Analysis
- max time kernel
150s - max time network
131s - platform
windows10-2004_x64 - resource
win10v2004-20240704-en - submitted
08/07/2024, 09:19
General
- Target 33682e861b76b0ae22b7361f5b59bb7e69b95e69480156714f01e7044408b546.exe
- Size 4.3MB
- Sample240708-lafb3ssdmn
- SHA256 33682e861b76b0ae22b7361f5b59bb7e69b95e69480156714f01e7044408b546
Malware Config
Extracted
-
rhadamanthys
-
https://marckapq.ug/0f73f7f531224235bb0/5l7qnm6w.iic68
Signatures
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
- Rhadamanthys family
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 3 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of WriteProcessMemory 24 IoCs
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\SysWOW64\openwith.exe"C:\Windows\system32\openwith.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\33682e861b76b0ae22b7361f5b59bb7e69b95e69480156714f01e7044408b546.exe"C:\Users\Admin\AppData\Local\Temp\33682e861b76b0ae22b7361f5b59bb7e69b95e69480156714f01e7044408b546.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\blue.exe"C:\Users\Admin\AppData\Local\Temp\blue.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\blue.exe"C:\Users\Admin\AppData\Local\Temp\blue.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\33682e861b76b0ae22b7361f5b59bb7e69b95e69480156714f01e7044408b546.exe"C:\Users\Admin\AppData\Local\Temp\33682e861b76b0ae22b7361f5b59bb7e69b95e69480156714f01e7044408b546.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3856,i,17705702031385645742,8200011525621908985,262144 --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:81⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAVgBlAHIAcwBpAG8AbgAuAGUAeABlADsA1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\AuditRuleType\ippauefi\Version.exeC:\Users\Admin\AppData\Local\AuditRuleType\ippauefi\Version.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
33682e861b76b0ae22b7361f5b59bb7e69b95e69480156714f01e7044408b546.exe.log
__PSScriptPolicyTest_qyumgper.f1s.ps1
blue.exe
memory/1760-4885-0x0000000004DA0000-0x000000000504A000-memory.dmp
memory/1760-4881-0x00000000001F0000-0x0000000000416000-memory.dmp
memory/1760-4883-0x0000000074910000-0x00000000750C0000-memory.dmp
memory/1760-9777-0x0000000074910000-0x00000000750C0000-memory.dmp
memory/1760-9772-0x0000000005410000-0x00000000054F8000-memory.dmp
memory/1760-4884-0x0000000074910000-0x00000000750C0000-memory.dmp
memory/3216-5548-0x0000000000F60000-0x0000000000F69000-memory.dmp
memory/3328-13647-0x00000000057C0000-0x0000000005826000-memory.dmp
memory/3328-13646-0x0000000005550000-0x00000000055A6000-memory.dmp
memory/3328-9779-0x00000000053A0000-0x0000000005474000-memory.dmp
memory/3328-9778-0x0000000000400000-0x0000000000496000-memory.dmp
memory/3520-13657-0x0000021BE6F00000-0x0000021BE6F22000-memory.dmp
memory/4228-47-0x0000000005A30000-0x0000000005F00000-memory.dmp
memory/4228-28-0x0000000005A30000-0x0000000005F00000-memory.dmp
memory/4228-13-0x0000000005A30000-0x0000000005F00000-memory.dmp
memory/4228-11-0x0000000005A30000-0x0000000005F00000-memory.dmp
memory/4228-9-0x0000000005A30000-0x0000000005F00000-memory.dmp
memory/4228-29-0x0000000005A30000-0x0000000005F00000-memory.dmp
memory/4228-35-0x0000000005A30000-0x0000000005F00000-memory.dmp
memory/4228-53-0x0000000005A30000-0x0000000005F00000-memory.dmp
memory/4228-51-0x0000000005A30000-0x0000000005F00000-memory.dmp
memory/4228-57-0x0000000005A30000-0x0000000005F00000-memory.dmp
memory/4228-59-0x0000000005A30000-0x0000000005F00000-memory.dmp
memory/4228-65-0x0000000005A30000-0x0000000005F00000-memory.dmp
memory/4228-67-0x0000000005A30000-0x0000000005F00000-memory.dmp
memory/4228-63-0x0000000005A30000-0x0000000005F00000-memory.dmp
memory/4228-61-0x0000000005A30000-0x0000000005F00000-memory.dmp
memory/4228-55-0x0000000005A30000-0x0000000005F00000-memory.dmp
memory/4228-49-0x0000000005A30000-0x0000000005F00000-memory.dmp
memory/4228-20-0x0000000005A30000-0x0000000005F00000-memory.dmp
memory/4228-46-0x0000000005A30000-0x0000000005F00000-memory.dmp
memory/4228-43-0x0000000005A30000-0x0000000005F00000-memory.dmp
memory/4228-42-0x0000000005A30000-0x0000000005F00000-memory.dmp
memory/4228-40-0x0000000005A30000-0x0000000005F00000-memory.dmp
memory/4228-37-0x0000000005A30000-0x0000000005F00000-memory.dmp
memory/4228-33-0x0000000005A30000-0x0000000005F00000-memory.dmp
memory/4228-32-0x0000000005A30000-0x0000000005F00000-memory.dmp
memory/4228-17-0x0000000005A30000-0x0000000005F00000-memory.dmp
memory/4228-25-0x0000000005A30000-0x0000000005F00000-memory.dmp
memory/4228-4866-0x0000000074910000-0x00000000750C0000-memory.dmp
memory/4228-4867-0x0000000007210000-0x0000000007522000-memory.dmp
memory/4228-4868-0x0000000001840000-0x000000000188C000-memory.dmp
memory/4228-4880-0x0000000008870000-0x0000000008E14000-memory.dmp
memory/4228-4882-0x0000000005F30000-0x0000000005F84000-memory.dmp
memory/4228-4985-0x0000000074910000-0x00000000750C0000-memory.dmp
memory/4228-0-0x000000007491E000-0x000000007491F000-memory.dmp
memory/4228-1-0x0000000000A60000-0x0000000000EB2000-memory.dmp
memory/4228-2-0x0000000005A30000-0x0000000005F06000-memory.dmp
memory/4228-3-0x0000000074910000-0x00000000750C0000-memory.dmp
memory/4228-4-0x0000000005A30000-0x0000000005F00000-memory.dmp
memory/4228-5-0x0000000005A30000-0x0000000005F00000-memory.dmp
memory/4228-23-0x0000000005A30000-0x0000000005F00000-memory.dmp
memory/4228-21-0x0000000005A30000-0x0000000005F00000-memory.dmp
memory/4228-7-0x0000000005A30000-0x0000000005F00000-memory.dmp
memory/4228-15-0x0000000005A30000-0x0000000005F00000-memory.dmp
memory/4928-5717-0x0000000074910000-0x00000000750C0000-memory.dmp
memory/4928-5383-0x0000000074910000-0x00000000750C0000-memory.dmp
memory/4928-5331-0x0000000005A60000-0x0000000005A68000-memory.dmp
memory/4928-4979-0x0000000074910000-0x00000000750C0000-memory.dmp
memory/4928-4986-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4928-4988-0x0000000074910000-0x00000000750C0000-memory.dmp
memory/4928-4987-0x0000000005A70000-0x0000000005B02000-memory.dmp