rhadamanthys | 8a9f45044aca163fcdd47e4fc6f4c72cc6e17231b3a467758e641d8a76684109

Analysis

max time kernel
151s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
07-06-2024 08:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Requirements upwork.scr
Size

699.6MB
MD5

1cbf33e0f9964d14cc107236d8060972
SHA1

bd7052b3f20a83ed7ce837030d7aee6b1150781a
SHA256

b7615563fc08671d442b6f8102eeb61f5058f75821bac5f701385f7c123d7fa5
SHA512

1042f8ee6b23000d55082af3061a8559c266302d5a72eb35041d33a090ec4e70850f7d55df3c3463478d40d0a17f4a1834d9e72a59829041540898d6b4bba63b
SSDEEP

393216:fM07b4unYmNXdJu4LTYi7dRcogr6+7QJhrrXZEwCz:fNIunb9bJRRgrWXZEw0

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 5052 created 2616	5052	calc.exe	44

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	Requirements upwork.scr

Executes dropped EXE 3 IoCs

pid	Process
1104	pythonw.exe
1996	pythonw.exe
5052	calc.exe

Loads dropped DLL 4 IoCs

pid	Process
1104	pythonw.exe
1104	pythonw.exe
1996	pythonw.exe
1996	pythonw.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	explorer.exe
File opened (read-only)	\??\p:	explorer.exe
File opened (read-only)	\??\P:	explorer.exe
File opened (read-only)	\??\q:	explorer.exe
File opened (read-only)	\??\Z:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\S:	explorer.exe
File opened (read-only)	\??\s:	explorer.exe
File opened (read-only)	\??\u:	explorer.exe
File opened (read-only)	\??\a:	explorer.exe
File opened (read-only)	\??\A:	explorer.exe
File opened (read-only)	\??\b:	explorer.exe
File opened (read-only)	\??\K:	explorer.exe
File opened (read-only)	\??\m:	explorer.exe
File opened (read-only)	\??\r:	explorer.exe
File opened (read-only)	\??\W:	explorer.exe
File opened (read-only)	\??\y:	explorer.exe
File opened (read-only)	\??\T:	explorer.exe
File opened (read-only)	\??\x:	explorer.exe
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\G:	explorer.exe
File opened (read-only)	\??\H:	explorer.exe
File opened (read-only)	\??\n:	explorer.exe
File opened (read-only)	\??\O:	explorer.exe
File opened (read-only)	\??\t:	explorer.exe
File opened (read-only)	\??\X:	explorer.exe
File opened (read-only)	\??\j:	explorer.exe
File opened (read-only)	\??\k:	explorer.exe
File opened (read-only)	\??\Q:	explorer.exe
File opened (read-only)	\??\V:	explorer.exe
File opened (read-only)	\??\w:	explorer.exe
File opened (read-only)	\??\Y:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\g:	explorer.exe
File opened (read-only)	\??\i:	explorer.exe
File opened (read-only)	\??\o:	explorer.exe
File opened (read-only)	\??\R:	explorer.exe
File opened (read-only)	\??\B:	explorer.exe
File opened (read-only)	\??\h:	explorer.exe
File opened (read-only)	\??\I:	explorer.exe
File opened (read-only)	\??\J:	explorer.exe
File opened (read-only)	\??\l:	explorer.exe
File opened (read-only)	\??\M:	explorer.exe
File opened (read-only)	\??\U:	explorer.exe
File opened (read-only)	\??\z:	explorer.exe
File opened (read-only)	\??\L:	explorer.exe
File opened (read-only)	\??\N:	explorer.exe
File opened (read-only)	\??\v:	explorer.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1996 set thread context of 1892	1996	pythonw.exe	97
PID 4408 set thread context of 5052	4408	explorer.exe	116

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	Requirements upwork.scr

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
1104	pythonw.exe
1996	pythonw.exe
1996	pythonw.exe
1996	pythonw.exe
1892	cmd.exe
1892	cmd.exe
1892	cmd.exe
1892	cmd.exe
2484	AcroRd32.exe
2484	AcroRd32.exe
2484	AcroRd32.exe
2484	AcroRd32.exe
2484	AcroRd32.exe
2484	AcroRd32.exe
2484	AcroRd32.exe
2484	AcroRd32.exe
2484	AcroRd32.exe
2484	AcroRd32.exe
2484	AcroRd32.exe
2484	AcroRd32.exe
2484	AcroRd32.exe
2484	AcroRd32.exe
2484	AcroRd32.exe
2484	AcroRd32.exe
2484	AcroRd32.exe
2484	AcroRd32.exe
2484	AcroRd32.exe
2484	AcroRd32.exe
4408	explorer.exe
4408	explorer.exe
5052	calc.exe
5052	calc.exe
2152	dialer.exe
2152	dialer.exe
2152	dialer.exe
2152	dialer.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1996	pythonw.exe
1892	cmd.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2484	AcroRd32.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2484	AcroRd32.exe
2484	AcroRd32.exe
2484	AcroRd32.exe
2484	AcroRd32.exe
2484	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 1104	2132	Requirements upwork.scr	93
PID 2132 wrote to memory of 1104	2132	Requirements upwork.scr	93
PID 2132 wrote to memory of 2484	2132	Requirements upwork.scr	94
PID 2132 wrote to memory of 2484	2132	Requirements upwork.scr	94
PID 2132 wrote to memory of 2484	2132	Requirements upwork.scr	94
PID 1104 wrote to memory of 1996	1104	pythonw.exe	95
PID 1104 wrote to memory of 1996	1104	pythonw.exe	95
PID 1996 wrote to memory of 1892	1996	pythonw.exe	97
PID 1996 wrote to memory of 1892	1996	pythonw.exe	97
PID 1996 wrote to memory of 1892	1996	pythonw.exe	97
PID 2484 wrote to memory of 2496	2484	AcroRd32.exe	103
PID 2484 wrote to memory of 2496	2484	AcroRd32.exe	103
PID 2484 wrote to memory of 2496	2484	AcroRd32.exe	103
PID 2496 wrote to memory of 4636	2496	RdrCEF.exe	104
PID 2496 wrote to memory of 4636	2496	RdrCEF.exe	104
PID 2496 wrote to memory of 4636	2496	RdrCEF.exe	104
PID 2496 wrote to memory of 4636	2496	RdrCEF.exe	104
PID 2496 wrote to memory of 4636	2496	RdrCEF.exe	104
PID 2496 wrote to memory of 4636	2496	RdrCEF.exe	104
PID 2496 wrote to memory of 4636	2496	RdrCEF.exe	104
PID 2496 wrote to memory of 4636	2496	RdrCEF.exe	104
PID 2496 wrote to memory of 4636	2496	RdrCEF.exe	104
PID 2496 wrote to memory of 4636	2496	RdrCEF.exe	104
PID 2496 wrote to memory of 4636	2496	RdrCEF.exe	104
PID 2496 wrote to memory of 4636	2496	RdrCEF.exe	104
PID 2496 wrote to memory of 4636	2496	RdrCEF.exe	104
PID 2496 wrote to memory of 4636	2496	RdrCEF.exe	104
PID 2496 wrote to memory of 4636	2496	RdrCEF.exe	104
PID 2496 wrote to memory of 4636	2496	RdrCEF.exe	104
PID 2496 wrote to memory of 4636	2496	RdrCEF.exe	104
PID 2496 wrote to memory of 4636	2496	RdrCEF.exe	104
PID 2496 wrote to memory of 4636	2496	RdrCEF.exe	104
PID 2496 wrote to memory of 4636	2496	RdrCEF.exe	104
PID 2496 wrote to memory of 4636	2496	RdrCEF.exe	104
PID 2496 wrote to memory of 4636	2496	RdrCEF.exe	104
PID 2496 wrote to memory of 4636	2496	RdrCEF.exe	104
PID 2496 wrote to memory of 4636	2496	RdrCEF.exe	104
PID 2496 wrote to memory of 4636	2496	RdrCEF.exe	104
PID 2496 wrote to memory of 4636	2496	RdrCEF.exe	104
PID 2496 wrote to memory of 4636	2496	RdrCEF.exe	104
PID 2496 wrote to memory of 4636	2496	RdrCEF.exe	104
PID 2496 wrote to memory of 4636	2496	RdrCEF.exe	104
PID 2496 wrote to memory of 4636	2496	RdrCEF.exe	104
PID 2496 wrote to memory of 4636	2496	RdrCEF.exe	104
PID 2496 wrote to memory of 4636	2496	RdrCEF.exe	104
PID 2496 wrote to memory of 4636	2496	RdrCEF.exe	104
PID 2496 wrote to memory of 4636	2496	RdrCEF.exe	104
PID 2496 wrote to memory of 4636	2496	RdrCEF.exe	104
PID 2496 wrote to memory of 4636	2496	RdrCEF.exe	104
PID 2496 wrote to memory of 4636	2496	RdrCEF.exe	104
PID 2496 wrote to memory of 4636	2496	RdrCEF.exe	104
PID 2496 wrote to memory of 4636	2496	RdrCEF.exe	104
PID 2496 wrote to memory of 4636	2496	RdrCEF.exe	104
PID 2496 wrote to memory of 4636	2496	RdrCEF.exe	104
PID 2496 wrote to memory of 1272	2496	RdrCEF.exe	105
PID 2496 wrote to memory of 1272	2496	RdrCEF.exe	105
PID 2496 wrote to memory of 1272	2496	RdrCEF.exe	105
PID 2496 wrote to memory of 1272	2496	RdrCEF.exe	105
PID 2496 wrote to memory of 1272	2496	RdrCEF.exe	105
PID 2496 wrote to memory of 1272	2496	RdrCEF.exe	105
PID 2496 wrote to memory of 1272	2496	RdrCEF.exe	105
PID 2496 wrote to memory of 1272	2496	RdrCEF.exe	105
PID 2496 wrote to memory of 1272	2496	RdrCEF.exe	105
PID 2496 wrote to memory of 1272	2496	RdrCEF.exe	105

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2616
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2152

C:\Users\Admin\AppData\Local\Temp\Requirements upwork.scr
"C:\Users\Admin\AppData\Local\Temp\Requirements upwork.scr" /S
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Users\Admin\AppData\Roaming\Programs\WinRAR\pythonw.exe
  "C:\Users\Admin\AppData\Roaming\Programs\WinRAR\pythonw.exe" /S
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1104
- - C:\Users\Admin\AppData\Roaming\wh_Ultra\pythonw.exe
    "C:\Users\Admin\AppData\Roaming\wh_Ultra\pythonw.exe" /S
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1996
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\SysWOW64\cmd.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:1892
    - - C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe" /S
        5⤵
        Enumerates connected drives
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:4408
      - C:\Windows\SysWoW64\calc.exe
        
        C:\Windows\SysWoW64\calc.exe
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:5052
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\Temp\Requirements.pdf"
  2⤵
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2484
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2496
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=72923F373BB08749839827CE83061791 --mojo-platform-channel-handle=1732 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:4636
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=5ABF09510C46B6297890BD633A45BEC9 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=5ABF09510C46B6297890BD633A45BEC9 --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:1272
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DC03D89F61CD6EABED98A08A2C0C2414 --mojo-platform-channel-handle=2316 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:1288
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BE5357285D63C6B0DB38CA46B050E6C7 --mojo-platform-channel-handle=1932 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:1812
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=2B8034B2704DE7D1CA643EAC1EFEDE67 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=2B8034B2704DE7D1CA643EAC1EFEDE67 --renderer-client-id=6 --mojo-platform-channel-handle=1872 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:1104
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F8052D94DE0DE3964F7497FC918A3B9B --mojo-platform-channel-handle=2376 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:4796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4244,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:8
1⤵
PID:1016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
3df3c9d258679ccee4567278ab48c97d

SHA1
0cd4e28f930ca5d30b73b5f07fabd51c95309eef

SHA256
181f0ba491e8e88e907040d36a47a0e0c4ed5575ee15dbee3d2ddda5ad79869f

SHA512
c3567474fd402421b52eea430c437c805cc6c07cc018b2ab37f5546f4576e32c7ae77f49cae4f405e617ea4d49d9c190055031c9b457239bc9f6d07e15686522

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
36KB

MD5
b30d3becc8731792523d599d949e63f5

SHA1
19350257e42d7aee17fb3bf139a9d3adb330fad4

SHA256
b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

SHA512
523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit
C:\Users\Admin\AppData\Local\Temp\d9740971

Filesize
2.4MB

MD5
f3408db6841b9472cb403310b445608d

SHA1
ea59bbe4a82d3af90b8db53f21f0438ae567ed0c

SHA256
414b27b15dd5d1ad7b0806838e7e9d97a3fdd783fe9a55e7c114a1345dc88950

SHA512
535dc3eb4fc899d65ecaaf299c9573076e1739625c100259c332ed40e5a46d3a2660b7a144507001a986f203a991484d6b8b7f7eb149b1e7cc87f8cc352db1b6

Download Submit
C:\Users\Admin\AppData\Roaming\Programs\WinRAR\VCRUNTIME140.dll

Filesize
106KB

MD5
49c96cecda5c6c660a107d378fdfc3d4

SHA1
00149b7a66723e3f0310f139489fe172f818ca8e

SHA256
69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc

SHA512
e09e072f3095379b0c921d41d6e64f4f1cd78400594a2317cfb5e5dca03dedb5a8239ed89905c9e967d1acb376b0585a35addf6648422c7ddb472ce38b1ba60d

Download Submit
C:\Users\Admin\AppData\Roaming\Programs\WinRAR\birdseed.ppt

Filesize
49KB

MD5
cdec9e890deef870a230ac61480ba210

SHA1
549a622bb93e5ab4114f10d8ed884d15be5e3777

SHA256
c36e7e60ca938247cb90be8af70a8044e965dd58c69260748f6bfe3e5109eb04

SHA512
ecb49dcaeaaf7fdefb622c8a2d7b8c187e8d791f8e26e16c669600aa24868d93cbccec0e7fc1cf0be12c7ea7b4f4412f0802e93ac5f2849229aa9c0b3e6bc98e

Download Submit
C:\Users\Admin\AppData\Roaming\Programs\WinRAR\python310.dll

Filesize
4.3MB

MD5
8fbbe41173ae011a717c706f25d06121

SHA1
db35f1d1a0916cc0732b9747bd67a37e827440aa

SHA256
ccd635f18a955d0d6bec012be96de876bb2009ff522c3457df40792405637a5a

SHA512
8a17ecd7545ccee3bba62df2c5a00b839f60e0009fa55d9c9d8cc962349a501c618d65f83de2a977bda9b4368224f6ea89a881478d58fa4b68a9891b998d985a

Download Submit
C:\Users\Admin\AppData\Roaming\Programs\WinRAR\pythonw.exe

Filesize
94KB

MD5
9a4cc0d8e7007f7ef20ca585324e0739

SHA1
f3e5a2e477cac4bab85940a2158eed78f2d74441

SHA256
040d121a3179f49cd3f33f4bc998bc8f78b7f560bfd93f279224d69e76a06e92

SHA512
54636a48141804112f5b4f2fc70cb7c959a041e5743aeedb5184091b51daa1d1a03f0016e8299c0d56d924c6c8ae585e4fc864021081ffdf1e6f3eab11dd43b3

Download Submit
C:\Users\Admin\AppData\Roaming\Programs\WinRAR\rhatany.docx

Filesize
2.2MB

MD5
95a2d2cbff9d49bb8f71a968e6d70692

SHA1
d1880df094228be3764a6d466396cd86a16749db

SHA256
3074fd2d1c68a0224d9a1bb28c222ca303af7efe6a251b0ca2b7160c635ecdd5

SHA512
09296b402aeeec2ba5e8005753533a78cf368b361b115e0d11d79375653036c0670918564bc53119a41e5d43a8680e69d339e44d34d33b53176e54550641e098

Download Submit
C:\Users\Admin\AppData\Roaming\Temp\Requirements.pdf

Filesize
717KB

MD5
720b78ca59dbb0e1b885f47b9c4eebd3

SHA1
98629bc8c27329023931d158d2ab879e8136b5ff

SHA256
73300eda96e39870895468cf7a7b90616b37d5d7673671c89db1776c192ed2be

SHA512
ee22206441b41881acbae939dba2f4269e652782ba485963f81d3ae2aedd3838bba2a673de502a367cdc5f1a8c33a08e120495a473d617f2ec049fa5f0be17ac

Download Submit
memory/1104-30-0x00007FFCA7A20000-0x00007FFCA7B92000-memory.dmp

Filesize
1.4MB

Download
memory/1892-79-0x00007FFCC6BF0000-0x00007FFCC6DE5000-memory.dmp

Filesize
2.0MB

Download
memory/1892-178-0x00000000692D0000-0x000000006944B000-memory.dmp

Filesize
1.5MB

Download
memory/1892-80-0x00000000692D0000-0x000000006944B000-memory.dmp

Filesize
1.5MB

Download
memory/1996-69-0x00007FFCA7E80000-0x00007FFCA7FF2000-memory.dmp

Filesize
1.4MB

Download
memory/1996-45-0x00007FFCA7E80000-0x00007FFCA7FF2000-memory.dmp

Filesize
1.4MB

Download
memory/2152-192-0x0000000000CA0000-0x0000000000CA9000-memory.dmp

Filesize
36KB

Download
memory/2152-196-0x00000000028D0000-0x0000000002CD0000-memory.dmp

Filesize
4.0MB

Download
memory/2152-197-0x00007FFCC6BF0000-0x00007FFCC6DE5000-memory.dmp

Filesize
2.0MB

Download
memory/2152-199-0x0000000076E50000-0x0000000077065000-memory.dmp

Filesize
2.1MB

Download
memory/4408-183-0x00007FF6F3560000-0x00007FF6F371C000-memory.dmp

Filesize
1.7MB

Download
memory/4408-201-0x00007FF6F3560000-0x00007FF6F371C000-memory.dmp

Filesize
1.7MB

Download
memory/5052-186-0x00000000008E0000-0x000000000094D000-memory.dmp

Filesize
436KB

Download
memory/5052-187-0x0000000003DF0000-0x00000000041F0000-memory.dmp

Filesize
4.0MB

Download
memory/5052-188-0x0000000003DF0000-0x00000000041F0000-memory.dmp

Filesize
4.0MB

Download
memory/5052-189-0x00007FFCC6BF0000-0x00007FFCC6DE5000-memory.dmp

Filesize
2.0MB

Download
memory/5052-191-0x0000000076E50000-0x0000000077065000-memory.dmp

Filesize
2.1MB

Download
memory/5052-194-0x00000000008E0000-0x000000000094D000-memory.dmp

Filesize
436KB

Download