Extracted

• • Target
    x64__setup__build_18957/Sysprep/en-US/sysprep.exe.mui
  • Size 9KB
  • SHA256 cde2d677dc2813b2b28db9f000c4eb38282b3c5258f9f1a2adae8c6cd66b073d
  • MD5 a3c4e7fb74bce863d13bd8ecab167d9f
  • SHA1 a2ceffd0a5a21785d62211608dcc04840297a642
  • SHA512 97044c92b03bcf7e9482e964310a8afa2044209d4fa25b69ea531f7b8cba24778095017c60579fdb44d92e0e2ccc0e3e1487d530adf0612d6396d2b35cbed818
  • SSDEEP 192:FhoxuIyF48mMUqEV6EDEG3hEr9J3aZWh4m7x2WtcW3:ENO45vyYch1QWtcW3
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral1
• • Target
    x64__setup__build_18957/Sysprep/sysprep.exe
  • Size 1.3MB
  • SHA256 c723d7dcb559386d16be57498185fcf17ff8f68ff952f4add84cef6ecb58d672
  • MD5 6bd9aecd5d43133e4046dd6ee22611d3
  • SHA1 e7f75f7ee4a6359cefc20f3ef5662119cbd5ef2a
  • SHA512 b208d3348f65d2c696973874f78e9a700ea036b5a764dba2d44067876c6def251f5ae410840c8548962ce6c17c8cb2a60a5fdfffc5d3bb6f1d4284ef32fed62a
  • SSDEEP 12288:+e62N1AcIjxMCN8/Uq54/t4KAWoiQ6Ppa+syKYnk3:+uNqqCe/f5u2fj6PuynnY
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral2
• • Target
    x64__setup__build_18957/fmapi/SEMgrPS.dll
  • Size 40KB
  • SHA256 5edd09d2a2e2e03ac2fa7db4c7b9f4ee300c696534788dbedaf9cee617a97ab1
  • MD5 76e12d39f82567db28b132e245d9e3ce
  • SHA1 53cbd54614b8e21e78096d32ddebf0771b359c37
  • SHA512 62de3ef3caf4997e0f1b02f5805a5da757c7506dcf5e6f93ed9870b6a53858dd24f588700dc2e6cd1d524291fb0fe1968169a52c53e9253244f7ebd633b89f4a
  • SSDEEP 384:tASguFmJEqu2MZ3RDil1jt9exCUF9n10jaTANQ+1Lxdprb4Y75WRkWmmca9pa:KK9JbyFUF910GANQ+1pgYg
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral3
• • Target
    x64__setup__build_18957/fmapi/fmapi.dll
  • Size 73KB
  • SHA256 cd375aeab416e68c62ed19bc2f2c5e59725ce3be1f92f2daaea0c8298917d4ed
  • MD5 cd7f7d5bff3559fde6fcd68b5f29d0a7
  • SHA1 54daaa8d71c723b96a658d07b804f305204ac57b
  • SHA512 9916fc444f6d9bb50f470ed2d2288518a984b8a908293afd52e9a15c39f00dc2cce9663abcbbc940303c49c68d33a5a7b0d13636956f468b2863f39737b8cf0f
  • SSDEEP 1536:RkMyR7TMzLXqUoyNegAjFlgk5zXXceHJ:RLyRngLaQUR55TZJ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral4
• • Target
    x64__setup__build_18957/fmapi/sppnp.dll
  • Size 269KB
  • SHA256 207816a107793a554f18e480b59de9b5f98b0bbd54a7e81ecf666e538e0e363b
  • MD5 ce2827a201e3df7986f1db198081c1c1
  • SHA1 c4f9077fc98e5d70545daef31007a9dd9b589f32
  • SHA512 8aee1936800ff447deb172c6110dbb6593cba3cbbf5f6185049af250602bb50e4c20029e7fed033c574717065bd924272b30516e57422b5094b1b3d8445db151
  • SSDEEP 3072:OAiWbUe6ZATojLurmI6hUsRuG79fMj5k9kVZ4UQebrPA48dLrJGyCM7X8AuSVcVq:3YVGmI67945V2ebrPA48dLrbBcIzh
  • MD5 SHA1 SHA512 SSDEEP

  Score

  4^/10
  behavioral5
• • Target
    x64__setup__build_18957/fmapi/tzautoupdate.dll
  • Size 180KB
  • SHA256 2a352c7ca6d2c3794311cc404514877979f5b896c66edbffafe876689acb7d02
  • MD5 51cf16070f442daede8d61dcb7ffe87a
  • SHA1 7bbf4fb5bbca2c83b53bf0274b01204ab488a576
  • SHA512 700261819d78b3ceb3105e636d1fcb812502168c40c41f4975abb6ccd8452aa5e76a5f9b6f579a730e79332c64a99cf67ac27e4390cdbc73da19891c700a8b85
  • SSDEEP 3072:IewznZCOUogbNMQF7PF3PlW3THAC6i+ZD4uZcgK2FHTMkkK:IvznZojb7F7PF3NWDHACTDUcaFzvk
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral6
• • Target
    x64__setup__build_18957/hal/KBDKOR.DLL
  • Size 15KB
  • SHA256 9d73451eed80c7cff7d4a4f796fdc58cf0badc31925b97fd8bf9f27e1e52e173
  • MD5 dc5c272b83b4d9769c87a50ffe662130
  • SHA1 c79491aaddaf3239b43628e3d3b94baa18caf5df
  • SHA512 c79bbe9e14e126f827c8ca7250d20e79590cdf587608fe91507da51de0475b83e576271a16ed941ad6091c6d387547d30fb233a7d44b4bc52105b2f6a6a4bdf0
  • SSDEEP 192:38uFvmPZMzmQPYumuenzk3pBQNL4nPZGQUWAaW4O:MPZ4meYuFezEpBQenhGWAaW4O
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral7
• • Target
    x64__setup__build_18957/hal/duser.dll
  • Size 575KB
  • SHA256 c7be8a83ef861073c9f9e510a579d42cfae6dd04a92bdd98273e0c8a99a413cc
  • MD5 0de31834191b9524a69f8b8aad655b3b
  • SHA1 ffc55693372b60b587ea9298b20629e2bc2906db
  • SHA512 ff0cd8d7782714f098536bf82eb3a27e62cc4ea9d5faf9f35e0f19858001c04d0f2ec0c0093dff3b6694fec4452230ca1ab59c2dae317e67ddf15505a967d240
  • SSDEEP 6144:E7i0j5jXCDZfjDFdCEmpY3y8upRrSq5ID8XdEELnFluG22G+sM4O1l6lAJHyPvN:DtrDFCY3y8u+LAXB7FluGRKCYd
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral8
• • Target
    x64__setup__build_18957/hal/fontext.dll
  • Size 966KB
  • SHA256 4a2de5e3428d80783d1651ec0c8fe29557e421c93aa0009c99a5c6c4abc907d4
  • MD5 280699e5c068ef4aa58d9c6b211cf8a7
  • SHA1 fabe1e84a6e8de4b1c49f1fd304baf23f20d26a3
  • SHA512 dd5ceadd707fd6a8a94de01a03ed235387cf24e1bf1fd22dca04263e56207bbe1e8bf2510dd40f8d460fa6a524910eb718bf898d7ad92f6c7523fa622a23e031
  • SSDEEP 12288:ZJ8p80yvsuv2A6/N8c3S/sa9j/wHXuvYdSnEGzuMnEP0Afd:BTouc3Stjgu4/GzuMnEPz
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral9
• • Target
    x64__setup__build_18957/hal/hal.dll
  • Size 17KB
  • SHA256 9c32cef8fb1d4eb0fcec864617b850594eeeac2fe0163de77aa2f947fba4f3be
  • MD5 01fd720f78d7d72e19ca732a909ae005
  • SHA1 e542847f226190042cfda60dd8be6266d5e5d4a4
  • SHA512 dada83d0ca3f90d5c1e8facdf8141b7098be241efe2800ae51826c7445cf3c6801f751e9f500400af50a672643439975e85ffac0f9f2f2ed56a3f4729361e959
  • SSDEEP 384:MkqP8+N5nC+k6yIwws9sCQZWu7kWXddhMDBRJM1x85zR9zF6Nn:qi+aITsGFTdhM1PM109z2n
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral10
• • Target
    x64__setup__build_18957/msvcp140/PeopleAPIs.dll
  • Size 118KB
  • SHA256 cbc0e6262b52b82c8f789912a0ca2bfac26d83279121cf1173e05272af8ad803
  • MD5 0d641a44b3976e97944259f97c340caa
  • SHA1 4c077e6749f19fe80fe2d97839b823395d876023
  • SHA512 ee29a08e7c2583187807c9d6ecb3404be86f24380ccd56d75d8ba358540de2e1d4e50775f0fc1a653440ee346c47711135c22a433cfc56bfa73d6dadf7ee5b17
  • SSDEEP 3072:ahF8Wkwpx9URc4FbQPddTBa/o0h8hwkBPNX6J40lbazf+TVD+lgVCTl5:eKWkwpx9URcgbQH8kTl
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral11
• • Target
    x64__setup__build_18957/msvcp140/msvcp140.dll
  • Size 554KB
  • SHA256 9b783a58b3e1cd9976169f3ca9329f868b7980966d34a84274c2208a64f8b6fb
  • MD5 53a6dd2062e438cfdfc3327cd48e9a43
  • SHA1 02f7cb32c424d06fab1937ce0203952fe0f558e6
  • SHA512 d24d58d940e7b77bdd36dfc1b601eed9355f9d9560152196754dbb9c1ce3276646003b23af34274b971b87c39da1681f3b1e6f81721b81c68441a12895cb9825
  • SSDEEP 12288:D0+cOjCI4JxkdGwm9b39KJ7TgQSToGet+VfTxZ5HU/Z8y8RQEKZm+jWodEEV8q:A+cJjxzH68RQEKZm+jWodEEuq
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral12behavioral13
• • Target
    x64__setup__build_18957/msvcp140/ngccredprov.dll
  • Size 664KB
  • SHA256 99b0ec136f91c61af0e6fc357b08cdb6d6182ddf2e2e12d933e3ce6d5e333422
  • MD5 1a253557334204253f4a20a93eb184cb
  • SHA1 0b6462c2fa6b68f1da59870f3d4fdaef721d18e3
  • SHA512 dbfb25cc8a2252fde6434d816e256b7a0431236e1e8556bbc75c6e3241989d13a6426d8811ffdebe4b0e601354a2c7cb6825c7d5c02b11d38ce7692ceb870581
  • SSDEEP 6144:CJnJp6mOysk+NFNnBzMyLC1oCuEgWVxOLpxPHX1vDGXxKjHOBOG0O0/vSuQi8hTw:CJ+x++NNzMD3lrbOLLlvqXxmuBOr
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral14
• • Target
    x64__setup__build_18957/msvcp140/provdatastore.dll
  • Size 97KB
  • SHA256 8985aaef15357e165fb411a62e2a4bd9d5628c71767f81ecabfd1f0ce0ca68aa
  • MD5 73a9db35423ec62f017158089f9b676d
  • SHA1 e8c7ea91c0a33db3931ba8933854ae73d19e00e8
  • SHA512 3aacf8ac37c477e9cfd9610862572e4a6b2d7cd2da3e90823bf71698c603b4c9125f828b4beeea7174799dba9398e1bf6105b556b6a286e70ba6b05b322a860b
  • SSDEEP 3072:Z4yfY6zIX+6ACkc4P37YfV2Ciq1KS+6XquIMqNrH:Z4yfY6zIOtYfV2xq0J6XLIMG
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral15
• • Target
    x64__setup__build_18957/setup.msi
  • Size 34.8MB
  • SHA256 8735b260af2dd098418563efcc05d006f22239ba04108de94dbabc638dfd338f
  • MD5 92e08e754cfaf2b872bd52f9c1491c24
  • SHA1 a0447c63b8b5d0b85fce76390820a5ea78b0e8c7
  • SHA512 3f2f7466e87020bef1137c219fff109cca44adbfda4a05aa2caba6ef9dc9be53a5b6cdd7c9738b32a43e45fd6b3f99fa814cecbfd2180877da5c7800631d9629
  • SSDEEP 786432:BqTRkI57hVSZmlNdonqUuhGMCiEIS/vTis1MDN:Bq1T57jSZmGnqUezSTt
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  persistenceprivilege_escalationrhadamanthysexecutionstealer

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Blocklisted process makes network request

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral16behavioral17
• • Target
    x64__setup__build_18957/spoolss/MSAMRNBSource.dll
  • Size 99KB
  • SHA256 b050cb2685e2da30d72b9bf837754fb07a83566ae97b78f8998cce31356508f4
  • MD5 21dd8585802c8ddefdbf95c7b4f9700e
  • SHA1 77e1a4c1b65edcef679571660a4bfb7a2b029c5b
  • SHA512 64553196c07110c1c86fdda822393f40fc661e2424fca2f74819e4c845b8b7bf19683b3267adbef69847592095725d341cc0f5ce0988e98274320d4bbe39e9b9
  • SSDEEP 3072:fmcVDKNEHbW/VGDblNRfiQnaN0ept2cL+8vkRnrHmA:sebWAtNRfiQnaN0ept2eh8rH
  • MD5 SHA1 SHA512 SSDEEP

  Score

  7^/10

  persistenceprivilege_escalation

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  behavioral18
• • Target
    x64__setup__build_18957/spoolss/ReportingCSP.dll
  • Size 120KB
  • SHA256 7c46620ba1785adb6450b41e648a231eaf47d50c6dc56109b5d37b9537c39778
  • MD5 505dcdac9a54975aa65fedb50a49712b
  • SHA1 761caa6af32caa1138355e9271d8fa95aabbc6f8
  • SHA512 6d940cd5d57b5347fc35d9c31e2f2505d23958177afc85128e088b3df28d550828a3ec8fd3176126c2ecd956238e4357f8bdc0827044911a2cbcd277de974bcc
  • SSDEEP 3072:Xjn1O9nfVQgFM9LkFS7umnsQ6gnjQp+LLLLL0jbYqEuv:Xr1O9f1FM9LlymnsQ6o04LLLLL0jbYqv
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral19
• • Target
    x64__setup__build_18957/spoolss/spoolss.dll
  • Size 99KB
  • SHA256 c0a42b03016f5090bdc7d7f70ff9d9ea2082a4fca8f45f778265db6020d81a75
  • MD5 97ea00e1b73e6b8b3b4d045dd4b22334
  • SHA1 53f90c2a04a58977a419b27c786e2a5ce5089996
  • SHA512 81cc01c22db282dc5cb8e3a07ada7d0cb76d13c64ef72c5239dfd3ef4ef468e3f3a086bb3cf33eca5d32c10d5c4bd2cd38ab71d78d57e43a8d256ab78605f24e
  • SSDEEP 3072:UMlUeXQ08yVjDA99DVoJv0ma+CNk3poDr:UMlZXQ01VjDAHDVoJv0ma+l3po
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral20
• • Target
    x64__setup__build_18957/spoolss/stobject.dll
  • Size 306KB
  • SHA256 b4bb94723589d24ae446ee2d259f810928a4c58ce4c95c3d84ed27ea651114df
  • MD5 eb37729b447c90fc81df94bcfde7097c
  • SHA1 8a08b217bab182c31786d23e72ef7f700c1a2234
  • SHA512 6c9b09a2422434d9d990ba8811d27fda09b7016c8ee969237c65668739b72fb5b9dc7fe428d4367a1de83691805c0c4edc2f6d29f8ced00f4180b07bcaf3c38f
  • SSDEEP 6144:129//6rq2sw6gPrUZ0eFfv3RBjD+MiFl:Frq2swxiV3RBTc
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral21
• • Target
    x64__setup__build_18957/sysmain/devobj.dll
  • Size 162KB
  • SHA256 aea1e23dbb84a4eb5f7d1a3cebbbe13f6cf8a0115033687d7c6dfdff19eda80d
  • MD5 e0321ef29b88da13c5d0fd6335b6090c
  • SHA1 0140ce9dfff126cf48bef067ee6192b868a95311
  • SHA512 10b6f153256227cfa6cfe8cf7df5a905a18adb0e10c0f3408f20f237a30849058ce218f88e009dc74e85e9734c54422ae11ff7d9cc97b8de674db661010a498f
  • SSDEEP 3072:XcgAKKoIDocNLn2D8RlsDC2xi2T0w3y6re/+81/K/BNar:XcZovcZn2oRlsDzD5y61w9
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral22
• • Target
    x64__setup__build_18957/sysmain/eapphost.dll
  • Size 344KB
  • SHA256 478fe0b778f0d643664e57bca4a25c92959c557921b390d1de5b4dd497a5d642
  • MD5 d6aa5f430ced4d98cca2f4c0e6d63a5d
  • SHA1 427908bf4f21709bd1c9324db6d050ae5499a073
  • SHA512 5d832ae9c59fbed5d9f8d748f045602b3f342fb436a501e98cf6122bb99a8ce93565c7f30e525ef7c3d99d8db00997ce4fb95a462279a812d490ae711b988a59
  • SSDEEP 6144:gJvNJQSmoT6iSSMO2+aUC6RuSwzSB4cV5jItQhdFcY2+YbDy:QvNJQVoiO2DUC6cSwzOZvs2/6+Y6
  • MD5 SHA1 SHA512 SSDEEP

  Score

  7^/10

  persistenceprivilege_escalation

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  behavioral23
• • Target
    x64__setup__build_18957/sysmain/shacct.dll
  • Size 142KB
  • SHA256 9d4e44b85e7b39ae69cf85c877dc50fb1f4b336eaed304ddf93c03bc46c02c64
  • MD5 ea57daabed46f3695f2ae2771ce03ddd
  • SHA1 fecd4ba466a08741518c4bc3e50822ed60f4db44
  • SHA512 83a78130b496f14961a19c9f44159d697a7571a4462757a7ed2b0649e207c388b27ac534b9bb0361318de0aad3ba54f67ebe442d0964669dc6ec03fbe30e5d10
  • SSDEEP 3072:oxECadGNNfjUenR3pZn7oArjkf2Zw+e1d:oxDadC7vZnkf2Zw
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral24
• • Target
    x64__setup__build_18957/sysmain/sysmain.dll
  • Size 982KB
  • SHA256 07f5694d440b9807db933e7091bc002c395b99f01a4423316118f1a860b60c1e
  • MD5 6c608c28f3469a3fbb1fc762945aed44
  • SHA1 250e0a04f55b8bcf10b18bd343fc2fe648f8e6b8
  • SHA512 11af42558f371a7a98b92f32eb441de6f7afa53b294494c7ad6e4c65f84594427da2d1c60b55bec084e8d097f597fba9e12711b9b01d48388d5143be028c5c23
  • SSDEEP 24576:gufcVZxYDn1sanpd1fwUFMPsisHvoIgbRGd:8s71smFfwUqPsHeG
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral25