Analysis Overview
SHA256
f6d3d9319fe42be572804cd30d6a562094d2c00899707a64425d034b26818d10
Threat Level: Known bad
The file freedomOSU1.12.rar was found to be: Known bad.
Malicious Activity Summary
Rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess
Checks computer location settings
Executes dropped EXE
Unsigned PE
Enumerates physical storage devices
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Modifies registry class
Suspicious behavior: EnumeratesProcesses
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-04-03 02:06
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-04-03 02:06
Reported
2024-04-03 02:06
Platform
win10v2004-20240226-en
Max time kernel
31s
Max time network
33s
Command Line
Signatures
Rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess
| Description | Indicator | Process | Target |
| PID 1256 created 2472 | N/A | C:\Users\Admin\Desktop\freedom_loader.exe | C:\Windows\system32\sihost.exe |
| PID 1664 created 2472 | N/A | C:\Users\Admin\Desktop\freedom_loader.exe | C:\Windows\system32\sihost.exe |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation | C:\Windows\system32\cmd.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\Desktop\freedom_loader.exe | N/A |
| N/A | N/A | C:\Users\Admin\Desktop\freedom_loader.exe | N/A |
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings | C:\Windows\system32\cmd.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\Desktop\freedom_loader.exe | N/A |
| N/A | N/A | C:\Users\Admin\Desktop\freedom_loader.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\dialer.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\dialer.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\dialer.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\dialer.exe | N/A |
| N/A | N/A | C:\Users\Admin\Desktop\freedom_loader.exe | N/A |
| N/A | N/A | C:\Users\Admin\Desktop\freedom_loader.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\dialer.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\dialer.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\dialer.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\dialer.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\7-Zip\7zFM.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeRestorePrivilege | N/A | C:\Program Files\7-Zip\7zFM.exe | N/A |
| Token: 35 | N/A | C:\Program Files\7-Zip\7zFM.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Program Files\7-Zip\7zFM.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\7-Zip\7zFM.exe | N/A |
| N/A | N/A | C:\Program Files\7-Zip\7zFM.exe | N/A |
| N/A | N/A | C:\Program Files\7-Zip\7zFM.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Windows\system32\sihost.exe
sihost.exe
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\freedomOSU1.12.rar
C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\freedomOSU1.12.rar"
C:\Users\Admin\Desktop\freedom_loader.exe
"C:\Users\Admin\Desktop\freedom_loader.exe"
C:\Windows\SysWOW64\dialer.exe
"C:\Windows\system32\dialer.exe"
C:\Users\Admin\Desktop\freedom_loader.exe
"C:\Users\Admin\Desktop\freedom_loader.exe"
C:\Windows\SysWOW64\dialer.exe
"C:\Windows\system32\dialer.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 183.142.211.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 138.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 81.171.91.138.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | udp | |
| US | 8.8.8.8:53 | udp | |
| N/A | 13.95.31.18:443 | tcp | |
| US | 8.8.8.8:53 | udp |
Files
C:\Users\Admin\Desktop\freedom_loader.exe
| MD5 | bb84cc2853596d21a318576c4995fcce |
| SHA1 | 477a224d5b4e398b34a978ac19def1cbafb211d3 |
| SHA256 | 6135bdbcfd9f824b3da0bef2ba73018a998967e20c5d0274c6a1c0433649b017 |
| SHA512 | aa32be3d91bf6e2c8fed0d0e0407723466b477ab0d27c5d3cd705ac73365ab4c56de4f16d4786ee586e750d6835eba09775dbf5a93b0da0eaea4326f2fc2bd5c |
memory/1256-5-0x0000000000F30000-0x0000000000F9D000-memory.dmp
memory/1256-7-0x00000000042A0000-0x00000000046A0000-memory.dmp
memory/1256-8-0x00000000042A0000-0x00000000046A0000-memory.dmp
memory/1256-9-0x00000000042A0000-0x00000000046A0000-memory.dmp
memory/1256-10-0x00007FFFA5D50000-0x00007FFFA5F45000-memory.dmp
memory/1256-13-0x00000000042A0000-0x00000000046A0000-memory.dmp
memory/1256-12-0x00000000769B0000-0x0000000076BC5000-memory.dmp
memory/4032-14-0x00000000005B0000-0x00000000005B9000-memory.dmp
memory/1256-15-0x0000000000F30000-0x0000000000F9D000-memory.dmp
memory/4032-17-0x00000000023D0000-0x00000000027D0000-memory.dmp
memory/4032-18-0x00000000023D0000-0x00000000027D0000-memory.dmp
memory/4032-19-0x00007FFFA5D50000-0x00007FFFA5F45000-memory.dmp
memory/4032-20-0x00000000023D0000-0x00000000027D0000-memory.dmp
memory/4032-22-0x00000000769B0000-0x0000000076BC5000-memory.dmp
memory/4032-23-0x00000000023D0000-0x00000000027D0000-memory.dmp
memory/1664-25-0x0000000000F30000-0x0000000000F9D000-memory.dmp
memory/1664-28-0x0000000003D50000-0x0000000004150000-memory.dmp
memory/1664-27-0x0000000003D50000-0x0000000004150000-memory.dmp
memory/1664-30-0x0000000003D50000-0x0000000004150000-memory.dmp
memory/1664-29-0x00007FFFA5D50000-0x00007FFFA5F45000-memory.dmp
memory/1664-32-0x00000000769B0000-0x0000000076BC5000-memory.dmp
memory/1348-36-0x0000000002570000-0x0000000002970000-memory.dmp
memory/1348-37-0x00007FFFA5D50000-0x00007FFFA5F45000-memory.dmp
memory/1348-35-0x0000000002570000-0x0000000002970000-memory.dmp
memory/1348-39-0x0000000002570000-0x0000000002970000-memory.dmp
memory/1348-40-0x00000000769B0000-0x0000000076BC5000-memory.dmp
memory/1348-41-0x0000000002570000-0x0000000002970000-memory.dmp