Analysis

  • max time kernel
    146s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • submitted
    09/02/2024, 18:55

General

  • Target

    d6fc4895775aafffbd52cb8e9e731824.exe

  • Size

    1.1MB

  • MD5

    d6fc4895775aafffbd52cb8e9e731824

  • SHA1

    9762ab2f2e6bc7a3d55bc5321667ca06cf16ce00

  • SHA256

    a8c2d6bf4c101746a89855247e2472a8d4871b4bd75726d41948e802ebaf3e43

  • SHA512

    6557a7d7178b84a1cde3c92747ad2eed5da60270b06bb7df8f6d6cf738a1028a575d29804f05a01f778358e7a6aa6a1fea20295d5bdb45e05b01e18b1c983606

  • SSDEEP

    24576:rus8z4E8k29sef3ykfjptYRawBIU3gyCta0SBuNoObZJR8wrGKB/urQD:asOqfykLp7wBIhyAOBuzlvLurY

Malware Config

Extracted

Family

rhadamanthys

C2

https://91.92.255.105:8215/b45c71e9ac60e42309ff71/foj0i1cc.fi8v9

Signatures

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

  • Rhadamanthys family
  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 50 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 59 IoCs

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2452
      • C:\Windows\SysWOW64\dialer.exe
        "C:\Windows\system32\dialer.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2716
      • C:\Windows\SysWOW64\dialer.exe
        "C:\Windows\system32\dialer.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4980
    • C:\Users\Admin\AppData\Local\Temp\d6fc4895775aafffbd52cb8e9e731824.exe
      "C:\Users\Admin\AppData\Local\Temp\d6fc4895775aafffbd52cb8e9e731824.exe"
      1⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:64
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /k move Delays Delays.bat & Delays.bat & exit
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3780
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          3⤵
          • Enumerates processes with tasklist
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4800
        • C:\Windows\SysWOW64\findstr.exe
          findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:2484
        • C:\Windows\SysWOW64\findstr.exe
          findstr /I "wrsa.exe opssvc.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4888
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          3⤵
          • Enumerates processes with tasklist
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4484
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c md 25912
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1192
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c copy /b Networks + Aberdeen + Temporary + Maps + Aggressive 25912\Structure.pif
          3⤵
          • System Location Discovery: System Language Discovery
          PID:2424
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c copy /b Bowling + Micro + Britney 25912\J
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3988
        • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\25912\Structure.pif
          25912\Structure.pif 25912\J
          3⤵
          • Deletes itself
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:972
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks.exe /create /tn "SwiftSync" /tr "wscript 'C:\Users\Admin\AppData\Local\Digital Harmony Technologies\SwiftSync.js'" /sc onlogon /F /RL HIGHEST
            4⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:3388
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c schtasks.exe /create /tn "Guess" /tr "wscript 'C:\Users\Admin\AppData\Local\Digital Harmony Technologies\SwiftSync.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4832
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks.exe /create /tn "Guess" /tr "wscript 'C:\Users\Admin\AppData\Local\Digital Harmony Technologies\SwiftSync.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST
              5⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:2320
          • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\25912\Structure.pif
            C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\25912\Structure.pif
            4⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:4548
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 436
              5⤵
              • Program crash
              PID:4144
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 432
              5⤵
              • Program crash
              PID:4248
          • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\25912\Structure.pif
            C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\25912\Structure.pif
            4⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2320
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 436
              5⤵
              • Program crash
              PID:456
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 432
              5⤵
              • Program crash
              PID:3492
        • C:\Windows\SysWOW64\PING.EXE
          ping -n 15 localhost
          3⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:1640
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4548 -ip 4548
      1⤵
        PID:4668
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4548 -ip 4548
        1⤵
          PID:4312
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2320 -ip 2320
          1⤵
            PID:2096
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2320 -ip 2320
            1⤵
              PID:684

            Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\25912\J

                    Filesize

                    1.2MB

                    MD5

                    9e026102dd03937a6464c85c69a2383f

                    SHA1

                    520325a083a63ee251284fa447acb52f8004ce53

                    SHA256

                    9df3a12e7cc135b26f76b2e967df78b81fd5f505d356e9fc079bf04026931759

                    SHA512

                    26b989788ff0c2f2d626b59451a7fd6e3a2c11ea898b1066de5fb2f9fa59f87760bd10ba7db4377455ef9cd2368954d272a58a6a10e6b4fb7ca6eb6625f2fe77

                  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\25912\Structure.pif

                    Filesize

                    924KB

                    MD5

                    848164d084384c49937f99d5b894253e

                    SHA1

                    3055ef803eeec4f175ebf120f94125717ee12444

                    SHA256

                    f58d3a4b2f3f7f10815c24586fae91964eeed830369e7e0701b43895b0cefbd3

                    SHA512

                    aabe1cf076f48f32542f49a92e4ca9f054b31d5a9949119991b897b9489fe775d8009896408ba49ac43ec431c87c0d385daead9dbbde7ef6309b0c97bbaf852a

                  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Aberdeen

                    Filesize

                    236KB

                    MD5

                    cadf612984ebd5ecd45906b805ffe46c

                    SHA1

                    1b53b6b2a843e6d05678356664be82b0317a3c1a

                    SHA256

                    696dabffb01c537d4f35dcf5b44cd0b3250a96bf55b5e47f70351cb87d290909

                    SHA512

                    d412fb5f4469463a7e2394b9dc829241ae500ead96178c8da813f8bad6687f46f4ab9378512c55a9fb0025389abb47cdba4546a77b5f601d6f9cb3cac48db51e

                  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Aggressive

                    Filesize

                    109KB

                    MD5

                    029325f8240d37784f57441b3176163c

                    SHA1

                    bd61a35e87d9e579e3f14f1912437ac91568e969

                    SHA256

                    32acea596c43d3a11f1dddd1b50eafa491bb97f4724d7cf193bbf584196889eb

                    SHA512

                    333aca81513e6dd0d49a824c889a945121f4f8343e6c53f47d589be0624c46ba5495fbac37560bec489583638ce03eac0cdab0d2a8273a6e70bedb8799cad85b

                  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Bowling

                    Filesize

                    438KB

                    MD5

                    51269b2f02dba8f71d9fa5a2a7119642

                    SHA1

                    6502d3e85e61fd6cb03f68525bd92682e0de6198

                    SHA256

                    526e1f710c86eb4d1f3b05bb5bc981d7fb7fd5daed752992f1f543daadffb89f

                    SHA512

                    2e0ff51926256595c95b636e6a8314cac1763be5cdb0f51a54dc59d7b67b20275d425eec61fe483e65f73f3b58424fd6fc85b9fed4288fc2c5d57b4f49f7fd53

                  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Britney

                    Filesize

                    337KB

                    MD5

                    afdc4a4520d5dc1c3dd70fda304c9aa9

                    SHA1

                    914ee920b6e037a42e3b522d89909ae1d899197a

                    SHA256

                    c16921f44342ff963f0a6f93e3816c2d9fab7e0382a87a755012fc56422423a7

                    SHA512

                    efc9cb520ad2997ca35c5d521839f9723a665fb162dc3c832ea7d7da3cbe855c1ef75904f5cfe9a608d3e97d268ecfd78730fc39dd01318a5234aa960e91381d

                  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Delays

                    Filesize

                    11KB

                    MD5

                    60a0a998ac721ce59926c350c1cfa346

                    SHA1

                    9b69aef9a6d12e0e7f4efab8f7a65329c0d958f2

                    SHA256

                    0129d157049640ba4a556776946a767b859bcf0503ccaf17c5f8b373fbfbcd38

                    SHA512

                    86e705176ab1060c29930bdb516dd4bb3d0ae32c7fbf49f5ada56478be067cae7c5be0bbf1abb44c042f9dfa531123d85c45d7ed92e6509562dbf023bce04e30

                  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Maps

                    Filesize

                    215KB

                    MD5

                    43819522acece762a7389a5683136c4d

                    SHA1

                    b3ff7cf638094690347653f613d5cac9913fbd68

                    SHA256

                    eb08e78f8bb92c71c0fe7b03bd6b9498e2fb7118635f7199b762301653c68c2b

                    SHA512

                    03dda574da87595b7593387d3e575d9c2ef5256d2e9dd4fb163ac9d993a2c7ad747445fd51c4a8b4627bd09c251aecd6fd3b1401a79cf4468f2f8a9f99ac58f4

                  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Micro

                    Filesize

                    467KB

                    MD5

                    16c7e782af3a480cf58b2f67f47a637c

                    SHA1

                    f23178c12ada8993410e8f1a59a1e271879d5977

                    SHA256

                    ce65a1dea48934a61b3e98697659857e466e859d22ed244cbf45e9feded8c8b4

                    SHA512

                    6d61e15ada0b82668ada59e95d0d2b5f4bf21fa8beed38b66abea401a642f7c974710f30db0cd537d1397e7b0e060e2225e16f1269632578dd0301e0ab30b71b

                  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Networks

                    Filesize

                    217KB

                    MD5

                    e0ee57b3d753dba0d3a58379968e19c9

                    SHA1

                    7cb2bd6f3bab50a9836a620610d8e47459445ab0

                    SHA256

                    4175135f12188ab2c643aeeca361bcd506730de21255b8eabf6cb8f1d4c2ecf5

                    SHA512

                    3cd236c51634159250317f3a8705a836cb72203184c3ca5313d18c8e15bff9d25dd50e7c6ac7af66c9d107046e0ec09579d630b510a1c22b94d6cfbc02034059

                  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Temporary

                    Filesize

                    147KB

                    MD5

                    90114130f88ac2fb224c689998e124ce

                    SHA1

                    df94c44b1ceae98749237fae6ac07092fc4c6099

                    SHA256

                    87b55a91dd04d2377e0eddf641fa5d2325bce6a9025dd3cfddb3cb5ca1192cff

                    SHA512

                    38fd4b234a0358f1fe4a77b0f4c3204768759edd9a626676364081fc90d18cd0bf3dab181e8c928526b38e7f7e959a4f3cb34022a66c74226bf23d6d430d0b44

                  • memory/972-32-0x00000000770A1000-0x00000000771C1000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/972-37-0x0000000003E00000-0x0000000003E01000-memory.dmp

                    Filesize

                    4KB

                  • memory/2320-66-0x0000000001650000-0x00000000016D8000-memory.dmp

                    Filesize

                    544KB

                  • memory/2320-62-0x0000000001650000-0x00000000016D8000-memory.dmp

                    Filesize

                    544KB

                  • memory/2320-82-0x00000000044F0000-0x00000000048F0000-memory.dmp

                    Filesize

                    4.0MB

                  • memory/2320-73-0x0000000076940000-0x0000000076B55000-memory.dmp

                    Filesize

                    2.1MB

                  • memory/2320-70-0x00007FFC64D10000-0x00007FFC64F05000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/2320-71-0x00000000044F0000-0x00000000048F0000-memory.dmp

                    Filesize

                    4.0MB

                  • memory/2320-69-0x00000000044F0000-0x00000000048F0000-memory.dmp

                    Filesize

                    4.0MB

                  • memory/2320-68-0x00000000044F0000-0x00000000048F0000-memory.dmp

                    Filesize

                    4.0MB

                  • memory/2320-65-0x0000000001650000-0x00000000016D8000-memory.dmp

                    Filesize

                    544KB

                  • memory/2716-60-0x00000000028B0000-0x0000000002CB0000-memory.dmp

                    Filesize

                    4.0MB

                  • memory/2716-51-0x0000000000C90000-0x0000000000C99000-memory.dmp

                    Filesize

                    36KB

                  • memory/2716-53-0x00000000028B0000-0x0000000002CB0000-memory.dmp

                    Filesize

                    4.0MB

                  • memory/2716-54-0x00000000028B0000-0x0000000002CB0000-memory.dmp

                    Filesize

                    4.0MB

                  • memory/2716-57-0x00000000028B0000-0x0000000002CB0000-memory.dmp

                    Filesize

                    4.0MB

                  • memory/2716-58-0x0000000076940000-0x0000000076B55000-memory.dmp

                    Filesize

                    2.1MB

                  • memory/2716-55-0x00007FFC64D10000-0x00007FFC64F05000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/4548-38-0x0000000001440000-0x00000000014C8000-memory.dmp

                    Filesize

                    544KB

                  • memory/4548-43-0x0000000001440000-0x00000000014C8000-memory.dmp

                    Filesize

                    544KB

                  • memory/4548-50-0x0000000076940000-0x0000000076B55000-memory.dmp

                    Filesize

                    2.1MB

                  • memory/4548-48-0x00000000042A0000-0x00000000046A0000-memory.dmp

                    Filesize

                    4.0MB

                  • memory/4548-59-0x00000000042A0000-0x00000000046A0000-memory.dmp

                    Filesize

                    4.0MB

                  • memory/4548-47-0x00007FFC64D10000-0x00007FFC64F05000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/4548-46-0x00000000042A0000-0x00000000046A0000-memory.dmp

                    Filesize

                    4.0MB

                  • memory/4548-45-0x00000000042A0000-0x00000000046A0000-memory.dmp

                    Filesize

                    4.0MB

                  • memory/4548-44-0x00000000042A0000-0x00000000046A0000-memory.dmp

                    Filesize

                    4.0MB

                  • memory/4548-39-0x0000000001440000-0x00000000014C8000-memory.dmp

                    Filesize

                    544KB

                  • memory/4548-42-0x0000000001440000-0x00000000014C8000-memory.dmp

                    Filesize

                    544KB

                  • memory/4980-76-0x0000000002D60000-0x0000000003160000-memory.dmp

                    Filesize

                    4.0MB

                  • memory/4980-78-0x00007FFC64D10000-0x00007FFC64F05000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/4980-80-0x0000000002D60000-0x0000000003160000-memory.dmp

                    Filesize

                    4.0MB

                  • memory/4980-81-0x0000000076940000-0x0000000076B55000-memory.dmp

                    Filesize

                    2.1MB

                  • memory/4980-77-0x0000000002D60000-0x0000000003160000-memory.dmp

                    Filesize

                    4.0MB

                  • memory/4980-83-0x0000000002D60000-0x0000000003160000-memory.dmp

                    Filesize

                    4.0MB