Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
03/08/2023, 17:57
Static task
static1
Behavioral task
behavioral1
Sample
8763813113.exe
Resource
win10-20230703-en
General
-
Target
8763813113.exe
-
Size
448KB
-
MD5
9efdb9b9eb70d34702b4b30cf8f5bb7d
-
SHA1
76eb914250cc4a75232744827d3f9751ff634a21
-
SHA256
cd30eb3dd9b99f4a7a39e3608e1e50ae2333870c93c59c8e7bcfb898040bbffa
-
SHA512
d55a0c001778dc6b3d71bc393b98a3c961b16dcf6c117f4397cafa2ac23b5f9fda90e4dd3e3d90cd67a593092bc128b8995e50e436f97313aac7bc9f6189e361
-
SSDEEP
6144:L/E8DIpjK28t4snQTlp3z/pSZ+pDKpf9EkQbKxVK+PXItNOapG8RuzRiRh3Zi:dEpj7snkv/cgu4VGn6OaM+ucj
Malware Config
Signatures
-
Detect rhadamanthys stealer shellcode 5 IoCs
resource yara_rule behavioral1/memory/3532-123-0x00000000024D0000-0x00000000028D0000-memory.dmp family_rhadamanthys behavioral1/memory/3532-124-0x00000000024D0000-0x00000000028D0000-memory.dmp family_rhadamanthys behavioral1/memory/3532-125-0x00000000024D0000-0x00000000028D0000-memory.dmp family_rhadamanthys behavioral1/memory/3532-126-0x00000000024D0000-0x00000000028D0000-memory.dmp family_rhadamanthys behavioral1/memory/3532-137-0x00000000024D0000-0x00000000028D0000-memory.dmp family_rhadamanthys -
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 8 IoCs
description pid Process procid_target PID 3532 created 3188 3532 8763813113.exe 29 PID 4144 created 3188 4144 ]V(SZ~OEm.exe 29 PID 4144 created 3188 4144 ]V(SZ~OEm.exe 29 PID 4144 created 3188 4144 ]V(SZ~OEm.exe 29 PID 2448 created 3188 2448 updater.exe 29 PID 2448 created 3188 2448 updater.exe 29 PID 2448 created 3188 2448 updater.exe 29 PID 2448 created 3188 2448 updater.exe 29 -
XMRig Miner payload 2 IoCs
resource yara_rule behavioral1/memory/2448-354-0x00007FF7B9180000-0x00007FF7B9D2F000-memory.dmp xmrig behavioral1/memory/2448-355-0x00007FF7B9180000-0x00007FF7B9D2F000-memory.dmp xmrig -
Deletes itself 1 IoCs
pid Process 924 certreq.exe -
Executes dropped EXE 2 IoCs
pid Process 4144 ]V(SZ~OEm.exe 2448 updater.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2448 set thread context of 2344 2448 updater.exe 94 PID 2448 set thread context of 4512 2448 updater.exe 95 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3532 8763813113.exe 3532 8763813113.exe 3532 8763813113.exe 3532 8763813113.exe 924 certreq.exe 924 certreq.exe 924 certreq.exe 924 certreq.exe 4144 ]V(SZ~OEm.exe 4144 ]V(SZ~OEm.exe 4144 ]V(SZ~OEm.exe 4144 ]V(SZ~OEm.exe 4144 ]V(SZ~OEm.exe 4144 ]V(SZ~OEm.exe 4376 powershell.exe 4376 powershell.exe 4376 powershell.exe 4144 ]V(SZ~OEm.exe 4144 ]V(SZ~OEm.exe 2448 updater.exe 2448 updater.exe 2448 updater.exe 2448 updater.exe 2448 updater.exe 2448 updater.exe 3040 powershell.exe 3040 powershell.exe 3040 powershell.exe 2448 updater.exe 2448 updater.exe 2448 updater.exe 2448 updater.exe 4512 explorer.exe 4512 explorer.exe 4512 explorer.exe 4512 explorer.exe 4512 explorer.exe 4512 explorer.exe 4512 explorer.exe 4512 explorer.exe 4512 explorer.exe 4512 explorer.exe 4512 explorer.exe 4512 explorer.exe 4512 explorer.exe 4512 explorer.exe 4512 explorer.exe 4512 explorer.exe 4512 explorer.exe 4512 explorer.exe 4512 explorer.exe 4512 explorer.exe 4512 explorer.exe 4512 explorer.exe 4512 explorer.exe 4512 explorer.exe 4512 explorer.exe 4512 explorer.exe 4512 explorer.exe 4512 explorer.exe 4512 explorer.exe 4512 explorer.exe 4512 explorer.exe 4512 explorer.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 632 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3468 powercfg.exe Token: SeCreatePagefilePrivilege 3468 powercfg.exe Token: SeShutdownPrivilege 400 powercfg.exe Token: SeCreatePagefilePrivilege 400 powercfg.exe Token: SeShutdownPrivilege 3764 powercfg.exe Token: SeCreatePagefilePrivilege 3764 powercfg.exe Token: SeDebugPrivilege 4376 powershell.exe Token: SeShutdownPrivilege 2148 powercfg.exe Token: SeCreatePagefilePrivilege 2148 powercfg.exe Token: SeIncreaseQuotaPrivilege 4376 powershell.exe Token: SeSecurityPrivilege 4376 powershell.exe Token: SeTakeOwnershipPrivilege 4376 powershell.exe Token: SeLoadDriverPrivilege 4376 powershell.exe Token: SeSystemProfilePrivilege 4376 powershell.exe Token: SeSystemtimePrivilege 4376 powershell.exe Token: SeProfSingleProcessPrivilege 4376 powershell.exe Token: SeIncBasePriorityPrivilege 4376 powershell.exe Token: SeCreatePagefilePrivilege 4376 powershell.exe Token: SeBackupPrivilege 4376 powershell.exe Token: SeRestorePrivilege 4376 powershell.exe Token: SeShutdownPrivilege 4376 powershell.exe Token: SeDebugPrivilege 4376 powershell.exe Token: SeSystemEnvironmentPrivilege 4376 powershell.exe Token: SeRemoteShutdownPrivilege 4376 powershell.exe Token: SeUndockPrivilege 4376 powershell.exe Token: SeManageVolumePrivilege 4376 powershell.exe Token: 33 4376 powershell.exe Token: 34 4376 powershell.exe Token: 35 4376 powershell.exe Token: 36 4376 powershell.exe Token: SeIncreaseQuotaPrivilege 4376 powershell.exe Token: SeSecurityPrivilege 4376 powershell.exe Token: SeTakeOwnershipPrivilege 4376 powershell.exe Token: SeLoadDriverPrivilege 4376 powershell.exe Token: SeSystemProfilePrivilege 4376 powershell.exe Token: SeSystemtimePrivilege 4376 powershell.exe Token: SeProfSingleProcessPrivilege 4376 powershell.exe Token: SeIncBasePriorityPrivilege 4376 powershell.exe Token: SeCreatePagefilePrivilege 4376 powershell.exe Token: SeBackupPrivilege 4376 powershell.exe Token: SeRestorePrivilege 4376 powershell.exe Token: SeShutdownPrivilege 4376 powershell.exe Token: SeDebugPrivilege 4376 powershell.exe Token: SeSystemEnvironmentPrivilege 4376 powershell.exe Token: SeRemoteShutdownPrivilege 4376 powershell.exe Token: SeUndockPrivilege 4376 powershell.exe Token: SeManageVolumePrivilege 4376 powershell.exe Token: 33 4376 powershell.exe Token: 34 4376 powershell.exe Token: 35 4376 powershell.exe Token: 36 4376 powershell.exe Token: SeIncreaseQuotaPrivilege 4376 powershell.exe Token: SeSecurityPrivilege 4376 powershell.exe Token: SeTakeOwnershipPrivilege 4376 powershell.exe Token: SeLoadDriverPrivilege 4376 powershell.exe Token: SeSystemProfilePrivilege 4376 powershell.exe Token: SeSystemtimePrivilege 4376 powershell.exe Token: SeProfSingleProcessPrivilege 4376 powershell.exe Token: SeIncBasePriorityPrivilege 4376 powershell.exe Token: SeCreatePagefilePrivilege 4376 powershell.exe Token: SeBackupPrivilege 4376 powershell.exe Token: SeRestorePrivilege 4376 powershell.exe Token: SeShutdownPrivilege 4376 powershell.exe Token: SeDebugPrivilege 4376 powershell.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 3532 wrote to memory of 924 3532 8763813113.exe 71 PID 3532 wrote to memory of 924 3532 8763813113.exe 71 PID 3532 wrote to memory of 924 3532 8763813113.exe 71 PID 3532 wrote to memory of 924 3532 8763813113.exe 71 PID 4880 wrote to memory of 3468 4880 cmd.exe 78 PID 4880 wrote to memory of 3468 4880 cmd.exe 78 PID 4880 wrote to memory of 400 4880 cmd.exe 79 PID 4880 wrote to memory of 400 4880 cmd.exe 79 PID 4880 wrote to memory of 3764 4880 cmd.exe 80 PID 4880 wrote to memory of 3764 4880 cmd.exe 80 PID 4880 wrote to memory of 2148 4880 cmd.exe 81 PID 4880 wrote to memory of 2148 4880 cmd.exe 81 PID 4744 wrote to memory of 2076 4744 cmd.exe 90 PID 4744 wrote to memory of 2076 4744 cmd.exe 90 PID 4744 wrote to memory of 3160 4744 cmd.exe 91 PID 4744 wrote to memory of 3160 4744 cmd.exe 91 PID 4744 wrote to memory of 4748 4744 cmd.exe 92 PID 4744 wrote to memory of 4748 4744 cmd.exe 92 PID 4744 wrote to memory of 3936 4744 cmd.exe 93 PID 4744 wrote to memory of 3936 4744 cmd.exe 93 PID 2448 wrote to memory of 2344 2448 updater.exe 94 PID 2448 wrote to memory of 4512 2448 updater.exe 95
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\8763813113.exe"C:\Users\Admin\AppData\Local\Temp\8763813113.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3532
-
-
C:\Windows\system32\certreq.exe"C:\Windows\system32\certreq.exe"2⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
PID:924
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:3468
-
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:400
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:3764
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:2148
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#eoddjntm#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -RunLevel 'Highest' -Force; }2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4376
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"2⤵PID:5104
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵PID:2076
-
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵PID:3160
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵PID:4748
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵PID:3936
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#eoddjntm#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -RunLevel 'Highest' -Force; }2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3040
-
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe2⤵PID:2344
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4512
-
-
C:\Users\Admin\AppData\Local\Microsoft\]V(SZ~OEm.exe"C:\Users\Admin\AppData\Local\Microsoft\]V(SZ~OEm.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4144
-
C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exeC:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2448
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD591897de07fcb115c5f42cf4c7a984982
SHA14903ea814fed6c31b62b394cc9eb024d107b1834
SHA256bb34e4a3e0dd9623e77f569dbd0093b19dd43e91bb911dc7758e09fb4a53f789
SHA51254fbd604758c7bc66151018d18bdb140d26e8dcc5d03e974197b0f3b63946eb338bf323f80b4a3e02fd109337cc1c7c8389eb15b17e0d55fced35a0398efcf4b
-
Filesize
1KB
MD58cb4bbdfc748ca5c6a523d35ddd32af7
SHA11210eab7fd183e8db5165b0e04f1608c0238fe71
SHA256474dcbca2194069b614f52a85455ab5b9d0759c7f48c97738922991255390462
SHA5121e5ffc09b5950868196e315eafa453aa941eeebddb1c192e99e738a970999e8032252bd57f6cbfb72637773f0539f1478e2c6f9e93282e4ce3f8a792cdc22d1e
-
Filesize
11.4MB
MD5c20b9ea19f248767189aab29e9691385
SHA111ba355b56728dfed08d6dc04b11f62ebff45052
SHA256da49e4f08991b86db99741942e8b5a252e7757a5080b10e9c82922ab25372cf0
SHA5121ac09be7e521623f0cb6c2a5079d7db2153f85e085e44fb9228f38ed472f9392bf9b5136e0fc8955353a206e2a2aaea76db9343cd2a2e28a2b5f5de2a081f3ac
-
Filesize
11.4MB
MD5c20b9ea19f248767189aab29e9691385
SHA111ba355b56728dfed08d6dc04b11f62ebff45052
SHA256da49e4f08991b86db99741942e8b5a252e7757a5080b10e9c82922ab25372cf0
SHA5121ac09be7e521623f0cb6c2a5079d7db2153f85e085e44fb9228f38ed472f9392bf9b5136e0fc8955353a206e2a2aaea76db9343cd2a2e28a2b5f5de2a081f3ac
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
11.4MB
MD5c20b9ea19f248767189aab29e9691385
SHA111ba355b56728dfed08d6dc04b11f62ebff45052
SHA256da49e4f08991b86db99741942e8b5a252e7757a5080b10e9c82922ab25372cf0
SHA5121ac09be7e521623f0cb6c2a5079d7db2153f85e085e44fb9228f38ed472f9392bf9b5136e0fc8955353a206e2a2aaea76db9343cd2a2e28a2b5f5de2a081f3ac
-
Filesize
11.4MB
MD5c20b9ea19f248767189aab29e9691385
SHA111ba355b56728dfed08d6dc04b11f62ebff45052
SHA256da49e4f08991b86db99741942e8b5a252e7757a5080b10e9c82922ab25372cf0
SHA5121ac09be7e521623f0cb6c2a5079d7db2153f85e085e44fb9228f38ed472f9392bf9b5136e0fc8955353a206e2a2aaea76db9343cd2a2e28a2b5f5de2a081f3ac