Overview

overview

10

Static

static

1

api-ms-win...-0.dll

windows10-2004-x64

1

api-ms-win...-0.dll

windows10-2004-x64

1

api-ms-win...-0.dll

windows10-2004-x64

1

mib.bin

windows7-x64

3

mib.bin

windows10-2004-x64

3

setup.exe

windows7-x64

1

setup.exe

windows10-2004-x64

10

setupact.log

windows7-x64

1

setupact.log

windows10-2004-x64

1

system.ini

windows7-x64

1

system.ini

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Solara_roblox.zip

  • Size

    15.2MB

  • Sample

    240727-pya9tazelq

  • MD5

    325eaa719d119aa8a559410b7af339fd

  • SHA1

    3fcad09ac80ab0e9c056eab70b55887ea4245df3

  • SHA256

    3f767ffe96383bc3850ccecde867a3d4395b647947c9a3f004fbbc4894302136

  • SHA512

    d76e0fd995621f9267aa5dd25e23bdcd2247fd3732f268f8afc2e382f703e009e97fbfa1022f3d69aa851a1e261267614d923ae2a311fe1177ea3b4036f77e35

  • SSDEEP

    393216:C2qI4zgeCPIFiglX8Cw0777rnkmHueNS6gEPX+0ZrSZ+Y7:CXI3Iwg/f7kmDN9POoA

Score
10/10
rhadamanthysdiscoveryevasionexecutionpersistenceprivilege_escalationstealertrojan

Malware Config

Targets

    • Target

      api-ms-win-core-console-l1-1-0.dll

    • Size

      18KB

    • MD5

      cde2424d99db56dd0d1eaf34811738c1

    • SHA1

      cc7889c43729b93a4e193b2fd6ae5f22b6ad6b8f

    • SHA256

      4ceaf28cadfd0929b44e9c686b93432a7151504c8ffe2a6afe516f9b16538131

    • SHA512

      d5b8ef2de3fefde29b2c9cccb330c3076ba71d6ae29e1b34617057d8a832d37eae8e2f238e2abb6eb226453c00a835c669a7c03a00cd1698d02272d8eb6998e2

    • SSDEEP

      192:MgWuufhW3a4V10b8uDBks/nGfe4pBjS7EQ8WebtuVaVWQ4eWbKqnajy3Snk0lpn:1W5hWq+10vq0GftpBj5fZblGinjXn

    Score
    1/10
    behavioral1

    • Target

      api-ms-win-core-datetime-l1-1-0.dll

    • Size

      17KB

    • MD5

      acf4321ac8c8ff4d0442c799d621f8d9

    • SHA1

      b12f87e6afc48697f1ce8b587715361e89b79cae

    • SHA256

      69b84f7318798a91143e3d273ae9c0bedaabba930e3702447d493e2b8dd70725

    • SHA512

      7878a7cd62f9d259a6bab05e13e9ac5b16437c0d8bda46e864f205465ae19531e5655d7547ae1594a53a05ddeb8b0c6058a73caeb21cd7c81fe5a424303d3bde

    • SSDEEP

      192:hEWuufhWr2ivT16uDBks/nGfe4pBjSbGPKA8WebtuVaVWQ4mWOC9qnajjpxf9c98:aW5hWPvT1Nq0GftpBjjeZRC9lBLcT+

    Score
    1/10
    behavioral2

    • Target

      api-ms-win-core-debug-l1-1-0.dll

    • Size

      17KB

    • MD5

      3c47c25b8141d20b2b4d576000000a61

    • SHA1

      04543f9cdd847ff66389c9fd1e12b444dae6383a

    • SHA256

      290030199e8b47d6bcf466f9fc81fee7e6aebc2c16a3f26dd77019f795658956

    • SHA512

      c599ef06045583b28faac051909c28f5f2fa56c34d47f3bd49efc101a1cdcb571a298eb100d0b381e3ebb1ba19b2fb4dd5127f259eb8ab183753722ecbe0f10a

    • SSDEEP

      384:M7eW5hWlo+10vq0GftpBj2uZwDkIldBQ7QMI:YkeinqDFQnI

    Score
    1/10
    behavioral3

    • Target

      mib.bin

    • Size

      42KB

    • MD5

      23af90d2355d8c83aa4567ef1763b467

    • SHA1

      08007f178be90ca8cb97de922ac4f8bf45691404

    • SHA256

      c2bf719b19848fb90245a45a19160b479be8138ff17dc82ea38c5ee65d20097b

    • SHA512

      ee1479bff096e4fcb3bdbb57eb08a51df971dd0e8d629f7b36b0758654ed2b3cc9969163b1bdcf2c8b3c276c20e5c24c000874c2ccbaea37e09ce690e5c44115

    • SSDEEP

      384:crfecaVB5/5GGb6GrhMAIS5uQFRwv3e+prYTB1CT7XGOKMfGwfqI1Ie72XKB8bgS:crM/5GGTF5FFRi35prYH2GwlIPXIdG

    Score
    3/10
    discovery
    behavioral4behavioral5

    • Target

      setup.exe

    • Size

      52.5MB

    • MD5

      4efe5b34754a7b87e7a2fb46664fb245

    • SHA1

      7a2ffeac89d92fb0fb987cb6b284133e41a1e666

    • SHA256

      88f6b132a2f2f4bee053e521ca9a212bca12ed681b223ad615d4263c976e152c

    • SHA512

      a090deac29ae7aa7baf6411d1eef6121f5fdf09eb3d14f57f2b7e1f1f56859a70d12019234055c74df6e339081529c670bdf035c728244435ea8830b2d6f6b14

    • SSDEEP

      393216:3T6KLdGUHM9yCKxECB54r6X9eDQrps7p6Y:3T6edGUs9yLEFy+sY

    Score
    10/10
    rhadamanthysdiscoveryevasionexecutionpersistenceprivilege_escalationstealertrojan

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

      stealerrhadamanthys

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Downloads MZ/PE file

    • Event Triggered Execution: Image File Execution Options Injection

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Network Share Discovery

      Attempt to gather information on host network.

      discovery

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Enumerates processes with tasklist

      discovery

    • Suspicious use of SetThreadContext

    behavioral6behavioral7

    • Target

      setupact.log

    • Size

      2KB

    • MD5

      4c39556ae445b09a7c2a6f5e4b486fc5

    • SHA1

      18f728d8667327f446949b801ddc40f9ce3bc2f5

    • SHA256

      7558f2aac7807f786c3db87e9447a9529bdd3ecd5f4af2de9595effdc23d85f2

    • SHA512

      1a9692a52ae41285a9902b293cefb20d3f475a1f493dc0ecdabbde390560e67a8d6ca00751ded3b99b265f8a4be311b165a299e69b2f6b73b6a95b00f11e17b4

    Score
    1/10
    behavioral8behavioral9

    • Target

      system.ini

    • Size

      219B

    • MD5

      286a9edb379dc3423a528b0864a0f111

    • SHA1

      18db3e3dfb6b1d4dc9bc2226109112466de28db0

    • SHA256

      6f533ccc79227e38f18bfc63bfc961ef4d3ee0e2bf33dd097ccf3548a12b743b

    • SHA512

      588720a82941b44338196f1808b810fecbbc56cb9979628f1126048c28f80b946314092a8dd26f5e7aca234b7163c4b9c1283a65c9b36be2a4da9966feb8b2cb

    Score
    1/10
    behavioral10behavioral11

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Event Triggered Execution

2
T1546

Component Object Model Hijacking

1
T1546.015

Image File Execution Options Injection

1
T1546.012

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Event Triggered Execution

2
T1546

Component Object Model Hijacking

1
T1546.015

Image File Execution Options Injection

1
T1546.012

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Modify Registry

2
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Discovery

Network Share Discovery

1
T1135

Peripheral Device Discovery

2
T1120

Process Discovery

1
T1057

Query Registry

7
T1012

System Information Discovery

8
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks