rhysida | b183b142d3c4e99ee07c3407b82858146fa61ded95be2e67ce920c8002309fb0

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12-06-2024 00:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
Size

906KB
MD5

7cfba113342f78b5909f606c26fc1dc4
SHA1

f9e65f0cb46128bdc218053e1549c5e584ab6cd5
SHA256

b183b142d3c4e99ee07c3407b82858146fa61ded95be2e67ce920c8002309fb0
SHA512

9339d2b22b074f0357dd1319d02e6675394bb6c9fbd5d6ac51bc5554c95b5d0044bf05e0c3626c4f79f9c0a48dcb0a4063a32cdd99531ee8071491b661cc24d2
SSDEEP

6144:BYdNbzC+2VEIxgYClW0ClmQzrAczJPBv7ameMF87XUPwfO+jOT:SkLClW0ClmQzrtFBv767XcoO+

Score

10^/10

rhysida ransomware spyware stealer

Malware Config

Signatures

Rhysida
Rhysida is a ransomware that is written in C++ and discovered in 2023.
ransomware rhysida
Renames multiple (8059) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Mozilla Firefox\browser\CriticalBreachDetected.pdf	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18237_.WMF.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\CriticalBreachDetected.pdf	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN086.XML.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02746U.BMP.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00192_.WMF.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\vlc.mo.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\PREVIEW.GIF.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator.nl_zh_4.4.0.v20140623020002.jar.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TR00482_.WMF.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS01603_.WMF.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Triedit\en-US\CriticalBreachDetected.pdf	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_FileHigh.jpg.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\FLYER.XML.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0298653.WMF.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0287641.JPG.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File created	C:\Program Files\DVD Maker\it-IT\CriticalBreachDetected.pdf	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hy\CriticalBreachDetected.pdf	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\PREVIEW.GIF.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_italic.gif.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00254_.WMF.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14868_.GIF.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0241043.WMF.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\CriticalBreachDetected.pdf	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mn\CriticalBreachDetected.pdf	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\THMBNAIL.PNG.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\bg_SlateBlue.gif.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341554.JPG.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0178348.JPG.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\NamedURLs.HxK.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01866_.WMF.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18241_.WMF.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\MOR6INT.REST.IDX_DLL.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR33F.GIF.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\OutofSyncIconImagesMask.bmp.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\include\jawt.h.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\css\CriticalBreachDetected.pdf	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD15155_.GIF.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0216600.WMF.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-explorer.xml.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files\Java\jre7\lib\currency.data.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Library\Analysis\ATPVBAEN.XLAM.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00382_.WMF.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_zh_TW.jar.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\CriticalBreachDetected.pdf	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf_1.1.0.v20140408-1354.jar.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\THMBNAIL.PNG.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange\button.gif.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Stanley.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.io_8.1.14.v20131031.jar.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00810_.WMF.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.LIC.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\mset7ge.kic.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-tools.jar.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\shvlzm.exe.mui.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\OriginLetter.Dotx.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14710_.GIF.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0300840.WMF.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Vilnius.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Australia\Sydney.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\vlc.mo.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt55.ths.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0212953.WMF.rhysida	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1664	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1500	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
1500	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 1160	1500	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe	31
PID 1500 wrote to memory of 1160	1500	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe	31
PID 1500 wrote to memory of 1160	1500	2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe	31
PID 1160 wrote to memory of 896	1160	cmd.exe	33
PID 1160 wrote to memory of 896	1160	cmd.exe	33
PID 1160 wrote to memory of 896	1160	cmd.exe	33
PID 896 wrote to memory of 1664	896	cmd.exe	34
PID 896 wrote to memory of 1664	896	cmd.exe	34
PID 896 wrote to memory of 1664	896	cmd.exe	34

C:\Users\Admin\AppData\Local\Temp\2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cmd.exe /c start ping 127.0.0.1 -n 2 > nul && del /f /q "C:\Users\Admin\AppData\Local\Temp\C:\Users\Admin\AppData\Local\Temp\2024-06-12_7cfba113342f78b5909f606c26fc1dc4_rhysida.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1160
- - C:\Windows\system32\cmd.exe
    cmd.exe /c start ping 127.0.0.1 -n 2
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:896
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:1664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\CriticalBreachDetected.pdf

Filesize
111KB

MD5
2d94bc3146c72f6f8caf958efcd32fa3

SHA1
0be34aaca455daa62a296b56d025f396f066e5d5

SHA256
3cc02a7e8dfb12a7f0fc44c80115f8bc6e460f7b39f32b02b2185ef8424a07ec

SHA512
6fc7d3c2081485dd94c88cd61516d218139d330cd057316d2ba118c090833f00ea34225fb3453a25cb1f2666073567c84553e33093cc02924b3534ff360ecb9f

Download Submit
memory/1500-2691-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/1500-4381-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/1500-6140-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/1500-8697-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/1500-9915-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/1500-10247-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/1500-10248-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/1500-10249-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download