Analysis

  • max time kernel
    119s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    11/02/2024, 04:40

General

  • Target

    a8c2d6bf4c101746a89855247e2472a8d4871b4bd75726d41948e802ebaf3e43.exe

  • Size

    1.1MB

  • MD5

    d6fc4895775aafffbd52cb8e9e731824

  • SHA1

    9762ab2f2e6bc7a3d55bc5321667ca06cf16ce00

  • SHA256

    a8c2d6bf4c101746a89855247e2472a8d4871b4bd75726d41948e802ebaf3e43

  • SHA512

    6557a7d7178b84a1cde3c92747ad2eed5da60270b06bb7df8f6d6cf738a1028a575d29804f05a01f778358e7a6aa6a1fea20295d5bdb45e05b01e18b1c983606

  • SSDEEP

    24576:rus8z4E8k29sef3ykfjptYRawBIU3gyCta0SBuNoObZJR8wrGKB/urQD:asOqfykLp7wBIhyAOBuzlvLurY

Score
10/10

Malware Config

Signatures

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1256
      • C:\Users\Admin\AppData\Local\Temp\a8c2d6bf4c101746a89855247e2472a8d4871b4bd75726d41948e802ebaf3e43.exe
        "C:\Users\Admin\AppData\Local\Temp\a8c2d6bf4c101746a89855247e2472a8d4871b4bd75726d41948e802ebaf3e43.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2636
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k move Delays Delays.bat & Delays.bat & exit
          3⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2808
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:2680
          • C:\Windows\SysWOW64\findstr.exe
            findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
            4⤵
              PID:1252
            • C:\Windows\SysWOW64\tasklist.exe
              tasklist
              4⤵
              • Enumerates processes with tasklist
              • Suspicious use of AdjustPrivilegeToken
              PID:2512
            • C:\Windows\SysWOW64\findstr.exe
              findstr /I "wrsa.exe opssvc.exe"
              4⤵
                PID:2864
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c md 29428
                4⤵
                  PID:2600
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c copy /b Networks + Aberdeen + Temporary + Maps + Aggressive 29428\Structure.pif
                  4⤵
                    PID:2632
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c copy /b Bowling + Micro + Britney 29428\J
                    4⤵
                      PID:2812
                    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\29428\Structure.pif
                      29428\Structure.pif 29428\J
                      4⤵
                      • Deletes itself
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of SetThreadContext
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      • Suspicious use of WriteProcessMemory
                      PID:3028
                      • C:\Windows\SysWOW64\schtasks.exe
                        schtasks.exe /create /tn "SwiftSync" /tr "wscript 'C:\Users\Admin\AppData\Local\Digital Harmony Technologies\SwiftSync.js'" /sc onlogon /F /RL HIGHEST
                        5⤵
                        • Creates scheduled task(s)
                        PID:976
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c schtasks.exe /create /tn "Guess" /tr "wscript 'C:\Users\Admin\AppData\Local\Digital Harmony Technologies\SwiftSync.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST
                        5⤵
                        • Suspicious use of WriteProcessMemory
                        PID:440
                        • C:\Windows\SysWOW64\schtasks.exe
                          schtasks.exe /create /tn "Guess" /tr "wscript 'C:\Users\Admin\AppData\Local\Digital Harmony Technologies\SwiftSync.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST
                          6⤵
                          • Creates scheduled task(s)
                          PID:1484
                      • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\29428\Structure.pif
                        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\29428\Structure.pif
                        5⤵
                        • Suspicious use of NtCreateUserProcessOtherParentProcess
                        • Executes dropped EXE
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:2020
                      • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\29428\Structure.pif
                        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\29428\Structure.pif
                        5⤵
                        • Suspicious use of NtCreateUserProcessOtherParentProcess
                        • Executes dropped EXE
                        • Suspicious behavior: EnumeratesProcesses
                        PID:2144
                    • C:\Windows\SysWOW64\PING.EXE
                      ping -n 15 localhost
                      4⤵
                      • Runs ping.exe
                      PID:328
                • C:\Windows\SysWOW64\dialer.exe
                  "C:\Windows\system32\dialer.exe"
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1752
                • C:\Windows\SysWOW64\dialer.exe
                  "C:\Windows\system32\dialer.exe"
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1440

              Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\29428\J

                      Filesize

                      1.2MB

                      MD5

                      9e026102dd03937a6464c85c69a2383f

                      SHA1

                      520325a083a63ee251284fa447acb52f8004ce53

                      SHA256

                      9df3a12e7cc135b26f76b2e967df78b81fd5f505d356e9fc079bf04026931759

                      SHA512

                      26b989788ff0c2f2d626b59451a7fd6e3a2c11ea898b1066de5fb2f9fa59f87760bd10ba7db4377455ef9cd2368954d272a58a6a10e6b4fb7ca6eb6625f2fe77

                    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Aberdeen

                      Filesize

                      236KB

                      MD5

                      cadf612984ebd5ecd45906b805ffe46c

                      SHA1

                      1b53b6b2a843e6d05678356664be82b0317a3c1a

                      SHA256

                      696dabffb01c537d4f35dcf5b44cd0b3250a96bf55b5e47f70351cb87d290909

                      SHA512

                      d412fb5f4469463a7e2394b9dc829241ae500ead96178c8da813f8bad6687f46f4ab9378512c55a9fb0025389abb47cdba4546a77b5f601d6f9cb3cac48db51e

                    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Aggressive

                      Filesize

                      109KB

                      MD5

                      029325f8240d37784f57441b3176163c

                      SHA1

                      bd61a35e87d9e579e3f14f1912437ac91568e969

                      SHA256

                      32acea596c43d3a11f1dddd1b50eafa491bb97f4724d7cf193bbf584196889eb

                      SHA512

                      333aca81513e6dd0d49a824c889a945121f4f8343e6c53f47d589be0624c46ba5495fbac37560bec489583638ce03eac0cdab0d2a8273a6e70bedb8799cad85b

                    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Bowling

                      Filesize

                      438KB

                      MD5

                      51269b2f02dba8f71d9fa5a2a7119642

                      SHA1

                      6502d3e85e61fd6cb03f68525bd92682e0de6198

                      SHA256

                      526e1f710c86eb4d1f3b05bb5bc981d7fb7fd5daed752992f1f543daadffb89f

                      SHA512

                      2e0ff51926256595c95b636e6a8314cac1763be5cdb0f51a54dc59d7b67b20275d425eec61fe483e65f73f3b58424fd6fc85b9fed4288fc2c5d57b4f49f7fd53

                    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Britney

                      Filesize

                      337KB

                      MD5

                      afdc4a4520d5dc1c3dd70fda304c9aa9

                      SHA1

                      914ee920b6e037a42e3b522d89909ae1d899197a

                      SHA256

                      c16921f44342ff963f0a6f93e3816c2d9fab7e0382a87a755012fc56422423a7

                      SHA512

                      efc9cb520ad2997ca35c5d521839f9723a665fb162dc3c832ea7d7da3cbe855c1ef75904f5cfe9a608d3e97d268ecfd78730fc39dd01318a5234aa960e91381d

                    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Delays

                      Filesize

                      11KB

                      MD5

                      60a0a998ac721ce59926c350c1cfa346

                      SHA1

                      9b69aef9a6d12e0e7f4efab8f7a65329c0d958f2

                      SHA256

                      0129d157049640ba4a556776946a767b859bcf0503ccaf17c5f8b373fbfbcd38

                      SHA512

                      86e705176ab1060c29930bdb516dd4bb3d0ae32c7fbf49f5ada56478be067cae7c5be0bbf1abb44c042f9dfa531123d85c45d7ed92e6509562dbf023bce04e30

                    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Maps

                      Filesize

                      215KB

                      MD5

                      43819522acece762a7389a5683136c4d

                      SHA1

                      b3ff7cf638094690347653f613d5cac9913fbd68

                      SHA256

                      eb08e78f8bb92c71c0fe7b03bd6b9498e2fb7118635f7199b762301653c68c2b

                      SHA512

                      03dda574da87595b7593387d3e575d9c2ef5256d2e9dd4fb163ac9d993a2c7ad747445fd51c4a8b4627bd09c251aecd6fd3b1401a79cf4468f2f8a9f99ac58f4

                    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Micro

                      Filesize

                      467KB

                      MD5

                      16c7e782af3a480cf58b2f67f47a637c

                      SHA1

                      f23178c12ada8993410e8f1a59a1e271879d5977

                      SHA256

                      ce65a1dea48934a61b3e98697659857e466e859d22ed244cbf45e9feded8c8b4

                      SHA512

                      6d61e15ada0b82668ada59e95d0d2b5f4bf21fa8beed38b66abea401a642f7c974710f30db0cd537d1397e7b0e060e2225e16f1269632578dd0301e0ab30b71b

                    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Networks

                      Filesize

                      217KB

                      MD5

                      e0ee57b3d753dba0d3a58379968e19c9

                      SHA1

                      7cb2bd6f3bab50a9836a620610d8e47459445ab0

                      SHA256

                      4175135f12188ab2c643aeeca361bcd506730de21255b8eabf6cb8f1d4c2ecf5

                      SHA512

                      3cd236c51634159250317f3a8705a836cb72203184c3ca5313d18c8e15bff9d25dd50e7c6ac7af66c9d107046e0ec09579d630b510a1c22b94d6cfbc02034059

                    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Temporary

                      Filesize

                      147KB

                      MD5

                      90114130f88ac2fb224c689998e124ce

                      SHA1

                      df94c44b1ceae98749237fae6ac07092fc4c6099

                      SHA256

                      87b55a91dd04d2377e0eddf641fa5d2325bce6a9025dd3cfddb3cb5ca1192cff

                      SHA512

                      38fd4b234a0358f1fe4a77b0f4c3204768759edd9a626676364081fc90d18cd0bf3dab181e8c928526b38e7f7e959a4f3cb34022a66c74226bf23d6d430d0b44

                    • \Users\Admin\AppData\Local\Temp\7ZipSfx.000\29428\Structure.pif

                      Filesize

                      924KB

                      MD5

                      848164d084384c49937f99d5b894253e

                      SHA1

                      3055ef803eeec4f175ebf120f94125717ee12444

                      SHA256

                      f58d3a4b2f3f7f10815c24586fae91964eeed830369e7e0701b43895b0cefbd3

                      SHA512

                      aabe1cf076f48f32542f49a92e4ca9f054b31d5a9949119991b897b9489fe775d8009896408ba49ac43ec431c87c0d385daead9dbbde7ef6309b0c97bbaf852a

                    • memory/1440-78-0x0000000001C60000-0x0000000002060000-memory.dmp

                      Filesize

                      4.0MB

                    • memory/1440-85-0x0000000001C60000-0x0000000002060000-memory.dmp

                      Filesize

                      4.0MB

                    • memory/1440-84-0x0000000076840000-0x0000000076887000-memory.dmp

                      Filesize

                      284KB

                    • memory/1440-79-0x0000000001C60000-0x0000000002060000-memory.dmp

                      Filesize

                      4.0MB

                    • memory/1440-81-0x0000000001C60000-0x0000000002060000-memory.dmp

                      Filesize

                      4.0MB

                    • memory/1440-80-0x0000000077560000-0x0000000077709000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/1440-83-0x0000000077560000-0x0000000077709000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/1752-57-0x0000000001C00000-0x0000000002000000-memory.dmp

                      Filesize

                      4.0MB

                    • memory/1752-55-0x0000000001C00000-0x0000000002000000-memory.dmp

                      Filesize

                      4.0MB

                    • memory/1752-61-0x0000000001C00000-0x0000000002000000-memory.dmp

                      Filesize

                      4.0MB

                    • memory/1752-60-0x0000000076840000-0x0000000076887000-memory.dmp

                      Filesize

                      284KB

                    • memory/1752-59-0x0000000077560000-0x0000000077709000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/1752-52-0x0000000000080000-0x0000000000089000-memory.dmp

                      Filesize

                      36KB

                    • memory/1752-56-0x0000000077560000-0x0000000077709000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/2020-47-0x00000000030C0000-0x00000000034C0000-memory.dmp

                      Filesize

                      4.0MB

                    • memory/2020-54-0x00000000030C0000-0x00000000034C0000-memory.dmp

                      Filesize

                      4.0MB

                    • memory/2020-46-0x00000000030C0000-0x00000000034C0000-memory.dmp

                      Filesize

                      4.0MB

                    • memory/2020-51-0x0000000076840000-0x0000000076887000-memory.dmp

                      Filesize

                      284KB

                    • memory/2020-49-0x00000000030C0000-0x00000000034C0000-memory.dmp

                      Filesize

                      4.0MB

                    • memory/2020-48-0x0000000077560000-0x0000000077709000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/2020-45-0x00000000030C0000-0x00000000034C0000-memory.dmp

                      Filesize

                      4.0MB

                    • memory/2020-44-0x0000000000080000-0x0000000000108000-memory.dmp

                      Filesize

                      544KB

                    • memory/2020-43-0x0000000000080000-0x0000000000108000-memory.dmp

                      Filesize

                      544KB

                    • memory/2020-40-0x0000000000080000-0x0000000000108000-memory.dmp

                      Filesize

                      544KB

                    • memory/2020-39-0x0000000000080000-0x0000000000108000-memory.dmp

                      Filesize

                      544KB

                    • memory/2144-71-0x0000000077560000-0x0000000077709000-memory.dmp

                      Filesize

                      1.7MB

                    • memory/2144-73-0x0000000076840000-0x0000000076887000-memory.dmp

                      Filesize

                      284KB

                    • memory/2144-77-0x00000000032D0000-0x00000000036D0000-memory.dmp

                      Filesize

                      4.0MB

                    • memory/2144-74-0x00000000032D0000-0x00000000036D0000-memory.dmp

                      Filesize

                      4.0MB

                    • memory/2144-69-0x00000000032D0000-0x00000000036D0000-memory.dmp

                      Filesize

                      4.0MB

                    • memory/2144-70-0x00000000032D0000-0x00000000036D0000-memory.dmp

                      Filesize

                      4.0MB

                    • memory/3028-37-0x00000000001D0000-0x00000000001D1000-memory.dmp

                      Filesize

                      4KB

                    • memory/3028-33-0x0000000077750000-0x0000000077826000-memory.dmp

                      Filesize

                      856KB