memory.dmp

                  Filesize

                  11.7MB

                • memory/4144-187-0x00007FFBAD5F0000-0x00007FFBAD68D000-memory.dmp

                  Filesize

                  628KB

                • memory/4376-205-0x0000029A47930000-0x0000029A47952000-memory.dmp

                  Filesize

                  136KB

                • memory/4376-206-0x00007FFB93DD0000-0x00007FFB947BC000-memory.dmp

                  Filesize

                  9.9MB

                • memory/4376-207-0x0000029A47AF0000-0x0000029A47B00000-memory.dmp

                  Filesize

                  64KB

                • memory/4376-208-0x0000029A47AF0000-0x0000029A47B00000-memory.dmp

                  Filesize

                  64KB

                • memory/4376-211-0x0000029A60070000-0x0000029A600E6000-memory.dmp

                  Filesize

                  472KB

                • memory/4376-224-0x0000029A47AF0000-0x0000029A47B00000-memory.dmp

                  Filesize

                  64KB

                • memory/4376-243-0x0000029A47AF0000-0x0000029A47B00000-memory.dmp

                  Filesize

                  64KB

                • memory/4376-247-0x00007FFB93DD0000-0x00007FFB947BC000-memory.dmp

                  Filesize

                  9.9MB

                • memory/4512-358-0x0000000002160000-0x00000000021A0000-memory.dmp

                  Filesize

                  256KB

                • memory/4512-363-0x00000000006A0000-0x00000000006C0000-memory.dmp

                  Filesize

                  128KB