Analysis
- max time kernel
108s - max time network
115s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
30/08/2024, 02:19
General
- Target 6cd031908922840ee684d3c05294e7e071b500915b760c474f22c1def0df14bc.exe
- Size 2.5MB
- Sample240830-cr7yzssdrf
- SHA256 6cd031908922840ee684d3c05294e7e071b500915b760c474f22c1def0df14bc
Malware Config
Extracted
-
rhadamanthys
-
https://154.216.19.149:2047/888260cc6af8f/07djb4gj.jifud
Extracted
-
xworm
-
5.0
-
TN3sSNYI1fDMFOs2
-
install_file
USB.exe
-
pastebin_url
https://pastebin.com/raw/jxfGm9Pc
Signatures
- Detect Xworm Payload 1 IoCs
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 5 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious behavior: MapViewOfSection 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\SysWOW64\openwith.exe"C:\Windows\system32\openwith.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\6cd031908922840ee684d3c05294e7e071b500915b760c474f22c1def0df14bc.exe"C:\Users\Admin\AppData\Local\Temp\6cd031908922840ee684d3c05294e7e071b500915b760c474f22c1def0df14bc.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SendBugReportNew.exe"C:\Users\Admin\AppData\Local\Temp\SendBugReportNew.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Javaoraclev4\WLAKGGESVCOQNX\V3.exeC:\Users\Admin\AppData\Roaming\Javaoraclev4\WLAKGGESVCOQNX\V3.exe3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
34e054d5
SendBugReportNew.exe
mvyvk
nfsxtmg
rtl120.bpl
vcl120.bpl
vclx120.bpl
V3.exe
memory/1548-60-0x0000000073713000-0x0000000073714000-memory.dmp
memory/1548-38-0x0000000073700000-0x000000007387B000-memory.dmp
memory/1548-65-0x0000000050000000-0x0000000050116000-memory.dmp
memory/1548-35-0x0000000073713000-0x0000000073714000-memory.dmp
memory/1548-34-0x00007FFA33290000-0x00007FFA33485000-memory.dmp
memory/1548-66-0x0000000050120000-0x000000005030D000-memory.dmp
memory/1548-33-0x0000000073700000-0x000000007387B000-memory.dmp
memory/1548-67-0x0000000050310000-0x0000000050349000-memory.dmp
memory/1548-37-0x0000000073700000-0x000000007387B000-memory.dmp
memory/1548-64-0x0000000000400000-0x0000000000585000-memory.dmp
memory/1548-61-0x0000000073700000-0x000000007387B000-memory.dmp
memory/1560-46-0x00007FFA33290000-0x00007FFA33485000-memory.dmp
memory/1560-43-0x0000000003160000-0x0000000003560000-memory.dmp
memory/1560-42-0x0000000000150000-0x00000000001CE000-memory.dmp
memory/1560-45-0x0000000003160000-0x0000000003560000-memory.dmp
memory/1560-44-0x0000000003160000-0x0000000003560000-memory.dmp
memory/1560-47-0x0000000003160000-0x0000000003560000-memory.dmp
memory/1560-49-0x0000000076E00000-0x0000000077015000-memory.dmp
memory/1560-51-0x0000000000150000-0x00000000001CE000-memory.dmp
memory/2848-59-0x0000000002830000-0x0000000002C30000-memory.dmp
memory/2848-58-0x0000000002830000-0x0000000002C30000-memory.dmp
memory/2848-57-0x0000000076E00000-0x0000000077015000-memory.dmp
memory/2848-55-0x00007FFA33290000-0x00007FFA33485000-memory.dmp
memory/2848-53-0x0000000002830000-0x0000000002C30000-memory.dmp
memory/2848-50-0x0000000000C90000-0x0000000000C99000-memory.dmp
memory/2848-54-0x0000000002830000-0x0000000002C30000-memory.dmp
memory/4464-69-0x00007FFA33290000-0x00007FFA33485000-memory.dmp
memory/4464-72-0x0000000073700000-0x000000007387B000-memory.dmp
memory/5016-74-0x00000000721D0000-0x0000000073424000-memory.dmp
memory/5016-77-0x0000000000FA0000-0x0000000000FAE000-memory.dmp
memory/5016-78-0x0000000005860000-0x00000000058FC000-memory.dmp