Analysis
- max time kernel
19s - max time network
17s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
31/03/2024, 19:18
General
- Target iCrack.exe
- Size 4.8MB
- Sample240331-x1c57aac93
- SHA256 fad83422bd338909393c57663ab1bcafb94ec684f74fdb95aaad925e82567fa3
Malware Config
Signatures
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 5 IoCs
- Loads dropped DLL 14 IoCs
- UPX packed file 29 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 1 IoCs
- Detects Pyinstaller 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Kills process with taskkill 1 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 25 IoCs
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\iCrack.exe"C:\Users\Admin\AppData\Local\Temp\iCrack.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHYAegBmACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAG4AegB3ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHMAeQB2ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwByACMAPgA="2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
C:\Users\Admin\AppData\Local\explorer.exe"C:\Users\Admin\AppData\Local\explorer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\explorer.exe"C:\Users\Admin\AppData\Local\explorer.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\activate.bat4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /f /im "explorer.exe"5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\explorer.exe"explorer.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\explorer.exe"explorer.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"7⤵
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_socket.pyd
base_library.zip
libcrypto-1_1.dll
libffi-7.dll
python310.dll
select.pyd
unicodedata.pyd
__PSScriptPolicyTest_xynnfxe0.xgy.ps1
explorer.exe
svchost.exe
activate.bat
memory/1804-38-0x00007FF8CC900000-0x00007FF8CCD66000-memory.dmp
memory/1804-61-0x00007FF8D3570000-0x00007FF8D357F000-memory.dmp
memory/1804-64-0x00007FF8CD8B0000-0x00007FF8CD8DC000-memory.dmp
memory/1804-63-0x00007FF8D2470000-0x00007FF8D2488000-memory.dmp
memory/1804-84-0x00007FF8CC900000-0x00007FF8CCD66000-memory.dmp
memory/1804-60-0x00007FF8D2520000-0x00007FF8D2544000-memory.dmp
memory/2376-124-0x00007FF8CD8B0000-0x00007FF8CD8D4000-memory.dmp
memory/2376-110-0x00007FF8CC900000-0x00007FF8CCD66000-memory.dmp
memory/2376-181-0x00007FF8CC900000-0x00007FF8CCD66000-memory.dmp
memory/2376-180-0x00007FF8CD8B0000-0x00007FF8CD8D4000-memory.dmp
memory/2376-179-0x00007FF8CC900000-0x00007FF8CCD66000-memory.dmp
memory/2376-125-0x00007FF8D3570000-0x00007FF8D357F000-memory.dmp
memory/2376-130-0x00007FF8CD820000-0x00007FF8CD84C000-memory.dmp
memory/2376-133-0x00007FF8D2470000-0x00007FF8D2488000-memory.dmp
memory/2376-132-0x00007FF8D3560000-0x00007FF8D356D000-memory.dmp
memory/2376-131-0x00007FF8D0DC0000-0x00007FF8D0DD9000-memory.dmp
memory/3272-167-0x0000000075E80000-0x0000000076095000-memory.dmp
memory/3272-169-0x0000000002020000-0x0000000002420000-memory.dmp
memory/3272-162-0x0000000003A00000-0x0000000003E00000-memory.dmp
memory/3272-164-0x00007FF8DBE30000-0x00007FF8DC025000-memory.dmp
memory/3272-165-0x0000000002020000-0x0000000002420000-memory.dmp
memory/3272-160-0x0000000002020000-0x0000000002420000-memory.dmp
memory/3272-157-0x00000000004A0000-0x00000000004A9000-memory.dmp
memory/4604-151-0x0000000003A00000-0x0000000003E00000-memory.dmp
memory/4604-11-0x00000000004A0000-0x000000000050D000-memory.dmp
memory/4604-156-0x0000000003A00000-0x0000000003E00000-memory.dmp
memory/4604-155-0x0000000075E80000-0x0000000076095000-memory.dmp
memory/4604-152-0x00007FF8DBE30000-0x00007FF8DC025000-memory.dmp
memory/4604-148-0x0000000003A00000-0x0000000003E00000-memory.dmp
memory/4604-153-0x00000000004A0000-0x000000000050D000-memory.dmp
memory/4724-159-0x0000000074130000-0x00000000748E0000-memory.dmp
memory/4724-67-0x0000000004D40000-0x0000000005368000-memory.dmp
memory/4724-147-0x0000000006050000-0x000000000606E000-memory.dmp
memory/4724-137-0x0000000004700000-0x0000000004710000-memory.dmp
memory/4724-65-0x0000000004700000-0x0000000004710000-memory.dmp
memory/4724-134-0x0000000006070000-0x00000000060A2000-memory.dmp
memory/4724-136-0x0000000073D10000-0x0000000073D5C000-memory.dmp
memory/4724-70-0x00000000053E0000-0x0000000005446000-memory.dmp
memory/4724-81-0x0000000005630000-0x0000000005984000-memory.dmp
memory/4724-80-0x00000000055C0000-0x0000000005626000-memory.dmp
memory/4724-82-0x0000000005AA0000-0x0000000005ABE000-memory.dmp
memory/4724-135-0x000000007F0B0000-0x000000007F0C0000-memory.dmp
memory/4724-83-0x0000000005AF0000-0x0000000005B3C000-memory.dmp
memory/4724-149-0x0000000006A80000-0x0000000006B23000-memory.dmp
memory/4724-161-0x0000000007420000-0x0000000007A9A000-memory.dmp
memory/4724-163-0x0000000006DE0000-0x0000000006DFA000-memory.dmp
memory/4724-168-0x0000000006E60000-0x0000000006E6A000-memory.dmp
memory/4724-62-0x0000000002190000-0x00000000021C6000-memory.dmp
memory/4724-170-0x0000000007060000-0x00000000070F6000-memory.dmp
memory/4724-171-0x0000000006FE0000-0x0000000006FF1000-memory.dmp
memory/4724-172-0x0000000007020000-0x000000000702E000-memory.dmp
memory/4724-173-0x0000000007030000-0x0000000007044000-memory.dmp
memory/4724-174-0x0000000007120000-0x000000000713A000-memory.dmp
memory/4724-175-0x0000000007100000-0x0000000007108000-memory.dmp
memory/4724-178-0x0000000074130000-0x00000000748E0000-memory.dmp
memory/4724-69-0x0000000004A00000-0x0000000004A22000-memory.dmp
memory/4724-44-0x0000000074130000-0x00000000748E0000-memory.dmp
memory/4724-66-0x0000000004700000-0x0000000004710000-memory.dmp