Analysis
-
max time kernel
132s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29-08-2024 05:54
Behavioral task
behavioral1
Sample
6ea2b5143078d89828fbcb105b90a693.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
6ea2b5143078d89828fbcb105b90a693.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
⌚/stepao.exe
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
⌚/stepao.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
⌚/withrobot.exe
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
⌚/withrobot.exe
Resource
win10v2004-20240802-en
General
-
Target
6ea2b5143078d89828fbcb105b90a693.exe
-
Size
13.8MB
-
MD5
6ea2b5143078d89828fbcb105b90a693
-
SHA1
dbfe2845b56a4eaa60015dc001162c3023158d21
-
SHA256
84fa854d9295a49125aaa8faeb5f5a75f7d133dbbfb4831430e20d5d3dc417ac
-
SHA512
bffbbfb1c62d3ebadc3977d591c052d54289bc4b4348afe7c0096f9d1b709461fb66f3c8ede5a29670847b344364d1b33651807c83ab8f8c2c6f0f9f27e34f47
-
SSDEEP
393216:saawEVI99NrEPFn6JdXG1w2fIVtRGpFI0+mdkO0pGYIg:saGaPce218VtRG7vTkO0cM
Malware Config
Signatures
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 2028 created 2796 2028 stepao.exe 49 -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3404 powershell.exe -
Creates new service(s) 2 TTPs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation 6ea2b5143078d89828fbcb105b90a693.exe -
Executes dropped EXE 2 IoCs
pid Process 2028 stepao.exe 752 withrobot.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\MRT.exe withrobot.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3308 sc.exe 3568 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6ea2b5143078d89828fbcb105b90a693.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language stepao.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openwith.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 6ea2b5143078d89828fbcb105b90a693.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 752 withrobot.exe 752 withrobot.exe 2028 stepao.exe 2028 stepao.exe 2376 openwith.exe 2376 openwith.exe 2376 openwith.exe 2376 openwith.exe 752 withrobot.exe 3404 powershell.exe 3404 powershell.exe 752 withrobot.exe 752 withrobot.exe 752 withrobot.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3404 powershell.exe Token: SeDebugPrivilege 752 withrobot.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3328 wrote to memory of 2028 3328 6ea2b5143078d89828fbcb105b90a693.exe 87 PID 3328 wrote to memory of 2028 3328 6ea2b5143078d89828fbcb105b90a693.exe 87 PID 3328 wrote to memory of 2028 3328 6ea2b5143078d89828fbcb105b90a693.exe 87 PID 3328 wrote to memory of 752 3328 6ea2b5143078d89828fbcb105b90a693.exe 88 PID 3328 wrote to memory of 752 3328 6ea2b5143078d89828fbcb105b90a693.exe 88 PID 2028 wrote to memory of 2376 2028 stepao.exe 89 PID 2028 wrote to memory of 2376 2028 stepao.exe 89 PID 2028 wrote to memory of 2376 2028 stepao.exe 89 PID 2028 wrote to memory of 2376 2028 stepao.exe 89 PID 2028 wrote to memory of 2376 2028 stepao.exe 89 PID 4836 wrote to memory of 5056 4836 cmd.exe 105 PID 4836 wrote to memory of 5056 4836 cmd.exe 105
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2796
-
C:\Windows\SysWOW64\openwith.exe"C:\Windows\system32\openwith.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2376
-
-
C:\Users\Admin\AppData\Local\Temp\6ea2b5143078d89828fbcb105b90a693.exe"C:\Users\Admin\AppData\Local\Temp\6ea2b5143078d89828fbcb105b90a693.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Roaming\stepao.exe"C:\Users\Admin\AppData\Roaming\stepao.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2028
-
-
C:\Users\Admin\AppData\Roaming\withrobot.exe"C:\Users\Admin\AppData\Roaming\withrobot.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:752 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3404
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart3⤵
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart4⤵PID:5056
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "RuntimeBroker"3⤵
- Launches sc.exe
PID:3308
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "RuntimeBroker" binpath= "C:\ProgramData\RuntimeBroker.exe" start= "auto"3⤵
- Launches sc.exe
PID:3568
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
423KB
MD57313e7456fbaf0d2554570c77897abf1
SHA1850e156c7b58ab4b7ae5eedc0c8a396d33930d3d
SHA2562fc82bf903409c53ed2b488b7920be9df0c60835d12bb21c45c27384e4a1ff38
SHA51262cdd0914b5c150f615c2f7e56e5f106308387d9ef4d045a54e4f32280d6abbfefb1ace4ad7123881e437567df5566ff0c872555df913d534ebf43c56c8d6cd0
-
Filesize
14.8MB
MD502071fe1b9c8d6ade8dafa0a71600503
SHA15b547e72386e43c291bceea5b7d0e8f51469cd3c
SHA25600c32e90c14f9c866a30256c8499e753397c7385e4a3fbcdc86515b9ee563faf
SHA5121c4b1c1cb788f08dea954b795d4e0bbd7c028aa5655ce23af805243d06d1c96ef687b0788343182c1d0307e9c76088e4d53e4506e5a4f8d1707001e6549b487a