rhadamanthys | 6989ca6e02b3c9ab512ccdf3d6ad7fa8584ed5224cf730d3abbba59dc82974bc

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27/07/2024, 10:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c4455930a4ee15f3a7abecc4b0dc97911baf6b65b625849bc309fda3929432b4.msi
Size

1.5MB
MD5

1ab7db273d2431aed5d5bab9c1847246
SHA1

95393b511fad6e7017f3a7c57014004a2ebca17d
SHA256

c4455930a4ee15f3a7abecc4b0dc97911baf6b65b625849bc309fda3929432b4
SHA512

50add971d394ccbc31b145466ebc8611b6e030d69de0bf2475175ceedf2426f1460ca6c0d0d8ff8d216c557e03fca2788b75c80e161fcf934649cc42f9946d08
SSDEEP

24576:DKxfS0jEhnJ/mhGd6NFTzqh0lhSMXlTnD55U0zjjZqKtaTakjWCtFGuUK7XgW2:DiycFTznj95U0zjjZZtmzjRGuUK75

Score

10^/10

rhadamanthys discovery persistence privilege_escalation stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4568 created 2812	4568	MsiExec.exe	51

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI4064.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2E20.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI39BA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3A58.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3E8F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e582d35.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e582d35.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI367D.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{368F6F58-3229-4861-BCEF-E90269BD58C7}	msiexec.exe

Loads dropped DLL 6 IoCs

pid	Process
4568	MsiExec.exe
4568	MsiExec.exe
4568	MsiExec.exe
4568	MsiExec.exe
4568	MsiExec.exe
4568	MsiExec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
1556	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000eab6cd0790be1f660000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000eab6cd070000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900eab6cd07000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1deab6cd07000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000eab6cd0700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
744	msiexec.exe
744	msiexec.exe
4568	MsiExec.exe
4568	MsiExec.exe
1916	openwith.exe
1916	openwith.exe
1916	openwith.exe
1916	openwith.exe

Suspicious use of AdjustPrivilegeToken 63 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1556	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1556	msiexec.exe
Token: SeSecurityPrivilege	744	msiexec.exe
Token: SeCreateTokenPrivilege	1556	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1556	msiexec.exe
Token: SeLockMemoryPrivilege	1556	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1556	msiexec.exe
Token: SeMachineAccountPrivilege	1556	msiexec.exe
Token: SeTcbPrivilege	1556	msiexec.exe
Token: SeSecurityPrivilege	1556	msiexec.exe
Token: SeTakeOwnershipPrivilege	1556	msiexec.exe
Token: SeLoadDriverPrivilege	1556	msiexec.exe
Token: SeSystemProfilePrivilege	1556	msiexec.exe
Token: SeSystemtimePrivilege	1556	msiexec.exe
Token: SeProfSingleProcessPrivilege	1556	msiexec.exe
Token: SeIncBasePriorityPrivilege	1556	msiexec.exe
Token: SeCreatePagefilePrivilege	1556	msiexec.exe
Token: SeCreatePermanentPrivilege	1556	msiexec.exe
Token: SeBackupPrivilege	1556	msiexec.exe
Token: SeRestorePrivilege	1556	msiexec.exe
Token: SeShutdownPrivilege	1556	msiexec.exe
Token: SeDebugPrivilege	1556	msiexec.exe
Token: SeAuditPrivilege	1556	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1556	msiexec.exe
Token: SeChangeNotifyPrivilege	1556	msiexec.exe
Token: SeRemoteShutdownPrivilege	1556	msiexec.exe
Token: SeUndockPrivilege	1556	msiexec.exe
Token: SeSyncAgentPrivilege	1556	msiexec.exe
Token: SeEnableDelegationPrivilege	1556	msiexec.exe
Token: SeManageVolumePrivilege	1556	msiexec.exe
Token: SeImpersonatePrivilege	1556	msiexec.exe
Token: SeCreateGlobalPrivilege	1556	msiexec.exe
Token: SeBackupPrivilege	3556	vssvc.exe
Token: SeRestorePrivilege	3556	vssvc.exe
Token: SeAuditPrivilege	3556	vssvc.exe
Token: SeBackupPrivilege	744	msiexec.exe
Token: SeRestorePrivilege	744	msiexec.exe
Token: SeRestorePrivilege	744	msiexec.exe
Token: SeTakeOwnershipPrivilege	744	msiexec.exe
Token: SeRestorePrivilege	744	msiexec.exe
Token: SeTakeOwnershipPrivilege	744	msiexec.exe
Token: SeRestorePrivilege	744	msiexec.exe
Token: SeTakeOwnershipPrivilege	744	msiexec.exe
Token: SeRestorePrivilege	744	msiexec.exe
Token: SeTakeOwnershipPrivilege	744	msiexec.exe
Token: SeRestorePrivilege	744	msiexec.exe
Token: SeTakeOwnershipPrivilege	744	msiexec.exe
Token: SeRestorePrivilege	744	msiexec.exe
Token: SeTakeOwnershipPrivilege	744	msiexec.exe
Token: SeRestorePrivilege	744	msiexec.exe
Token: SeTakeOwnershipPrivilege	744	msiexec.exe
Token: SeRestorePrivilege	744	msiexec.exe
Token: SeTakeOwnershipPrivilege	744	msiexec.exe
Token: SeRestorePrivilege	744	msiexec.exe
Token: SeTakeOwnershipPrivilege	744	msiexec.exe
Token: SeBackupPrivilege	2220	srtasks.exe
Token: SeRestorePrivilege	2220	srtasks.exe
Token: SeSecurityPrivilege	2220	srtasks.exe
Token: SeTakeOwnershipPrivilege	2220	srtasks.exe
Token: SeBackupPrivilege	2220	srtasks.exe
Token: SeRestorePrivilege	2220	srtasks.exe
Token: SeSecurityPrivilege	2220	srtasks.exe
Token: SeTakeOwnershipPrivilege	2220	srtasks.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1556	msiexec.exe
1556	msiexec.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 2220	744	msiexec.exe	103
PID 744 wrote to memory of 2220	744	msiexec.exe	103
PID 744 wrote to memory of 4568	744	msiexec.exe	105
PID 744 wrote to memory of 4568	744	msiexec.exe	105
PID 744 wrote to memory of 4568	744	msiexec.exe	105
PID 4568 wrote to memory of 1916	4568	MsiExec.exe	107
PID 4568 wrote to memory of 1916	4568	MsiExec.exe	107
PID 4568 wrote to memory of 1916	4568	MsiExec.exe	107
PID 4568 wrote to memory of 1916	4568	MsiExec.exe	107
PID 4568 wrote to memory of 1916	4568	MsiExec.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2812
- C:\Windows\SysWOW64\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1916

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\c4455930a4ee15f3a7abecc4b0dc97911baf6b65b625849bc309fda3929432b4.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1556

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:744
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2220
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D6CBAB71D1D697C371733109382306FB
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4568

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e582d38.rbs

Filesize
999B

MD5
183cf256cf88acb084547b7c7eb2fe80

SHA1
778d4348a677b1860d4c9716ce4cbee54a7105d0

SHA256
d249453a7a875b3304f259818c8a9eaebe3509be1c9c6af7edde40aa1a943ce2

SHA512
79cd313bddb8a089b47e43260f41978244bfcfc8f8ce231aacefda202efaca428aa50ce5ae9c7e65be6d72118a9d70a305fda8cc0141c7af8f69096bc0b6c3e4

Download Submit
C:\Users\Admin\cr.dll

Filesize
2.5MB

MD5
0e8161c93aa083c2649182ec398e5a27

SHA1
fa0ae74e18b45378f0c7abb1b8a080a1702e6efb

SHA256
522b7a28eb6cfdf01c631f6007f46cabf2578d82a3ef027cd33c69628ed2fd97

SHA512
03920f59200d44710d035768970f51a896601ac6bbf7543823dda81949d5e80f7c083a2cc548226d86fdf837a957ed62ac7d4d2326e5176fb83da79d8b6f5a5b

Download Submit
C:\Windows\Installer\MSI2E20.tmp

Filesize
738KB

MD5
8e65fea37f700d948d1b67afd43b97fc

SHA1
823d2b30ec0372e0dc36f7983ad2de1ceda4036c

SHA256
20c648a2a4313b1b20da50a9b788d8a1b9637e154adae4541b65badaa40266c9

SHA512
07faf03685fde9c71f6bc4b3caecfe4d3c707a8bec5bce1a544f59c1f853edde8f37c019c16bffd3e8fbe5c72c0666ffe0e2dffd878744da64f47e52c7625084

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.7MB

MD5
a34b24adbaf3cb1eae25c1c3349b281a

SHA1
788baba39148bfa66027b3ee7856654e1f824a60

SHA256
a92559aa4b361de94ec0297019f1ef5a23b40e6c9eefe034783f06ff27035950

SHA512
0f53da99164c08c46efccddc62152843f205db93da2b90a94741815e54b1fc7646b71be938347b064ba1fb63dd4141fb2eb17edff7dadd8b9ebf143e724fb8a2

Download Submit
\??\Volume{07cdb6ea-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{ad97fd68-4cdb-481b-ac94-23a685f26751}_OnDiskSnapshotProp

Filesize
6KB

MD5
1e8f86842482f34229628d0e3c26223c

SHA1
6f8898ed59d9bed4907d4f4cd7989fde567cc420

SHA256
0f3c3bf1ef6edd93fa57cfbd5c7c6d77c13deb0c5349408274d57a692b20dcb2

SHA512
64a0121cc1eb32c7492745358138cdc3f348bf95ed4ccb31cb15ecc80ea4f50aa06adfd4e97f747d684d9b34b9d219b9ca01039fea77777aa249c0f641a2e545

Download Submit
memory/1916-44-0x0000000002280000-0x0000000002680000-memory.dmp

Filesize
4.0MB

Download
memory/1916-53-0x00007FFD25970000-0x00007FFD25B65000-memory.dmp

Filesize
2.0MB

Download
memory/1916-55-0x0000000076F80000-0x0000000077195000-memory.dmp

Filesize
2.1MB

Download
memory/1916-41-0x00000000003F0000-0x00000000003F9000-memory.dmp

Filesize
36KB

Download
memory/4568-36-0x00000000041C0000-0x00000000045C0000-memory.dmp

Filesize
4.0MB

Download
memory/4568-43-0x0000000073440000-0x00000000736C5000-memory.dmp

Filesize
2.5MB

Download
memory/4568-40-0x0000000076F80000-0x0000000077195000-memory.dmp

Filesize
2.1MB

Download
memory/4568-38-0x00007FFD25970000-0x00007FFD25B65000-memory.dmp

Filesize
2.0MB

Download
memory/4568-37-0x00000000041C0000-0x00000000045C0000-memory.dmp

Filesize
4.0MB

Download
memory/4568-35-0x0000000073440000-0x00000000736C5000-memory.dmp

Filesize
2.5MB

Download