Analysis
-
max time kernel
93s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
15-09-2024 19:05
Behavioral task
behavioral1
Sample
699b82c9536a8f8718d686cd4b13027f.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
699b82c9536a8f8718d686cd4b13027f.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
⌚/sdfgt.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
⌚/sdfgt.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
⌚/withrobot.exe
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
⌚/withrobot.exe
Resource
win10v2004-20240802-en
General
-
Target
699b82c9536a8f8718d686cd4b13027f.exe
-
Size
13.8MB
-
MD5
699b82c9536a8f8718d686cd4b13027f
-
SHA1
cf50c3736cd67282f8142bbb81907363bb446ddd
-
SHA256
f6289c816a6e59b7eabd07f97a32ac92f98ba35408a1408897c0271570dd16e2
-
SHA512
b449e23daf94dcbe7a13c65499f225a112228a8c75d4cde38978b143f83e08e775b4839a8d09c37d3a4afadb3a546736665503218d9b22735a8681ec81dd20bc
-
SSDEEP
393216:sPEvJY6rJIR1stsKIvTme9iWjS5RZyRkxj:s8vJZ+6tsK8RiW8ikxj
Malware Config
Signatures
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 1796 created 2508 1796 sdfgt.exe 42 -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4504 powershell.exe -
Creates new service(s) 2 TTPs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 699b82c9536a8f8718d686cd4b13027f.exe -
Executes dropped EXE 2 IoCs
pid Process 1796 sdfgt.exe 1472 withrobot.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\MRT.exe withrobot.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3136 sc.exe 1072 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 699b82c9536a8f8718d686cd4b13027f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sdfgt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openwith.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 699b82c9536a8f8718d686cd4b13027f.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1796 sdfgt.exe 1796 sdfgt.exe 5060 openwith.exe 5060 openwith.exe 1472 withrobot.exe 1472 withrobot.exe 5060 openwith.exe 5060 openwith.exe 1472 withrobot.exe 4504 powershell.exe 4504 powershell.exe 1472 withrobot.exe 1472 withrobot.exe 1472 withrobot.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4504 powershell.exe Token: SeDebugPrivilege 1472 withrobot.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4264 wrote to memory of 1796 4264 699b82c9536a8f8718d686cd4b13027f.exe 82 PID 4264 wrote to memory of 1796 4264 699b82c9536a8f8718d686cd4b13027f.exe 82 PID 4264 wrote to memory of 1796 4264 699b82c9536a8f8718d686cd4b13027f.exe 82 PID 4264 wrote to memory of 1472 4264 699b82c9536a8f8718d686cd4b13027f.exe 83 PID 4264 wrote to memory of 1472 4264 699b82c9536a8f8718d686cd4b13027f.exe 83 PID 1796 wrote to memory of 5060 1796 sdfgt.exe 84 PID 1796 wrote to memory of 5060 1796 sdfgt.exe 84 PID 1796 wrote to memory of 5060 1796 sdfgt.exe 84 PID 1796 wrote to memory of 5060 1796 sdfgt.exe 84 PID 1796 wrote to memory of 5060 1796 sdfgt.exe 84 PID 736 wrote to memory of 1560 736 cmd.exe 100 PID 736 wrote to memory of 1560 736 cmd.exe 100
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2508
-
C:\Windows\SysWOW64\openwith.exe"C:\Windows\system32\openwith.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5060
-
-
C:\Users\Admin\AppData\Local\Temp\699b82c9536a8f8718d686cd4b13027f.exe"C:\Users\Admin\AppData\Local\Temp\699b82c9536a8f8718d686cd4b13027f.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Roaming\sdfgt.exe"C:\Users\Admin\AppData\Roaming\sdfgt.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1796
-
-
C:\Users\Admin\AppData\Roaming\withrobot.exe"C:\Users\Admin\AppData\Roaming\withrobot.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1472 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4504
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart3⤵
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart4⤵PID:1560
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "RuntimeBroker"3⤵
- Launches sc.exe
PID:3136
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "RuntimeBroker" binpath= "C:\ProgramData\RuntimeBroker.exe" start= "auto"3⤵
- Launches sc.exe
PID:1072
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
423KB
MD5b8bf5beebfa1cf685e813973902bdf25
SHA155ca38cfb317da1926f39fa82ceb6c5b9a43b0b0
SHA256741b85f17765f4f17c342195642a39a34c8274c01e436b97b4e9294538310fd4
SHA512bef7e644150163450a8fdb1dce5123bab73942794a6b247c93a09b5e7e30d6f18c35607466ced2a6cb56a66cc5ffa3595e8e77d6e09a22eeb492eddd7729fc6f
-
Filesize
14.8MB
MD502071fe1b9c8d6ade8dafa0a71600503
SHA15b547e72386e43c291bceea5b7d0e8f51469cd3c
SHA25600c32e90c14f9c866a30256c8499e753397c7385e4a3fbcdc86515b9ee563faf
SHA5121c4b1c1cb788f08dea954b795d4e0bbd7c028aa5655ce23af805243d06d1c96ef687b0788343182c1d0307e9c76088e4d53e4506e5a4f8d1707001e6549b487a