Analysis
- max time kernel
149s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
27/07/2024, 10:31
Static task
static1
Behavioral task
behavioral1
Sample
c4455930a4ee15f3a7abecc4b0dc97911baf6b65b625849bc309fda3929432b4.msi
Resource
win7-20240708-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
c4455930a4ee15f3a7abecc4b0dc97911baf6b65b625849bc309fda3929432b4.msi
Resource
win10v2004-20240709-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target c4455930a4ee15f3a7abecc4b0dc97911baf6b65b625849bc309fda3929432b4.msi
- Size 1.5MB
- Sample240727-mkb8vavbpl
- SHA256 c4455930a4ee15f3a7abecc4b0dc97911baf6b65b625849bc309fda3929432b4
- MD5 1ab7db273d2431aed5d5bab9c1847246
- SHA1 95393b511fad6e7017f3a7c57014004a2ebca17d
- SHA512 50add971d394ccbc31b145466ebc8611b6e030d69de0bf2475175ceedf2426f1460ca6c0d0d8ff8d216c557e03fca2788b75c80e161fcf934649cc42f9946d08
- SSDEEP 24576:DKxfS0jEhnJ/mhGd6NFTzqh0lhSMXlTnD55U0zjjZqKtaTakjWCtFGuUK7XgW2:DiycFTznj95U0zjjZZtmzjRGuUK75
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 4568 created 2812 4568 MsiExec.exe 51 - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe - Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI4064.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI2E20.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI39BA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3A58.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3E8F.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\e582d35.msi msiexec.exe File opened for modification C:\Windows\Installer\e582d35.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI367D.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{368F6F58-3229-4861-BCEF-E90269BD58C7} msiexec.exe - Loads dropped DLL 6 IoCs
pid Process 4568 MsiExec.exe 4568 MsiExec.exe 4568 MsiExec.exe 4568 MsiExec.exe 4568 MsiExec.exe 4568 MsiExec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 1556 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openwith.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000eab6cd0790be1f660000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000eab6cd070000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900eab6cd07000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1deab6cd07000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000eab6cd0700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 744 msiexec.exe 744 msiexec.exe 4568 MsiExec.exe 4568 MsiExec.exe 1916 openwith.exe 1916 openwith.exe 1916 openwith.exe 1916 openwith.exe - Suspicious use of AdjustPrivilegeToken 63 IoCs
description pid Process Token: SeShutdownPrivilege 1556 msiexec.exe Token: SeIncreaseQuotaPrivilege 1556 msiexec.exe Token: SeSecurityPrivilege 744 msiexec.exe Token: SeCreateTokenPrivilege 1556 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1556 msiexec.exe Token: SeLockMemoryPrivilege 1556 msiexec.exe Token: SeIncreaseQuotaPrivilege 1556 msiexec.exe Token: SeMachineAccountPrivilege 1556 msiexec.exe Token: SeTcbPrivilege 1556 msiexec.exe Token: SeSecurityPrivilege 1556 msiexec.exe Token: SeTakeOwnershipPrivilege 1556 msiexec.exe Token: SeLoadDriverPrivilege 1556 msiexec.exe Token: SeSystemProfilePrivilege 1556 msiexec.exe Token: SeSystemtimePrivilege 1556 msiexec.exe Token: SeProfSingleProcessPrivilege 1556 msiexec.exe Token: SeIncBasePriorityPrivilege 1556 msiexec.exe Token: SeCreatePagefilePrivilege 1556 msiexec.exe Token: SeCreatePermanentPrivilege 1556 msiexec.exe Token: SeBackupPrivilege 1556 msiexec.exe Token: SeRestorePrivilege 1556 msiexec.exe Token: SeShutdownPrivilege 1556 msiexec.exe Token: SeDebugPrivilege 1556 msiexec.exe Token: SeAuditPrivilege 1556 msiexec.exe Token: SeSystemEnvironmentPrivilege 1556 msiexec.exe Token: SeChangeNotifyPrivilege 1556 msiexec.exe Token: SeRemoteShutdownPrivilege 1556 msiexec.exe Token: SeUndockPrivilege 1556 msiexec.exe Token: SeSyncAgentPrivilege 1556 msiexec.exe Token: SeEnableDelegationPrivilege 1556 msiexec.exe Token: SeManageVolumePrivilege 1556 msiexec.exe Token: SeImpersonatePrivilege 1556 msiexec.exe Token: SeCreateGlobalPrivilege 1556 msiexec.exe Token: SeBackupPrivilege 3556 vssvc.exe Token: SeRestorePrivilege 3556 vssvc.exe Token: SeAuditPrivilege 3556 vssvc.exe Token: SeBackupPrivilege 744 msiexec.exe Token: SeRestorePrivilege 744 msiexec.exe Token: SeRestorePrivilege 744 msiexec.exe Token: SeTakeOwnershipPrivilege 744 msiexec.exe Token: SeRestorePrivilege 744 msiexec.exe Token: SeTakeOwnershipPrivilege 744 msiexec.exe Token: SeRestorePrivilege 744 msiexec.exe Token: SeTakeOwnershipPrivilege 744 msiexec.exe Token: SeRestorePrivilege 744 msiexec.exe Token: SeTakeOwnershipPrivilege 744 msiexec.exe Token: SeRestorePrivilege 744 msiexec.exe Token: SeTakeOwnershipPrivilege 744 msiexec.exe Token: SeRestorePrivilege 744 msiexec.exe Token: SeTakeOwnershipPrivilege 744 msiexec.exe Token: SeRestorePrivilege 744 msiexec.exe Token: SeTakeOwnershipPrivilege 744 msiexec.exe Token: SeRestorePrivilege 744 msiexec.exe Token: SeTakeOwnershipPrivilege 744 msiexec.exe Token: SeRestorePrivilege 744 msiexec.exe Token: SeTakeOwnershipPrivilege 744 msiexec.exe Token: SeBackupPrivilege 2220 srtasks.exe Token: SeRestorePrivilege 2220 srtasks.exe Token: SeSecurityPrivilege 2220 srtasks.exe Token: SeTakeOwnershipPrivilege 2220 srtasks.exe Token: SeBackupPrivilege 2220 srtasks.exe Token: SeRestorePrivilege 2220 srtasks.exe Token: SeSecurityPrivilege 2220 srtasks.exe Token: SeTakeOwnershipPrivilege 2220 srtasks.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1556 msiexec.exe 1556 msiexec.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 744 wrote to memory of 2220 744 msiexec.exe 103 PID 744 wrote to memory of 2220 744 msiexec.exe 103 PID 744 wrote to memory of 4568 744 msiexec.exe 105 PID 744 wrote to memory of 4568 744 msiexec.exe 105 PID 744 wrote to memory of 4568 744 msiexec.exe 105 PID 4568 wrote to memory of 1916 4568 MsiExec.exe 107 PID 4568 wrote to memory of 1916 4568 MsiExec.exe 107 PID 4568 wrote to memory of 1916 4568 MsiExec.exe 107 PID 4568 wrote to memory of 1916 4568 MsiExec.exe 107 PID 4568 wrote to memory of 1916 4568 MsiExec.exe 107 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2812
-
C:\Windows\SysWOW64\openwith.exe"C:\Windows\system32\openwith.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1916
-
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\c4455930a4ee15f3a7abecc4b0dc97911baf6b65b625849bc309fda3929432b4.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1556
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:2220
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D6CBAB71D1D697C371733109382306FB2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4568
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3556
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e582d38.rbs
- Size 999B
- SHA256 d249453a7a875b3304f259818c8a9eaebe3509be1c9c6af7edde40aa1a943ce2
- MD5 183cf256cf88acb084547b7c7eb2fe80
- SHA1 778d4348a677b1860d4c9716ce4cbee54a7105d0
- SHA512 79cd313bddb8a089b47e43260f41978244bfcfc8f8ce231aacefda202efaca428aa50ce5ae9c7e65be6d72118a9d70a305fda8cc0141c7af8f69096bc0b6c3e4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\cr.dll
- Size 2.5MB
- SHA256 522b7a28eb6cfdf01c631f6007f46cabf2578d82a3ef027cd33c69628ed2fd97
- MD5 0e8161c93aa083c2649182ec398e5a27
- SHA1 fa0ae74e18b45378f0c7abb1b8a080a1702e6efb
- SHA512 03920f59200d44710d035768970f51a896601ac6bbf7543823dda81949d5e80f7c083a2cc548226d86fdf837a957ed62ac7d4d2326e5176fb83da79d8b6f5a5b
- SSDEEP 6144:MXXP8qRx6EhmpSLEf+jlUaQ7xKjgK3kli5AFmegoVOkwTC82nOVI9XN5GNFlu/lD:MXEEhGR6Kte/UbOWunOh8j7rY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI2E20.tmp
- Size 738KB
- SHA256 20c648a2a4313b1b20da50a9b788d8a1b9637e154adae4541b65badaa40266c9
- MD5 8e65fea37f700d948d1b67afd43b97fc
- SHA1 823d2b30ec0372e0dc36f7983ad2de1ceda4036c
- SHA512 07faf03685fde9c71f6bc4b3caecfe4d3c707a8bec5bce1a544f59c1f853edde8f37c019c16bffd3e8fbe5c72c0666ffe0e2dffd878744da64f47e52c7625084
- SSDEEP 12288:9CIETjR8kJ/FQhGd6rZj5Tzlqph0lhSMXle8nD55vccNzjjZqg:9jEhnJ/mhGd6NFTzqh0lhSMXlTnD55UM
- MD5 SHA1 SHA512 SSDEEP
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 23.7MB
- SHA256 a92559aa4b361de94ec0297019f1ef5a23b40e6c9eefe034783f06ff27035950
- MD5 a34b24adbaf3cb1eae25c1c3349b281a
- SHA1 788baba39148bfa66027b3ee7856654e1f824a60
- SHA512 0f53da99164c08c46efccddc62152843f205db93da2b90a94741815e54b1fc7646b71be938347b064ba1fb63dd4141fb2eb17edff7dadd8b9ebf143e724fb8a2
- SSDEEP 24576:mSqm41FldoO/vvTLkBxO2XmBSyuJTAOK1jx9Zawm6ma9gy92oxlebqRkW:i
- MD5 SHA1 SHA512 SSDEEP
- Path \??\Volume{07cdb6ea-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{ad97fd68-4cdb-481b-ac94-23a685f26751}_OnDiskSnapshotProp
- Size 6KB
- SHA256 0f3c3bf1ef6edd93fa57cfbd5c7c6d77c13deb0c5349408274d57a692b20dcb2
- MD5 1e8f86842482f34229628d0e3c26223c
- SHA1 6f8898ed59d9bed4907d4f4cd7989fde567cc420
- SHA512 64a0121cc1eb32c7492745358138cdc3f348bf95ed4ccb31cb15ecc80ea4f50aa06adfd4e97f747d684d9b34b9d219b9ca01039fea77777aa249c0f641a2e545
- SSDEEP 96:FM3oV4HdDD84LTHzbOHXOHBlBRQs8Sc9XE56tOSVQpu:Shb++lVm
- MD5 SHA1 SHA512 SSDEEP