Analysis
- max time kernel
160s - max time network
176s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
11/04/2024, 14:37
General
- Target g.ps1
- Size 472KB
- Sample240411-ry5jrsde36
- SHA256 531cd9a99acba3e4377d828403d113e5e7fd5f6e919d618101dc490c98a2c312
Malware Config
Signatures
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\g.ps11⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4004 --field-trial-handle=2272,i,11831746627654527593,10138103687018060346,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_psp2niqx.og1.ps1
memory/1428-21-0x00007FF8EACD0000-0x00007FF8EAD8E000-memory.dmp
memory/1428-15-0x00000202B0F80000-0x00000202B0F90000-memory.dmp
memory/1428-11-0x00000202B0F00000-0x00000202B0F10000-memory.dmp
memory/1428-12-0x00000202B0F00000-0x00000202B0F10000-memory.dmp
memory/1428-13-0x00000202B0F00000-0x00000202B0F10000-memory.dmp
memory/1428-14-0x00000202CB6C0000-0x00000202CB71E000-memory.dmp
memory/1428-0-0x00000202B0ED0000-0x00000202B0EF2000-memory.dmp
memory/1428-16-0x00000202CB730000-0x00000202CBB30000-memory.dmp
memory/1428-17-0x00000202CB730000-0x00000202CBB30000-memory.dmp
memory/1428-18-0x00000202CB730000-0x00000202CBB30000-memory.dmp
memory/1428-10-0x00007FF8CB860000-0x00007FF8CC321000-memory.dmp
memory/1428-19-0x00007FF8EADD0000-0x00007FF8EAFC5000-memory.dmp
memory/1428-33-0x00000202CB730000-0x00000202CBB30000-memory.dmp
memory/1428-22-0x00007FF8E8680000-0x00007FF8E8949000-memory.dmp
memory/1428-30-0x00000202B0F80000-0x00000202B0F90000-memory.dmp
memory/1428-29-0x00007FF8CB860000-0x00007FF8CC321000-memory.dmp
memory/1428-20-0x00000202CB730000-0x00000202CBB30000-memory.dmp
memory/1832-23-0x000001E7DD4E0000-0x000001E7DD4E9000-memory.dmp
memory/1832-32-0x00007FF8EADD0000-0x00007FF8EAFC5000-memory.dmp
memory/1832-31-0x000001E7DEF60000-0x000001E7DF360000-memory.dmp
memory/1832-28-0x000001E7DEF60000-0x000001E7DF360000-memory.dmp
memory/1832-34-0x00007FF8EACD0000-0x00007FF8EAD8E000-memory.dmp
memory/1832-35-0x00007FF8E8680000-0x00007FF8E8949000-memory.dmp
memory/1832-36-0x000001E7DEF60000-0x000001E7DF360000-memory.dmp