Analysis
-
max time kernel
281s -
max time network
298s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
10-09-2024 03:52
General
-
Target
b4346702b4b5029cbd627b5df724550f8b783ba22876e5070dadc0ed5c214df2.msi
-
Size
23.0MB
-
MD5
4295dda40427af8df6738b3531d63389
-
SHA1
cb5a45de787c34eda399a3cad64abd3b6133f514
-
SHA256
b4346702b4b5029cbd627b5df724550f8b783ba22876e5070dadc0ed5c214df2
-
SHA512
31ae6245cc6188e9d8b471c9cb169263fb7189e3d7653266857db01e3b92b1773ddc1971e3468734f48294f48aaf1a1e93b21d3ffc89dc30f6fcf8549c6a24e2
-
SSDEEP
393216:u66L7jpW/sxwA0Ip5AGgrJmD1Y5D9xAgAmBOn4AZENqMJiaErOQtt4KgTD5v2X:uHWUxOQxZDKNfAuOri9rQtlKy
Malware Config
Signatures
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
-
Blocklisted process makes network request 4 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 32 IoCs
-
Loads dropped DLL 6 IoCs
-
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 5 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of WriteProcessMemory 35 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\SysWOW64\openwith.exe"C:\Windows\system32\openwith.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\b4346702b4b5029cbd627b5df724550f8b783ba22876e5070dadc0ed5c214df2.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding FB8180940981AC644FEB49E550C483A72⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\dXNlcg==.msi"3⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3816 -s 14723⤵
- Program crash
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4452AAE9F2E6C6BD6A0F8A07B621771E C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0E8F2F186CA015D1A5290C22685654702⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -InputFormat None -ExecutionPolicy Bypass -Command "& 'C:\Program Files (x86)\GitExtensions\set-telemetry.ps1' 1; exit $($Error.Count)"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 91D30891D8C948C5638BECF4CCDB2735 E Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\GitExtensions\GitExtensions.exe" /queue:13⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\GitExtensions\GitExtensions.exe" /queue:13⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe update /queue3⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe update /queue3⤵
- Drops file in Windows directory
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3816 -ip 38161⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Event Triggered Execution
2Component Object Model Hijacking
1Installer Packages
1Privilege Escalation
Event Triggered Execution
2Component Object Model Hijacking
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD593aca64b92a3e87690de4e6c0ecb3525
SHA1f6258d4cc6f9fb6ef7394f0c411444cdc0ca1d04
SHA2567415b392da6a391bbfe4cde238246ccaf83fce33f2f2c5abc30df3b22a508971
SHA512064d094fac3c43be846e32ff6310ed00a7e3de8f03e5dc70a1e73dca82bf4ef946751e13caddfdc3d67ae5bd19ad40b456f96289d831a2e9edf223624ac961e7
-
Filesize
376KB
MD51a16388664012f98bdb3b347dc3bc2e3
SHA1e8b21ac522d379d66f272fab08ee18bd4528ab99
SHA256df7f2d1942c7042726fdaa2c742bb9654ef1bc4122b5cb2fc601689756decb80
SHA512ad9fd8ade6a1fe97fec2b75c2dd5d404d4876fbd09e629ea46b6cf7140e6aae6b4730270279d89a8cb625426e857f6d45a90a55d1446261971a02639cd84c38c
-
Filesize
60KB
MD579cfa8efd0538e708032f4397bdd1126
SHA1bba7b2666d1253d23dd06194edc44587d9d56c85
SHA25686e6b413bbbb9e84fa5ef4898313c6f7848854e0bfc5f94fc537f3c23c27001e
SHA51209853af9e9a0c7527b1c0047f22e95c221b6fa91bca8c674b126b773a838ec7dc99e1de5007927ba54edd3fe8f6d58568598d40a39c475b38f1e38ec36b95058
-
Filesize
14KB
MD546aa555e44a8a327b91bea688604102a
SHA14e70f82e8df312e5791cc2c739481594ae423b48
SHA25684bbd4cdf41af135871d612cb2869cd698c09fa623317ff36d8eda16565360f8
SHA51244e06c72c8cef051ba24dd387eb51465d4a02ef69863dbf842674568a91d9ea645670bbb753b966c48b17bf3d415ee9c7bfcd1164025dd433c600f3bb26c0022
-
Filesize
751B
MD5b11869dfd07ed73ebe9acb3e46aad945
SHA18210c7cace27f9db67325aeb392af7079be336df
SHA25682b99fe8316daf91f097a310b2aaa96a7d7c72fd11f51b55820d01a261b24d0d
SHA51292a599cfaff7dcb60ea96e0cc8860fec3d22f07943d2bc407c7b18f7d7ea3aad53daecfb80fde6e2cb583740ed6bd4f788c638d2612994721683ed4f77ff1c8e
-
Filesize
727B
MD57a3b8457313a521e0d44f91765a4e041
SHA14ea8ecb5e7b4c11f4c491caf6cee7ced5ec4c267
SHA2562b08ecf53bb8b6c430659926148f896102dc80b5f38b0ec5efe122199659651c
SHA5127349fd1b8c490d540a8bb25f40587f9874ff5d9b1f9bdb2ea69db9218ebdbdccea5e4d6645fbd1098d051b008b1ebfd12a619c3a4d6fb54940705ab14933e159
-
Filesize
478B
MD573d4b61ae50ed3b97775bf3c10377e4d
SHA11c97eca131f51f7950176a10e8cf9040e6f9afed
SHA25651e24655c39b37990ae677c226e78600b097c9571672c1c34706a3199aa007e6
SHA51252681172b1106f88bbe827e0bef3bda4205af344a42a59358733f5c5b561428dab79cd733eda2a34cd10217ef4d40b7a18938632ba1f7a77d030a6190e7515d6
-
Filesize
478B
MD58a52d414638dafb90f8a702091f2824c
SHA1c538bb7aebb0e30c2572e0f8c2d63af665d132d8
SHA256ff8bf00923654c2356538d7ae0d103479a39cc48320c9bff4375081df6e44370
SHA5126f7856de56b8982b54c09a406f52ba1064c5982f3c0cf04e74b13d09472495c9aafe316af357efb0d169dceb5860fb3571c68655df1155fa7208d2714dd4b1f5
-
Filesize
113KB
MD54fdd16752561cf585fed1506914d73e0
SHA1f00023b9ae3c8ce5b7bb92f25011eaebe6f9d424
SHA256aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7
SHA5123695e7eb1e35ec959243a91ab5b4454eb59aeef0f2699aa5de8e03de8fbb89f756a89130526da5c08815408cb700284a17936522ad2cad594c3e6e9d18a3f600
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
22.3MB
MD5e969fa4b30951a66e9bf28b21fd75174
SHA1dc818acf470ad20f56f464e4839650564f023a7f
SHA25696811ea4f9266ba8ee5c758c146fbc84f3cfe5ec4c5c966b5885e11b5f696f74
SHA5126da2ec033f58843a06270ef04c55ba0ee8449df685f1902ab953bf511acd0a4735532db3bff73858c082005b4df27d5c376a4fb324f9506b85564356286b0f68
-
Filesize
135KB
MD554b5196bac438d837d6abfab87985b20
SHA15ba90a7b50ce43ec10cac7f842f5cdf6d4e867c8
SHA256cb717468948c4c7f026615a15bbdf22328dc939d908f994099cb206e04705b24
SHA512b56c4cfdffb294cf5501bf27361fb1a317d05e3539835b0bef265ba21e440340cacdd59bdeb147a12e2647ef1812ac48a956ece8d76458251827e25cad1aa346
-
Filesize
211KB
MD5a3ae5d86ecf38db9427359ea37a5f646
SHA1eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA256c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
SHA51296ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
-
Filesize
193KB
MD57e274959f4347527c246a2c6343105e7
SHA18885c1a2624ccd01102d9eabfa9050fd19093f16
SHA256dbe502732e67c80c03fba12a885f3c68023eeff31fcde8170f4733d8261b540e
SHA512bf4666efec860030f2795ebdb5ed34a11f2611a342ea1b752dd232072425420b9155804fc43ed7546c4fd3973bc68cdfc9c5cd9765d3c529891a0862173df4b9
-
Filesize
155KB
MD55a6a1439e140b4c5b7e97d2ea4f548f7
SHA13326a19c88acd3b31961662df10e7283520cb1b9
SHA2564f37f2344a30a0da7bbf2f18fe05ea1c00dee82dbf9c7d59bdbccfde96831b38
SHA512070cb09dd0a7f5b768092f1d4b95de9efe3c27e3eabb18da88136fda4e969efb7699ace2f1c10f24022d2865dae63248579bde5f4e7468e55d2954186ac07f94
-
Filesize
155KB
MD58ef35058feff910b4dbf9884ca91ae67
SHA1c80f3cc63ef1a51ce56fd392352a8fa1d86fb278
SHA2569014b8b63424e8d928deb160fdf2f908f50211f150e2f8f1969dc2670f6e89fa
SHA5124020a4e8e09db21ea80cd4df32c0a8617b5b668a6f31328d7d264f2acdb64a2524dfa139cae8e61269d45b67db55c500ffbc16574b3f70d2360400e6aec11f09
-
Filesize
155KB
MD55e59a7f7620620cfedd5bf966a2c533a
SHA17a963eb4a34d960d24f09e4a59b870f3585ebf0e
SHA2563b28a591a5a859268f18f6335312861a3f88390bbd4ee9a0100ea6bd5ad3063f
SHA5124cfe29510405f4164be903813c1029c8f58800bc74e4fa8da00bf74596e12a3e2849b54765b93504c47fc3ce61c495b65593fcffbeb8c2c767d77a777ebd647a
-
Filesize
147KB
MD5c5bdd8dc06a1cda149bd1487f8c1b6b9
SHA138357a3d9ee6ff691c5973ee9ce05ce4dbd54019
SHA2561b6fc131571322f31af6b407b0cbd96a29ab9640385f7eccaf1294601dfeaac9
SHA512741b307c1b480114602c88d882cd78add9efe66bf7cd256ea091ca24240b55792cde60ddc86869eefe979ad907ff8c248f9c4cc0fe3e47fa257fefd4e9826584
-
Filesize
23.7MB
MD52b7769aa475c4fc245b593fc85f0b1c8
SHA12548422aac8c0111a0349a7380a9c99d302cc751
SHA256a00e893d8d3c365fcb68eaa5948bba769f5d887174c45c54869d432e41c83266
SHA512381ed1f6af9d15bb53ae66ac6cd98589e1cf5b2cfedc8ba07713c8e3e0607b7d4b6ff10689a9dfdf2886db453e69768f68cc73cc3c0f29a850fe2f9984f4c46a
-
Filesize
6KB
MD5c2af4ad6f29990ef1cbc3fb0e0fd928a
SHA1eecf26873582478dd909fa7aa5f8c07400b6e061
SHA256d395f5a0d45d999d27b0deb878c8844e50f040fbfbb728d7eaf3a2097f47680d
SHA512f853d7e15adc2f8638d47ebefb84ae86f07e9092991878b6a383263f7e3c2d8a38a8fc03677fbd557ee0adac796b42444a50b55de692f86185082da45539a250
-
Filesize
36KB
-
Filesize
2.1MB
-
Filesize
2.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
2.0MB
-
Filesize
2.1MB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
120KB
-
Filesize
600KB
-
Filesize
104KB
-
Filesize
136KB
-
Filesize
5.6MB
-
Filesize
6.5MB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
136KB
-
Filesize
6.2MB
-
Filesize
216KB