Overview

overview

10

Static

static

1

миимссми.png

windows11-21h2-x64

10

Resubmissions

05-08-2024 22:15

240805-16c9xstgka 10

05-08-2024 22:10

240805-13nw9azfjj 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    миимссми.png

  • Size

    932KB

  • Sample

    240805-16c9xstgka

  • MD5

    c884fc194231c9b1ea1b3174a4a5d245

  • SHA1

    ed5205b51b632191559f481f20944ebaa7cec4ad

  • SHA256

    10d18771311ea3d32128642debc3a5e7bfdbfa0982e0805558a87ef2497c5fb4

  • SHA512

    c22fc6fea39b9185394a64b32e0b6fcba677e9715390bb96eaac3a8a037d99252eaef9b6757cd6a771d4295ecee17e9aea6037169b5257004930b13621c73ae6

  • SSDEEP

    24576:nUKqVB0thWSrltKGDWVSHd14F0AIAwPWTRawTS5z+2:UKyBcjEoHd5/AwOT/cj

Score
10/10
rhadamanthysdefense_evasiondiscoveryexecutionstealer

Malware Config

Targets

    • Target

      миимссми.png

    • Size

      932KB

    • MD5

      c884fc194231c9b1ea1b3174a4a5d245

    • SHA1

      ed5205b51b632191559f481f20944ebaa7cec4ad

    • SHA256

      10d18771311ea3d32128642debc3a5e7bfdbfa0982e0805558a87ef2497c5fb4

    • SHA512

      c22fc6fea39b9185394a64b32e0b6fcba677e9715390bb96eaac3a8a037d99252eaef9b6757cd6a771d4295ecee17e9aea6037169b5257004930b13621c73ae6

    • SSDEEP

      24576:nUKqVB0thWSrltKGDWVSHd14F0AIAwPWTRawTS5z+2:UKyBcjEoHd5/AwOT/cj

    Score
    10/10
    rhadamanthysdefense_evasiondiscoveryexecutionstealer

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

      stealerrhadamanthys

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks