Analysis Overview
SHA256
5f09dcd96fe17153060fc166c97013847c3d785c03d644749d95954c31c40d60
Threat Level: Known bad
The file RG_Catalyst.zip was found to be: Known bad.
Malicious Activity Summary
Rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess
Executes dropped EXE
Drops file in Windows directory
Browser Information Discovery
System Location Discovery: System Language Discovery
Enumerates system info in registry
Suspicious use of SendNotifyMessage
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Modifies registry class
Suspicious use of WriteProcessMemory
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of SetWindowsHookEx
Suspicious use of FindShellTrayWindow
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-09-15 00:08
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-09-15 00:08
Reported
2024-09-15 00:12
Platform
win11-20240802-en
Max time kernel
195s
Max time network
208s
Command Line
Signatures
Rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess
| Description | Indicator | Process | Target |
| PID 232 created 2076 | N/A | C:\Users\Admin\AppData\Local\Temp\module.exe | C:\Windows\system32\sihost.exe |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\module.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\Panther\UnattendGC\setupact.log | C:\Windows\System32\oobe\UserOOBEBroker.exe | N/A |
| File opened for modification | C:\Windows\Panther\UnattendGC\setuperr.log | C:\Windows\System32\oobe\UserOOBEBroker.exe | N/A |
| File opened for modification | C:\Windows\Panther\UnattendGC\diagerr.xml | C:\Windows\System32\oobe\UserOOBEBroker.exe | N/A |
| File opened for modification | C:\Windows\Panther\UnattendGC\diagwrn.xml | C:\Windows\System32\oobe\UserOOBEBroker.exe | N/A |
Browser Information Discovery
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\module.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\openwith.exe | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings | C:\Windows\system32\OpenWith.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\module.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\module.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\module.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\module.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\openwith.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\openwith.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\openwith.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\openwith.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\OpenWith.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Processes
C:\Windows\system32\sihost.exe
sihost.exe
C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\RG_Catalyst.zip
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://temp/
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe46063cb8,0x7ffe46063cc8,0x7ffe46063cd8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,17446111706305158706,630819478021595008,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,17446111706305158706,630819478021595008,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,17446111706305158706,630819478021595008,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,17446111706305158706,630819478021595008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,17446111706305158706,630819478021595008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,17446111706305158706,630819478021595008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
C:\test\loader.exe
"C:\test\loader.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Temp\module.exe"
C:\Users\Admin\AppData\Local\Temp\module.exe
C:\Users\Admin\AppData\Local\Temp\module.exe
C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
Network
| Country | Destination | Domain | Proto |
| GB | 184.28.176.32:443 | tcp | |
| GB | 184.28.176.32:443 | tcp | |
| US | 8.8.8.8:53 | browser.pipe.aria.microsoft.com | udp |
| IE | 13.69.239.72:443 | browser.pipe.aria.microsoft.com | tcp |
| GB | 184.28.176.32:443 | tcp | |
| GB | 184.28.176.32:443 | tcp | |
| US | 8.8.8.8:53 | 72.239.69.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| GB | 184.28.176.10:443 | tcp | |
| GB | 184.28.176.10:443 | tcp | |
| GB | 184.28.176.10:443 | tcp | |
| GB | 184.28.176.10:443 | tcp | |
| GB | 184.28.176.10:443 | tcp | |
| US | 13.107.3.254:443 | s-ring.msedge.net | tcp |
| GB | 184.28.176.35:443 | tcp | |
| GB | 184.28.176.35:443 | tcp | |
| GB | 184.28.176.35:443 | tcp | |
| GB | 184.28.176.35:443 | tcp | |
| GB | 184.28.176.35:443 | tcp | |
| GB | 184.28.176.35:443 | tcp | |
| GB | 184.28.176.112:443 | tcp | |
| GB | 184.28.176.112:443 | tcp | |
| GB | 184.28.176.112:443 | tcp | |
| GB | 184.28.176.112:443 | tcp | |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | google.com | udp |
| US | 8.8.8.8:53 | google.com | udp |
| GB | 184.28.176.27:443 | tcp | |
| GB | 184.28.176.27:443 | tcp | |
| GB | 184.28.176.27:443 | tcp | |
| GB | 184.28.176.27:443 | tcp | |
| GB | 184.28.176.27:443 | tcp | |
| GB | 184.28.176.27:443 | tcp | |
| US | 13.107.136.254:443 | spo-ring.msedge.net | tcp |
| IE | 13.69.239.72:443 | browser.pipe.aria.microsoft.com | tcp |
| GB | 184.28.176.82:443 | tcp | |
| GB | 184.28.176.82:443 | tcp | |
| GB | 184.28.176.82:443 | tcp | |
| GB | 184.28.176.82:443 | tcp | |
| GB | 184.28.176.82:443 | tcp | |
| GB | 184.28.176.82:443 | tcp | |
| GB | 184.28.176.82:443 | tcp | |
| GB | 20.26.156.215:443 | github.com | tcp |
| US | 185.199.108.133:443 | objects.githubusercontent.com | tcp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 6fdbe80e9fe20761b59e8f32398f4b14 |
| SHA1 | 049b1f0c6fc4e93a4ba6b3c992f1d6cecf3ada1f |
| SHA256 | b7f0d9ece2307bdc4f05a2d814c947451b007067ff8af977f77f06c3d5706942 |
| SHA512 | cf25c7fd0d6eccc46e7b58949c16d17ebeefb7edd6c76aa62f7ab5da52d1c6fc88bde620be40396d336789bd0d62b2162209a947d7ab69389e8c03682e880234 |
\??\pipe\LOCAL\crashpad_1560_LIHUIBPQHTCQNSVK
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 9828ffacf3deee7f4c1300366ec22fab |
| SHA1 | 9aff54b57502b0fc2be1b0b4b3380256fb785602 |
| SHA256 | a3d21f0fb6563a5c9d0f7a6e9c125ec3faaa86ff43f37cb85a8778abc87950f7 |
| SHA512 | 2e73ea4d2fcd7c8d52487816110f5f4a808ed636ae87dd119702d1cd1ae315cbb25c8094a9dddf18f07472b4deaed3e7e26c9b499334b26bdb70d4fa7f84168d |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 684fd81e08c4260c0cb2aa04a3575695 |
| SHA1 | d8d7cbe538b127fca85e89e62306f0ae344e524e |
| SHA256 | 7a8683a18f36c30021fbb37ba1cff237f69b019846cf57ee92d21bdc155a14de |
| SHA512 | 7703941abb92bbf7879c1e3e89ab9d420ae182ce08599d18d5fa898a6dd5d4b31714726fe7a21cab13d45886ba5f76b1b10e79bde3d114fb2d96a7bd33ae22e8 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | fdb73912e8f38d957a7065ac607f44d4 |
| SHA1 | 7f28fefaaa07567f76fe17cda43b8e30e6dcefca |
| SHA256 | 5b3ebadb71aee1fbb6695072726463dcdf4b35917e3e61e0da54f7b0967c485c |
| SHA512 | 3cb16fa3332baf60542dd7072e2ad5fc7329f9456bdbc1d9f268a8d98b3401973f62f77c8032510a4cdb6cba3f628158ce65383de7ed563f416f95ae637ee06b |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | e5d243351860fe8ba41ec3d8e8f74dbb |
| SHA1 | 6075964fc83c01f7e0c49b8828c9be510e745584 |
| SHA256 | 51bb2be866e9c8c6501a6e912f78dd33345195cd05ff3aad551b82aab9f0344b |
| SHA512 | 1f82354c1d2639f5e42970c872d4399ce78dad84b2b50e7dc967434908624a58d8d55bb0c7b2b3970ca8c3003d957b6174051f083805e6c35235049847699b13 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
| MD5 | f50f89a0a91564d0b8a211f8921aa7de |
| SHA1 | 112403a17dd69d5b9018b8cede023cb3b54eab7d |
| SHA256 | b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec |
| SHA512 | bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58 |
C:\Users\Admin\AppData\Local\Temp\module.exe
| MD5 | 12d8c8c95c59e45b98b2a107575b0169 |
| SHA1 | 8a179831a9a5da9a64888702be744a0e837adfc3 |
| SHA256 | 6d3cb7a3b8e5a1ca0288c225b8bf2a3d741f05fe1d8f3954d5e36ce13ce99355 |
| SHA512 | 9b253516f3034a65232b97e58817c24ca4a0b73bf1bc141d5903a645a499cbd97c8f263a1704d54fb88998258d12a5da683090102c7dbaf1b1d98f71de9c6b6b |
memory/232-100-0x0000000000990000-0x0000000000EBB000-memory.dmp
memory/232-101-0x0000000000980000-0x0000000000981000-memory.dmp
memory/232-102-0x0000000000990000-0x0000000000EBB000-memory.dmp
memory/232-103-0x0000000003FA0000-0x00000000043A0000-memory.dmp
memory/232-104-0x0000000003FA0000-0x00000000043A0000-memory.dmp
memory/232-105-0x00007FFE66660000-0x00007FFE66869000-memory.dmp
memory/536-108-0x0000000000B70000-0x0000000000B79000-memory.dmp
memory/232-107-0x0000000076530000-0x0000000076782000-memory.dmp
memory/536-112-0x00007FFE66660000-0x00007FFE66869000-memory.dmp
memory/536-111-0x00000000029A0000-0x0000000002DA0000-memory.dmp
memory/536-114-0x0000000076530000-0x0000000076782000-memory.dmp
memory/232-110-0x0000000000990000-0x0000000000EBB000-memory.dmp