Analysis

  • max time kernel
    31s
  • max time network
    33s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-04-2024 02:06

General

  • Target

    freedomOSU1.12.rar

  • Size

    803KB

  • MD5

    0c9c295b75d76525154f9fc03aefd0a2

  • SHA1

    886e81bb6733cb9e33fb3c64bc9dbdfc96308419

  • SHA256

    f6d3d9319fe42be572804cd30d6a562094d2c00899707a64425d034b26818d10

  • SHA512

    bf9732cddc19162ac63f8cd030b19995b594303e79269eb1562947390c0c5902ad4c706313829262fa805274815b937a6e66527ce0c0d01e4154138c5e96e57d

  • SSDEEP

    24576:Njfs5lXuT5cc+3sk/Vg4nc5sjAzicDW3lUTLjl:Njftt+3pgnSK2UTvl

Score
10/10

Malware Config

Signatures

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2472
      • C:\Windows\SysWOW64\dialer.exe
        "C:\Windows\system32\dialer.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:4032
      • C:\Windows\SysWOW64\dialer.exe
        "C:\Windows\system32\dialer.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:1348
    • C:\Windows\system32\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\freedomOSU1.12.rar
      1⤵
      • Checks computer location settings
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:628
      • C:\Program Files\7-Zip\7zFM.exe
        "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\freedomOSU1.12.rar"
        2⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:2892
    • C:\Users\Admin\Desktop\freedom_loader.exe
      "C:\Users\Admin\Desktop\freedom_loader.exe"
      1⤵
      • Suspicious use of NtCreateUserProcessOtherParentProcess
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1256
    • C:\Users\Admin\Desktop\freedom_loader.exe
      "C:\Users\Admin\Desktop\freedom_loader.exe"
      1⤵
      • Suspicious use of NtCreateUserProcessOtherParentProcess
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1664

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\Desktop\freedom_loader.exe

      Filesize

      355KB

      MD5

      bb84cc2853596d21a318576c4995fcce

      SHA1

      477a224d5b4e398b34a978ac19def1cbafb211d3

      SHA256

      6135bdbcfd9f824b3da0bef2ba73018a998967e20c5d0274c6a1c0433649b017

      SHA512

      aa32be3d91bf6e2c8fed0d0e0407723466b477ab0d27c5d3cd705ac73365ab4c56de4f16d4786ee586e750d6835eba09775dbf5a93b0da0eaea4326f2fc2bd5c

    • memory/1256-13-0x00000000042A0000-0x00000000046A0000-memory.dmp

      Filesize

      4.0MB

    • memory/1256-15-0x0000000000F30000-0x0000000000F9D000-memory.dmp

      Filesize

      436KB

    • memory/1256-8-0x00000000042A0000-0x00000000046A0000-memory.dmp

      Filesize

      4.0MB

    • memory/1256-9-0x00000000042A0000-0x00000000046A0000-memory.dmp

      Filesize

      4.0MB

    • memory/1256-10-0x00007FFFA5D50000-0x00007FFFA5F45000-memory.dmp

      Filesize

      2.0MB

    • memory/1256-5-0x0000000000F30000-0x0000000000F9D000-memory.dmp

      Filesize

      436KB

    • memory/1256-12-0x00000000769B0000-0x0000000076BC5000-memory.dmp

      Filesize

      2.1MB

    • memory/1256-7-0x00000000042A0000-0x00000000046A0000-memory.dmp

      Filesize

      4.0MB

    • memory/1348-41-0x0000000002570000-0x0000000002970000-memory.dmp

      Filesize

      4.0MB

    • memory/1348-40-0x00000000769B0000-0x0000000076BC5000-memory.dmp

      Filesize

      2.1MB

    • memory/1348-39-0x0000000002570000-0x0000000002970000-memory.dmp

      Filesize

      4.0MB

    • memory/1348-35-0x0000000002570000-0x0000000002970000-memory.dmp

      Filesize

      4.0MB

    • memory/1348-37-0x00007FFFA5D50000-0x00007FFFA5F45000-memory.dmp

      Filesize

      2.0MB

    • memory/1348-36-0x0000000002570000-0x0000000002970000-memory.dmp

      Filesize

      4.0MB

    • memory/1664-32-0x00000000769B0000-0x0000000076BC5000-memory.dmp

      Filesize

      2.1MB

    • memory/1664-25-0x0000000000F30000-0x0000000000F9D000-memory.dmp

      Filesize

      436KB

    • memory/1664-28-0x0000000003D50000-0x0000000004150000-memory.dmp

      Filesize

      4.0MB

    • memory/1664-27-0x0000000003D50000-0x0000000004150000-memory.dmp

      Filesize

      4.0MB

    • memory/1664-30-0x0000000003D50000-0x0000000004150000-memory.dmp

      Filesize

      4.0MB

    • memory/1664-29-0x00007FFFA5D50000-0x00007FFFA5F45000-memory.dmp

      Filesize

      2.0MB

    • memory/4032-23-0x00000000023D0000-0x00000000027D0000-memory.dmp

      Filesize

      4.0MB

    • memory/4032-22-0x00000000769B0000-0x0000000076BC5000-memory.dmp

      Filesize

      2.1MB

    • memory/4032-20-0x00000000023D0000-0x00000000027D0000-memory.dmp

      Filesize

      4.0MB

    • memory/4032-19-0x00007FFFA5D50000-0x00007FFFA5F45000-memory.dmp

      Filesize

      2.0MB

    • memory/4032-18-0x00000000023D0000-0x00000000027D0000-memory.dmp

      Filesize

      4.0MB

    • memory/4032-17-0x00000000023D0000-0x00000000027D0000-memory.dmp

      Filesize

      4.0MB

    • memory/4032-14-0x00000000005B0000-0x00000000005B9000-memory.dmp

      Filesize

      36KB