Analysis
-
max time kernel
137s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
08-07-2024 08:41
Static task
static1
Behavioral task
behavioral1
Sample
7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe
Resource
win10v2004-20240704-en
General
-
Target
7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe
-
Size
5.4MB
-
MD5
a2a9c309c5300a53d2c2fc41b71b174b
-
SHA1
f6c26eae1925425fa8966266e87a57b688fad218
-
SHA256
7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224
-
SHA512
a29eec8fa98174a74e9bd93c5902cdd95ce329ff8b7a1469901a95705dc1d7fffde58afa296399febb8559d8cd73c932945e85cce8af54e7a672d8f1618e3f7c
-
SSDEEP
98304:j+ddAtuMvY00V2vtQSH7OuqeGszSQTADu0mL63KQOKvYA1ZuoyQPNf+xKi:wdOuMvc8VdbOuqePmQTAKH63NYAiGfiT
Malware Config
Signatures
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exedescription pid process target process PID 1584 created 2716 1584 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe sihost.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\Control Panel\International\Geo\Nation 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe -
Executes dropped EXE 2 IoCs
Processes:
BLueHvffhw.exeBLueHvffhw.exepid process 1376 BLueHvffhw.exe 1632 BLueHvffhw.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exeBLueHvffhw.exedescription pid process target process PID 1520 set thread context of 1584 1520 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe PID 1376 set thread context of 1632 1376 BLueHvffhw.exe BLueHvffhw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exeopenwith.exepowershell.exepid process 1584 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe 1584 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe 1236 openwith.exe 1236 openwith.exe 1236 openwith.exe 1236 openwith.exe 2796 powershell.exe 2796 powershell.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exeBLueHvffhw.exeBLueHvffhw.exepowershell.exedescription pid process Token: SeDebugPrivilege 1520 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe Token: SeDebugPrivilege 1520 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe Token: SeDebugPrivilege 1376 BLueHvffhw.exe Token: SeDebugPrivilege 1376 BLueHvffhw.exe Token: SeDebugPrivilege 1632 BLueHvffhw.exe Token: SeDebugPrivilege 2796 powershell.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exeBLueHvffhw.exedescription pid process target process PID 1520 wrote to memory of 1376 1520 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe BLueHvffhw.exe PID 1520 wrote to memory of 1376 1520 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe BLueHvffhw.exe PID 1520 wrote to memory of 1376 1520 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe BLueHvffhw.exe PID 1520 wrote to memory of 1584 1520 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe PID 1520 wrote to memory of 1584 1520 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe PID 1520 wrote to memory of 1584 1520 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe PID 1520 wrote to memory of 1584 1520 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe PID 1520 wrote to memory of 1584 1520 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe PID 1520 wrote to memory of 1584 1520 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe PID 1520 wrote to memory of 1584 1520 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe PID 1520 wrote to memory of 1584 1520 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe PID 1584 wrote to memory of 1236 1584 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe openwith.exe PID 1584 wrote to memory of 1236 1584 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe openwith.exe PID 1584 wrote to memory of 1236 1584 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe openwith.exe PID 1584 wrote to memory of 1236 1584 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe openwith.exe PID 1584 wrote to memory of 1236 1584 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe openwith.exe PID 1376 wrote to memory of 1632 1376 BLueHvffhw.exe BLueHvffhw.exe PID 1376 wrote to memory of 1632 1376 BLueHvffhw.exe BLueHvffhw.exe PID 1376 wrote to memory of 1632 1376 BLueHvffhw.exe BLueHvffhw.exe PID 1376 wrote to memory of 1632 1376 BLueHvffhw.exe BLueHvffhw.exe PID 1376 wrote to memory of 1632 1376 BLueHvffhw.exe BLueHvffhw.exe PID 1376 wrote to memory of 1632 1376 BLueHvffhw.exe BLueHvffhw.exe PID 1376 wrote to memory of 1632 1376 BLueHvffhw.exe BLueHvffhw.exe PID 1376 wrote to memory of 1632 1376 BLueHvffhw.exe BLueHvffhw.exe
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\SysWOW64\openwith.exe"C:\Windows\system32\openwith.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe"C:\Users\Admin\AppData\Local\Temp\7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BLueHvffhw.exe"C:\Users\Admin\AppData\Local\Temp\BLueHvffhw.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BLueHvffhw.exe"C:\Users\Admin\AppData\Local\Temp\BLueHvffhw.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe"C:\Users\Admin\AppData\Local\Temp\7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAARgBhAGwAbABiAGEAYwBrAEIAdQBmAGYAZQByAC4AZQB4AGUAOwA=1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe.logFilesize
805B
MD558a9108e39c2ea50e65c23be3a9407cf
SHA1fb21f7b9330aa1a77080a3243b81b49035102d7b
SHA2566049be83020702896a539b5c8c13270add224d7b91b3ee0bebc328791b74a84b
SHA51293804ee8a4560503e47c07f5fa4a959e23355a01aba406c103d339debc9b2b1d20a345cdbb8d8069dac97b9151f228cf559ac3dde1500e3484fba1a4126842bf
-
C:\Users\Admin\AppData\Local\Temp\BLueHvffhw.exeFilesize
2.7MB
MD5abf2da5b3e7845f50463a72f8b6e6aaa
SHA1a5299f55950ca82134da73b9e9844c5d624114c3
SHA2562a4b1ae0ae67cd31f85680e6351bd5b92ff61e246c158decb1a43a3ef01d9f2c
SHA512570e8becd18b36d66a2ac295518c8ba3c0bc83d8a6175e601b509efd9237462d1d0826dbeb9e52465e7cdcd57cb4ae7fd859ddc4a5aad895cef6ef7fa981e8a4
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rpesen1j.414.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/1376-9824-0x0000000074710000-0x0000000074EC0000-memory.dmpFilesize
7.7MB
-
memory/1376-9818-0x0000000006840000-0x0000000006934000-memory.dmpFilesize
976KB
-
memory/1376-9817-0x0000000074710000-0x0000000074EC0000-memory.dmpFilesize
7.7MB
-
memory/1376-4915-0x0000000005820000-0x0000000005AD8000-memory.dmpFilesize
2.7MB
-
memory/1376-4908-0x0000000074710000-0x0000000074EC0000-memory.dmpFilesize
7.7MB
-
memory/1376-4906-0x0000000000C10000-0x0000000000ECC000-memory.dmpFilesize
2.7MB
-
memory/1520-28-0x0000000006320000-0x000000000688E000-memory.dmpFilesize
5.4MB
-
memory/1520-14-0x0000000006320000-0x000000000688E000-memory.dmpFilesize
5.4MB
-
memory/1520-26-0x0000000006320000-0x000000000688E000-memory.dmpFilesize
5.4MB
-
memory/1520-34-0x0000000006320000-0x000000000688E000-memory.dmpFilesize
5.4MB
-
memory/1520-40-0x0000000006320000-0x000000000688E000-memory.dmpFilesize
5.4MB
-
memory/1520-38-0x0000000006320000-0x000000000688E000-memory.dmpFilesize
5.4MB
-
memory/1520-44-0x0000000006320000-0x000000000688E000-memory.dmpFilesize
5.4MB
-
memory/1520-54-0x0000000006320000-0x000000000688E000-memory.dmpFilesize
5.4MB
-
memory/1520-52-0x0000000006320000-0x000000000688E000-memory.dmpFilesize
5.4MB
-
memory/1520-50-0x0000000006320000-0x000000000688E000-memory.dmpFilesize
5.4MB
-
memory/1520-56-0x0000000006320000-0x000000000688E000-memory.dmpFilesize
5.4MB
-
memory/1520-58-0x0000000006320000-0x000000000688E000-memory.dmpFilesize
5.4MB
-
memory/1520-62-0x0000000006320000-0x000000000688E000-memory.dmpFilesize
5.4MB
-
memory/1520-68-0x0000000006320000-0x000000000688E000-memory.dmpFilesize
5.4MB
-
memory/1520-66-0x0000000006320000-0x000000000688E000-memory.dmpFilesize
5.4MB
-
memory/1520-64-0x0000000006320000-0x000000000688E000-memory.dmpFilesize
5.4MB
-
memory/1520-60-0x0000000006320000-0x000000000688E000-memory.dmpFilesize
5.4MB
-
memory/1520-48-0x0000000006320000-0x000000000688E000-memory.dmpFilesize
5.4MB
-
memory/1520-46-0x0000000006320000-0x000000000688E000-memory.dmpFilesize
5.4MB
-
memory/1520-42-0x0000000006320000-0x000000000688E000-memory.dmpFilesize
5.4MB
-
memory/1520-36-0x0000000006320000-0x000000000688E000-memory.dmpFilesize
5.4MB
-
memory/1520-32-0x0000000006320000-0x000000000688E000-memory.dmpFilesize
5.4MB
-
memory/1520-30-0x0000000006320000-0x000000000688E000-memory.dmpFilesize
5.4MB
-
memory/1520-0-0x000000007471E000-0x000000007471F000-memory.dmpFilesize
4KB
-
memory/1520-24-0x0000000006320000-0x000000000688E000-memory.dmpFilesize
5.4MB
-
memory/1520-22-0x0000000006320000-0x000000000688E000-memory.dmpFilesize
5.4MB
-
memory/1520-16-0x0000000006320000-0x000000000688E000-memory.dmpFilesize
5.4MB
-
memory/1520-20-0x0000000006320000-0x000000000688E000-memory.dmpFilesize
5.4MB
-
memory/1520-13-0x0000000006320000-0x000000000688E000-memory.dmpFilesize
5.4MB
-
memory/1520-4891-0x0000000074710000-0x0000000074EC0000-memory.dmpFilesize
7.7MB
-
memory/1520-4892-0x0000000074710000-0x0000000074EC0000-memory.dmpFilesize
7.7MB
-
memory/1520-4894-0x0000000000CD0000-0x0000000000D1C000-memory.dmpFilesize
304KB
-
memory/1520-4893-0x0000000007890000-0x0000000007C40000-memory.dmpFilesize
3.7MB
-
memory/1520-18-0x0000000006320000-0x000000000688E000-memory.dmpFilesize
5.4MB
-
memory/1520-7-0x0000000006320000-0x000000000688E000-memory.dmpFilesize
5.4MB
-
memory/1520-4907-0x0000000005FA0000-0x0000000005FF4000-memory.dmpFilesize
336KB
-
memory/1520-9-0x0000000006320000-0x000000000688E000-memory.dmpFilesize
5.4MB
-
memory/1520-1-0x00000000001D0000-0x0000000000748000-memory.dmpFilesize
5.5MB
-
memory/1520-2-0x0000000006320000-0x0000000006894000-memory.dmpFilesize
5.5MB
-
memory/1520-10-0x0000000006320000-0x000000000688E000-memory.dmpFilesize
5.4MB
-
memory/1520-3-0x00000000057A0000-0x0000000005D44000-memory.dmpFilesize
5.6MB
-
memory/1520-4913-0x0000000074710000-0x0000000074EC0000-memory.dmpFilesize
7.7MB
-
memory/1520-4-0x0000000005290000-0x0000000005322000-memory.dmpFilesize
584KB
-
memory/1520-5-0x0000000006320000-0x000000000688E000-memory.dmpFilesize
5.4MB
-
memory/1584-4941-0x0000000074710000-0x0000000074EC0000-memory.dmpFilesize
7.7MB
-
memory/1584-4916-0x00000000033D0000-0x00000000033D8000-memory.dmpFilesize
32KB
-
memory/1584-4914-0x0000000074710000-0x0000000074EC0000-memory.dmpFilesize
7.7MB
-
memory/1584-4912-0x0000000074710000-0x0000000074EC0000-memory.dmpFilesize
7.7MB
-
memory/1584-4911-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1632-9823-0x0000000000400000-0x00000000004AC000-memory.dmpFilesize
688KB
-
memory/1632-9825-0x0000000004FF0000-0x00000000050D8000-memory.dmpFilesize
928KB
-
memory/1632-12022-0x0000000005260000-0x0000000005268000-memory.dmpFilesize
32KB
-
memory/1632-12023-0x0000000005410000-0x0000000005466000-memory.dmpFilesize
344KB
-
memory/1632-12024-0x00000000055A0000-0x0000000005606000-memory.dmpFilesize
408KB
-
memory/2796-12030-0x00000201E4A60000-0x00000201E4A82000-memory.dmpFilesize
136KB