Resubmissions

27-03-2024 17:10

240327-vp3klabh7y 10

27-03-2024 17:07

240327-vnfdnsbh4w 3

27-03-2024 17:03

240327-vknwmsbg61 10

Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    27-03-2024 17:03

General

  • Target

    launcher.exe

  • Size

    4.7MB

  • MD5

    620024df612c13a4a33cf785384c2086

  • SHA1

    a6ae999723bea18c6d3acf2c52ed682f6226b7be

  • SHA256

    cd825788095cd61de39d98d6365ed80004cc55a64f4f115ef6bf532617bb0af1

  • SHA512

    34d4d8a423d98bf0b8d4f18dc980bed97e9492f0817bb1e2dff99fc8d9d0cfaa2687514eff7717b1310a2c858236614490e980390612901e08b69b6ded451bdd

  • SSDEEP

    98304:HqZRVmbr2CkyPqPnowAWTbNJ2EyT2QT27JaSGKN/3pJ:QVs6ysoDEUvwJEKdZJ

Malware Config

Signatures

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 5 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Detects Pyinstaller 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1200
      • C:\Users\Admin\AppData\Local\Temp\launcher.exe
        "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
        2⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2088
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGcAaQB6ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAZgBnACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHoAcgBnACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGQAYQBjACMAPgA="
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2016
        • C:\Users\Admin\AppData\Local\Temp\explorer.exe
          "C:\Users\Admin\AppData\Local\Temp\explorer.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1728
          • C:\Users\Admin\AppData\Local\Temp\explorer.exe
            "C:\Users\Admin\AppData\Local\Temp\explorer.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2708
        • C:\Users\Admin\AppData\Local\svchost.exe
          "C:\Users\Admin\AppData\Local\svchost.exe"
          3⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2312
      • C:\Windows\SysWOW64\dialer.exe
        "C:\Windows\system32\dialer.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2444

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\_MEI17282\python310.dll

      Filesize

      1.4MB

      MD5

      3f782cf7874b03c1d20ed90d370f4329

      SHA1

      08a2b4a21092321de1dcad1bb2afb660b0fa7749

      SHA256

      2a382aff16533054e6de7d13b837a24d97ea2957805730cc7b08b75e369f58d6

      SHA512

      950c039eb23ed64ca8b2f0a9284ebdb6f0efe71dde5bbf0187357a66c3ab0823418edca34811650270eea967f0e541eece90132f9959d5ba5984405630a99857

    • C:\Users\Admin\AppData\Local\svchost.exe

      Filesize

      355KB

      MD5

      8a6f1580a5b9b94d7cd47cc6b1af1b9a

      SHA1

      e68768afd59e18091d345cb300e859572e8d4c5c

      SHA256

      bb1464e75c750d90c0c49d148c9e64eefe0c29b2f670d708c8085ddd3104dbfe

      SHA512

      1663a9e0868b3f5d7e1edd30259024e419c2d190ec8c31e76e66aef0c8a0e02da0c829584214b9e2f76cbd349a53bf77d01d03e9b0e9c8a99eb18021b1d53309

    • \Users\Admin\AppData\Local\Temp\explorer.exe

      Filesize

      4.4MB

      MD5

      aba4fcf0d72b487887f315202bc43ae4

      SHA1

      de51440c742c58f52f3b7cc2a1fcda5abd3d1ca8

      SHA256

      8f312c17c2a525ac9bc0838e4d9f69db5bb20478ffa4880fb3a8b98caf0e25ef

      SHA512

      fed41d5eb4a61c43bb3032c0d0b3d347d6b89a06d2928155f2e0baa59295ae71d3e689c3c78a584f2db64fd5ab3a06578623a8d41d7055b535c4d2317aef2bf9

    • memory/2016-37-0x00000000029C0000-0x0000000002A00000-memory.dmp

      Filesize

      256KB

    • memory/2016-45-0x0000000073DA0000-0x000000007434B000-memory.dmp

      Filesize

      5.7MB

    • memory/2016-36-0x0000000073DA0000-0x000000007434B000-memory.dmp

      Filesize

      5.7MB

    • memory/2312-42-0x0000000003220000-0x0000000003620000-memory.dmp

      Filesize

      4.0MB

    • memory/2312-15-0x0000000000C00000-0x0000000000C6D000-memory.dmp

      Filesize

      436KB

    • memory/2312-40-0x0000000003220000-0x0000000003620000-memory.dmp

      Filesize

      4.0MB

    • memory/2312-41-0x0000000077070000-0x0000000077219000-memory.dmp

      Filesize

      1.7MB

    • memory/2312-38-0x0000000003220000-0x0000000003620000-memory.dmp

      Filesize

      4.0MB

    • memory/2312-44-0x00000000767B0000-0x00000000767F7000-memory.dmp

      Filesize

      284KB

    • memory/2312-47-0x0000000000C00000-0x0000000000C6D000-memory.dmp

      Filesize

      436KB

    • memory/2444-50-0x0000000001F20000-0x0000000002320000-memory.dmp

      Filesize

      4.0MB

    • memory/2444-46-0x0000000000110000-0x0000000000119000-memory.dmp

      Filesize

      36KB

    • memory/2444-49-0x0000000001F20000-0x0000000002320000-memory.dmp

      Filesize

      4.0MB

    • memory/2444-52-0x0000000001F20000-0x0000000002320000-memory.dmp

      Filesize

      4.0MB

    • memory/2444-51-0x0000000077070000-0x0000000077219000-memory.dmp

      Filesize

      1.7MB

    • memory/2444-55-0x00000000767B0000-0x00000000767F7000-memory.dmp

      Filesize

      284KB

    • memory/2444-54-0x0000000077070000-0x0000000077219000-memory.dmp

      Filesize

      1.7MB

    • memory/2444-56-0x0000000001F20000-0x0000000002320000-memory.dmp

      Filesize

      4.0MB

    • memory/2708-35-0x000007FEF5C90000-0x000007FEF60F6000-memory.dmp

      Filesize

      4.4MB