rhadamanthys | 91d2a52f3ccc94057ef09bff7a5591271aef63f04029c48b7a28cd7240e601b6

Analysis

max time kernel
137s
max time network
140s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
03-10-2024 15:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Launcher.exe
Size

364KB
MD5

93fde4e38a84c83af842f73b176ab8dc
SHA1

e8c55cc160a0a94e404f544b22e38511b9d71da8
SHA256

fb07af2aead3bdf360f555fc872191e43c2f0acbfc9258435f9a30afe272ba03
SHA512

48720aebe2158b8a58fc3431c2e6f68271fbade51303ad9cb5b0493efaec6053ff0c19a898841ef7c57a3c4d042ac8e7157fb3dc79593c1dfcdcf88e1469fdec
SSDEEP

6144:MpS9kEFKbITUvR8cy8dzQ7Lcf3Si96sfO+2RZrTql9unNrkYqliwrqH1JWP6f:Mp8KLBzQ7Lcf3SiQs2FTTql9unNrkvT2

Score

10^/10

rhadamanthys discovery execution persistence stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

lydqhty.exe

description pid process target process

PID 6272 created 2032 6272 lydqhty.exe sihost.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Start PowerShell.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

4972 powershell.exe
1488 powershell.exe

description	pid	process	target process
PID 6272 created 2032	6272	lydqhty.exe	sihost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000\Software\Microsoft\Windows\CurrentVersion\Run\CrowdstrikeEngine = "rundll32.exe C:\\Users\\Admin\\Documents\\CiscoUpdater000990.dll,EntryPoint"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000\Software\Microsoft\Windows\CurrentVersion\Run\CrowdstrikeEngine = "rundll32.exe C:\\Users\\Admin\\Documents\\CiscoUpdater000990.dll,EntryPoint"	reg.exe

Downloads MZ/PE file
Suspicious use of SetThreadContext 2 IoCs

Processes:

plugin212plugin212

description pid process target process

PID 1712 set thread context of 2280 1712 plugin212 csc.exe
PID 2024 set thread context of 5700 2024 plugin212 csc.exe
Executes dropped EXE 7 IoCs

Processes:

Launhcer.exeLauncher.exewinrar.exeplugin212plugin212lydqhty.exelydqhty.exe

pid process

708 Launhcer.exe
2044 Launcher.exe
3448 winrar.exe
1712 plugin212
2024 plugin212
6252 lydqhty.exe
6272 lydqhty.exe
Loads dropped DLL 2 IoCs

Processes:

plugin212plugin212

pid process

1712 plugin212
2024 plugin212
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

2084 6272 WerFault.exe lydqhty.exe
6080 6272 WerFault.exe lydqhty.exe

description	pid	process	target process
PID 1712 set thread context of 2280	1712	plugin212	csc.exe
PID 2024 set thread context of 5700	2024	plugin212	csc.exe

pid	process
708	Launhcer.exe
2044	Launcher.exe
3448	winrar.exe
1712	plugin212
2024	plugin212
6252	lydqhty.exe
6272	lydqhty.exe

pid	process
1712	plugin212
2024	plugin212

pid	pid_target	process	target process
2084	6272	WerFault.exe	lydqhty.exe
6080	6272	WerFault.exe	lydqhty.exe

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

Launcher.exeplugin212cmd.execsc.exereg.execsc.execmd.exeLauncher.exeLaunhcer.exepowershell.exepowershell.exereg.exeopenwith.exeplugin212cmd.exelydqhty.exewinrar.exelydqhty.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	plugin212
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launhcer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	plugin212
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lydqhty.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winrar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lydqhty.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

Launcher.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD	Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0280f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 5c000000010000000400000000080000190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0282000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Launcher.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

powershell.exepowershell.exelydqhty.exeopenwith.exe

pid	process
4972	powershell.exe
4972	powershell.exe
1488	powershell.exe
1488	powershell.exe
6272	lydqhty.exe
6272	lydqhty.exe
7060	openwith.exe
7060	openwith.exe
7060	openwith.exe
7060	openwith.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.exepowershell.execsc.execsc.exe

description	pid	process
Token: SeDebugPrivilege	4972	powershell.exe
Token: SeDebugPrivilege	1488	powershell.exe
Token: SeDebugPrivilege	2280	csc.exe
Token: SeDebugPrivilege	5700	csc.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

winrar.exe

pid process

3448 winrar.exe
3448 winrar.exe
3448 winrar.exe

pid	process
3448	winrar.exe
3448	winrar.exe
3448	winrar.exe

Suspicious use of WriteProcessMemory 60 IoCs

Processes:

Launcher.exeLaunhcer.exepowershell.exeLauncher.exeplugin212cmd.exeplugin212cmd.exelydqhty.exelydqhty.exe

description	pid	process	target process
PID 4540 wrote to memory of 708	4540	Launcher.exe	Launhcer.exe
PID 4540 wrote to memory of 708	4540	Launcher.exe	Launhcer.exe
PID 4540 wrote to memory of 708	4540	Launcher.exe	Launhcer.exe
PID 4540 wrote to memory of 708	4540	Launcher.exe	Launhcer.exe
PID 4540 wrote to memory of 708	4540	Launcher.exe	Launhcer.exe
PID 708 wrote to memory of 4972	708	Launhcer.exe	powershell.exe
PID 708 wrote to memory of 4972	708	Launhcer.exe	powershell.exe
PID 708 wrote to memory of 4972	708	Launhcer.exe	powershell.exe
PID 4972 wrote to memory of 2044	4972	powershell.exe	Launcher.exe
PID 4972 wrote to memory of 2044	4972	powershell.exe	Launcher.exe
PID 4972 wrote to memory of 2044	4972	powershell.exe	Launcher.exe
PID 4972 wrote to memory of 2044	4972	powershell.exe	Launcher.exe
PID 4972 wrote to memory of 2044	4972	powershell.exe	Launcher.exe
PID 2044 wrote to memory of 1488	2044	Launcher.exe	powershell.exe
PID 2044 wrote to memory of 1488	2044	Launcher.exe	powershell.exe
PID 2044 wrote to memory of 1488	2044	Launcher.exe	powershell.exe
PID 2044 wrote to memory of 3448	2044	Launcher.exe	winrar.exe
PID 2044 wrote to memory of 3448	2044	Launcher.exe	winrar.exe
PID 2044 wrote to memory of 3448	2044	Launcher.exe	winrar.exe
PID 2044 wrote to memory of 1712	2044	Launcher.exe	plugin212
PID 2044 wrote to memory of 1712	2044	Launcher.exe	plugin212
PID 2044 wrote to memory of 1712	2044	Launcher.exe	plugin212
PID 2044 wrote to memory of 2024	2044	Launcher.exe	plugin212
PID 2044 wrote to memory of 2024	2044	Launcher.exe	plugin212
PID 2044 wrote to memory of 2024	2044	Launcher.exe	plugin212
PID 1712 wrote to memory of 2280	1712	plugin212	csc.exe
PID 1712 wrote to memory of 2280	1712	plugin212	csc.exe
PID 1712 wrote to memory of 2280	1712	plugin212	csc.exe
PID 1712 wrote to memory of 2280	1712	plugin212	csc.exe
PID 1712 wrote to memory of 2280	1712	plugin212	csc.exe
PID 1712 wrote to memory of 4648	1712	plugin212	cmd.exe
PID 1712 wrote to memory of 4648	1712	plugin212	cmd.exe
PID 1712 wrote to memory of 4648	1712	plugin212	cmd.exe
PID 4648 wrote to memory of 2964	4648	cmd.exe	reg.exe
PID 4648 wrote to memory of 2964	4648	cmd.exe	reg.exe
PID 4648 wrote to memory of 2964	4648	cmd.exe	reg.exe
PID 2044 wrote to memory of 1456	2044	Launcher.exe	cmd.exe
PID 2044 wrote to memory of 1456	2044	Launcher.exe	cmd.exe
PID 2044 wrote to memory of 1456	2044	Launcher.exe	cmd.exe
PID 2024 wrote to memory of 5700	2024	plugin212	csc.exe
PID 2024 wrote to memory of 5700	2024	plugin212	csc.exe
PID 2024 wrote to memory of 5700	2024	plugin212	csc.exe
PID 2024 wrote to memory of 5700	2024	plugin212	csc.exe
PID 2024 wrote to memory of 5700	2024	plugin212	csc.exe
PID 2024 wrote to memory of 5216	2024	plugin212	cmd.exe
PID 2024 wrote to memory of 5216	2024	plugin212	cmd.exe
PID 2024 wrote to memory of 5216	2024	plugin212	cmd.exe
PID 5216 wrote to memory of 4376	5216	cmd.exe	reg.exe
PID 5216 wrote to memory of 4376	5216	cmd.exe	reg.exe
PID 5216 wrote to memory of 4376	5216	cmd.exe	reg.exe
PID 6252 wrote to memory of 6272	6252	lydqhty.exe	lydqhty.exe
PID 6252 wrote to memory of 6272	6252	lydqhty.exe	lydqhty.exe
PID 6252 wrote to memory of 6272	6252	lydqhty.exe	lydqhty.exe
PID 6252 wrote to memory of 6272	6252	lydqhty.exe	lydqhty.exe
PID 6252 wrote to memory of 6272	6252	lydqhty.exe	lydqhty.exe
PID 6272 wrote to memory of 7060	6272	lydqhty.exe	openwith.exe
PID 6272 wrote to memory of 7060	6272	lydqhty.exe	openwith.exe
PID 6272 wrote to memory of 7060	6272	lydqhty.exe	openwith.exe
PID 6272 wrote to memory of 7060	6272	lydqhty.exe	openwith.exe
PID 6272 wrote to memory of 7060	6272	lydqhty.exe	openwith.exe

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2032
- C:\Windows\SysWOW64\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:7060

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Users\Admin\AppData\Roaming\services\Launhcer.exe
  "C:\Users\Admin\AppData\Roaming\services\Launhcer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:708
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "$AdminRightsRequired = $true function Get-Win { while ($true) { # if ($AdminRightsRequired) { # try { Start-Process -FilePath '.\data\Launcher.exe' -Verb RunAs -Wait # break } catch { Write-Host 'Error 0xc0000906' } } else { # break } } } Get-Win"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4972
  - - C:\Users\Admin\AppData\Roaming\services\data\Launcher.exe
      "C:\Users\Admin\AppData\Roaming\services\data\Launcher.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2044
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath $env:ProgramData, $env:AppData, $env:SystemDrive\ "
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1488
    - - C:\Users\Admin\AppData\Roaming\services\winrar.exe
        
        "C:\Users\Admin\AppData\Roaming\services\winrar.exe" x -y -pjryj2023 C:\Users\Admin\AppData\Roaming\services\01 C:\Users\Admin\AppData\Roaming\services
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:3448
    - - C:\Users\Admin\AppData\Roaming\services\plugin212
        
        C:\Users\Admin\AppData\Roaming\services\plugin212
        5⤵
        Suspicious use of SetThreadContext
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1712
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2280
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "CrowdstrikeEngine" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\CiscoUpdater000990.dll",EntryPoint /f & exit
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4648
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "CrowdstrikeEngine" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\CiscoUpdater000990.dll",EntryPoint /f
        7⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2964
    - - C:\Users\Admin\AppData\Roaming\services\plugin212
        
        C:\Users\Admin\AppData\Roaming\services\plugin212
        5⤵
        Suspicious use of SetThreadContext
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2024
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5700
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "CrowdstrikeEngine" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\CiscoUpdater000990.dll",EntryPoint /f & exit
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5216
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "CrowdstrikeEngine" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\CiscoUpdater000990.dll",EntryPoint /f
        7⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:4376
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /K rd /s /q "C:\Users\Admin\AppData\Roaming\services" & EXIT
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1456

C:\Users\Admin\AppData\Local\Temp\lydqhty.exe
C:\Users\Admin\AppData\Local\Temp\lydqhty.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6252
- C:\Users\Admin\AppData\Local\Temp\lydqhty.exe
  "C:\Users\Admin\AppData\Local\Temp\lydqhty.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:6272
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6272 -s 456
    3⤵
    - Program crash
    PID:2084
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6272 -s 488
    3⤵
    - Program crash
    PID:6080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 6272 -ip 6272
1⤵
PID:1552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 6272 -ip 6272
1⤵
PID:1912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dr1mkigz.chm.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\lydqhty.exe

Filesize
2.9MB

MD5
53218d44298f406baefb2fd052eeb0ef

SHA1
afc422b48b829f29ee2cb95eb9d5139b788a1727

SHA256
11892dbe32cebd618deb6dc36477829ef9fb8181d7ec887408f44c08bb5f675b

SHA512
88b81da7e8d3665b0a41cd272c50318b8090dc3240d88020255f079df1373e2cf5fb9f0249320fb7346a52a29d20de42a4385f75e1cf91a12aa40786eae1a12a

Download Submit
C:\Users\Admin\AppData\Roaming\services\01

Filesize
17.3MB

MD5
f701c0f8a76b6495869b27f25483102f

SHA1
11499d073cc91226931eaf50467ab92bd78e2eac

SHA256
f7777723dc4bbf5ca3a5ecc39aca1fd763114a94cd805cddeb1e2a0edf73f738

SHA512
68d4ab1ad7aaf01f6f93f8d69b6bfd3289af63975759424db095447faafb1878ac7008228222d699652e0dcba5668ac5a7713600f8f98683536fb02979899a03

Download Submit
C:\Users\Admin\AppData\Roaming\services\Launhcer.dll

Filesize
2KB

MD5
7de0541eb96ba31067b4c58d9399693b

SHA1
a105216391bd53fa0c8f6aa23953030d0c0f9244

SHA256
934f75c8443d6379abdc380477a87ef6531d0429de8d8f31cd6b62f55a978f6e

SHA512
e5ffa3bfd19b4d69c8b4db0aabaf835810b8b8cccd7bc400c7ba90ef5f5ebd745c2619c9a3e83aa6b628d9cf765510c471a2ff8cb6aa5ad4cf3f7826f6ae84a3

Download Submit
C:\Users\Admin\AppData\Roaming\services\Launhcer.exe

Filesize
364KB

MD5
e5c00b0bc45281666afd14eef04252b2

SHA1
3b6eecf8250e88169976a5f866d15c60ee66b758

SHA256
542e2ebbded3ef0c43551fb56ce44d4dbb36a507c2a801c0815c79d9f5e0f903

SHA512
2bacd4e1c584565dfd5e06e492b0122860bfc3b0cc1543e6baded490535309834e0d5bb760f65dbfb19a9bb0beddb27a216c605bbed828810a480c8cd1fba387

Download Submit
C:\Users\Admin\AppData\Roaming\services\Launhcer.exe.manifest

Filesize
1KB

MD5
f0fc065f7fd974b42093594a58a4baef

SHA1
dbf28dd15d4aa338014c9e508a880e893c548d00

SHA256
d6e1c130f3c31258b4f6ff2e5d67bb838b65281af397a11d7eb35a7313993693

SHA512
8bd26de4f9b8e7b6fe9c42f44b548121d033f27272f1da4c340f81aa5642adc17bb9b092ece12bb8515460b9c432bf3b3b7b70f87d4beb6c491d3d0dfb5b71fe

Download Submit
C:\Users\Admin\AppData\Roaming\services\MSIMG32.dll

Filesize
4.2MB

MD5
b3b7a5388c55fd645e91a30918df4f3b

SHA1
6fe74711770bdecf45032369fcbb472155dcc020

SHA256
20007eeee7714925edf27094d9109025fdebaac26e1dbf97d51e8917276b6d3a

SHA512
409fcbd6031999d909eba71ba066e54bd6d72dc475a69f4586c3083184d37323916f4178987648a466a3ec0704c88b15bead0a7a2192d1aa2eb6c56b01e82db2

Download Submit
C:\Users\Admin\AppData\Roaming\services\data\Launcher.dll

Filesize
4KB

MD5
81c37a299ffaca00d04ba285c11fbef4

SHA1
a48a395894d9c9f64a8c6b7bb614b23554dc2de7

SHA256
55376b4b920acc1ccf1971e51e855d059eb65c7e684d49d0142d01937ae97d8d

SHA512
60ed30599986e6b4e923e765ff2518b3467276897382bdd0699513a36e005c2e9c73f0067153f39a5189f3e0ca39fbd0b41f73d9dc014b464bb7d759957edff3

Download Submit
C:\Users\Admin\AppData\Roaming\services\data\Launcher.exe

Filesize
364KB

MD5
93fde4e38a84c83af842f73b176ab8dc

SHA1
e8c55cc160a0a94e404f544b22e38511b9d71da8

SHA256
fb07af2aead3bdf360f555fc872191e43c2f0acbfc9258435f9a30afe272ba03

SHA512
48720aebe2158b8a58fc3431c2e6f68271fbade51303ad9cb5b0493efaec6053ff0c19a898841ef7c57a3c4d042ac8e7157fb3dc79593c1dfcdcf88e1469fdec

Download Submit
C:\Users\Admin\AppData\Roaming\services\data\Launcher.exe.manifest

Filesize
1KB

MD5
1b6de83d3f1ccabf195a98a2972c366a

SHA1
09f03658306c4078b75fa648d763df9cddd62f23

SHA256
e20486518d09caf6778ed0d60aab51bb3c8b1a498fd4ede3c238ee1823676724

SHA512
e171a7f2431cfe0d3dfbd73e6ea0fc9bd3e5efefc1fbdeff517f74b9d78679913c4a60c57dde75e4a605c288bc2b87b9bb54b0532e67758dfb4a2ac8aea440ce

Download Submit
C:\Users\Admin\AppData\Roaming\services\plugin212

Filesize
18.1MB

MD5
4f5749c5873c8fc08145afc910cd0fa8

SHA1
12475f59bc767dba061bb7b0f1d2441b9aa1e334

SHA256
a5ed9d1efd8d56351b20468844562e1004658c40d6b3c1c021752cfa4599e1b2

SHA512
b1b4d8537828a3d5e4c5f64e232d71fdc6dfbd969937587ea9e7686fc293382e24f4118d535ee6eb98d8578f3f68e30210ec9c73f05de0513f504665b6bcd388

Download Submit
C:\Users\Admin\AppData\Roaming\services\winrar.exe

Filesize
2.1MB

MD5
f59f4f7bea12dd7c8d44f0a717c21c8e

SHA1
17629ccb3bd555b72a4432876145707613100b3e

SHA256
f150b01c1cbc540c880dc00d812bcca1a8abe1166233227d621408f3e75b57d4

SHA512
44811f9a5f2917ccd56a7f894157fa305b749ca04903eeaeca493864742e459e0ce640c01c804c266283ce8c3e147c8e6b6cfd6c5cb717e2a374e92c32a63b2c

Download Submit
memory/1488-79-0x00000000076D0000-0x00000000076DE000-memory.dmp

Filesize
56KB

Download
memory/1488-75-0x0000000007510000-0x000000000751A000-memory.dmp

Filesize
40KB

Download
memory/1488-72-0x0000000007AD0000-0x000000000814A000-memory.dmp

Filesize
6.5MB

Download
memory/1488-71-0x0000000007360000-0x0000000007404000-memory.dmp

Filesize
656KB

Download
memory/1488-61-0x000000006F480000-0x000000006F4CC000-memory.dmp

Filesize
304KB

Download
memory/1488-70-0x00000000070E0000-0x00000000070FE000-memory.dmp

Filesize
120KB

Download
memory/1488-76-0x0000000007690000-0x00000000076A1000-memory.dmp

Filesize
68KB

Download
memory/1488-82-0x0000000007710000-0x0000000007718000-memory.dmp

Filesize
32KB

Download
memory/1488-80-0x00000000076E0000-0x00000000076F5000-memory.dmp

Filesize
84KB

Download
memory/1488-81-0x0000000007720000-0x000000000773A000-memory.dmp

Filesize
104KB

Download
memory/1488-60-0x0000000007120000-0x0000000007154000-memory.dmp

Filesize
208KB

Download
memory/1712-98-0x0000000010000000-0x000000001045A000-memory.dmp

Filesize
4.4MB

Download
memory/1712-100-0x0000000010000000-0x000000001045A000-memory.dmp

Filesize
4.4MB

Download
memory/1712-96-0x0000000010000000-0x000000001045A000-memory.dmp

Filesize
4.4MB

Download
memory/1712-97-0x0000000010000000-0x000000001045A000-memory.dmp

Filesize
4.4MB

Download
memory/1712-103-0x0000000010000000-0x000000001045A000-memory.dmp

Filesize
4.4MB

Download
memory/1712-104-0x0000000010000000-0x000000001045A000-memory.dmp

Filesize
4.4MB

Download
memory/2280-114-0x0000000005160000-0x000000000522F000-memory.dmp

Filesize
828KB

Download
memory/2280-112-0x0000000005160000-0x000000000522F000-memory.dmp

Filesize
828KB

Download
memory/2280-138-0x0000000005160000-0x000000000522F000-memory.dmp

Filesize
828KB

Download
memory/2280-4045-0x0000000005AD0000-0x0000000005B24000-memory.dmp

Filesize
336KB

Download
memory/2280-4043-0x0000000005330000-0x0000000005386000-memory.dmp

Filesize
344KB

Download
memory/2280-4044-0x0000000005230000-0x000000000527C000-memory.dmp

Filesize
304KB

Download
memory/2280-140-0x0000000005160000-0x000000000522F000-memory.dmp

Filesize
828KB

Download
memory/2280-106-0x0000000005160000-0x0000000005234000-memory.dmp

Filesize
848KB

Download
memory/2280-107-0x0000000005160000-0x000000000522F000-memory.dmp

Filesize
828KB

Download
memory/2280-108-0x0000000005160000-0x000000000522F000-memory.dmp

Filesize
828KB

Download
memory/2280-110-0x0000000005160000-0x000000000522F000-memory.dmp

Filesize
828KB

Download
memory/2280-116-0x0000000005160000-0x000000000522F000-memory.dmp

Filesize
828KB

Download
memory/2280-148-0x0000000005160000-0x000000000522F000-memory.dmp

Filesize
828KB

Download
memory/2280-102-0x0000000000350000-0x00000000003F4000-memory.dmp

Filesize
656KB

Download
memory/2280-124-0x0000000005160000-0x000000000522F000-memory.dmp

Filesize
828KB

Download
memory/2280-128-0x0000000005160000-0x000000000522F000-memory.dmp

Filesize
828KB

Download
memory/2280-160-0x0000000005160000-0x000000000522F000-memory.dmp

Filesize
828KB

Download
memory/2280-158-0x0000000005160000-0x000000000522F000-memory.dmp

Filesize
828KB

Download
memory/2280-142-0x0000000005160000-0x000000000522F000-memory.dmp

Filesize
828KB

Download
memory/2280-154-0x0000000005160000-0x000000000522F000-memory.dmp

Filesize
828KB

Download
memory/2280-152-0x0000000005160000-0x000000000522F000-memory.dmp

Filesize
828KB

Download
memory/2280-150-0x0000000005160000-0x000000000522F000-memory.dmp

Filesize
828KB

Download
memory/2280-146-0x0000000005160000-0x000000000522F000-memory.dmp

Filesize
828KB

Download
memory/2280-144-0x0000000005160000-0x000000000522F000-memory.dmp

Filesize
828KB

Download
memory/2280-156-0x0000000005160000-0x000000000522F000-memory.dmp

Filesize
828KB

Download
memory/2280-118-0x0000000005160000-0x000000000522F000-memory.dmp

Filesize
828KB

Download
memory/2280-120-0x0000000005160000-0x000000000522F000-memory.dmp

Filesize
828KB

Download
memory/2280-136-0x0000000005160000-0x000000000522F000-memory.dmp

Filesize
828KB

Download
memory/2280-134-0x0000000005160000-0x000000000522F000-memory.dmp

Filesize
828KB

Download
memory/2280-132-0x0000000005160000-0x000000000522F000-memory.dmp

Filesize
828KB

Download
memory/2280-130-0x0000000005160000-0x000000000522F000-memory.dmp

Filesize
828KB

Download
memory/2280-126-0x0000000005160000-0x000000000522F000-memory.dmp

Filesize
828KB

Download
memory/2280-122-0x0000000005160000-0x000000000522F000-memory.dmp

Filesize
828KB

Download
memory/4972-22-0x0000000072A0E000-0x0000000072A0F000-memory.dmp

Filesize
4KB

Download
memory/4972-39-0x0000000006810000-0x000000000685C000-memory.dmp

Filesize
304KB

Download
memory/4972-40-0x0000000007780000-0x0000000007816000-memory.dmp

Filesize
600KB

Download
memory/4972-90-0x0000000072A0E000-0x0000000072A0F000-memory.dmp

Filesize
4KB

Download
memory/4972-43-0x0000000007E40000-0x00000000083E6000-memory.dmp

Filesize
5.6MB

Download
memory/4972-37-0x00000000062D0000-0x0000000006627000-memory.dmp

Filesize
3.3MB

Download
memory/4972-38-0x00000000067C0000-0x00000000067DE000-memory.dmp

Filesize
120KB

Download
memory/4972-25-0x0000000005A50000-0x000000000607A000-memory.dmp

Filesize
6.2MB

Download
memory/4972-91-0x0000000072A00000-0x00000000731B1000-memory.dmp

Filesize
7.7MB

Download
memory/4972-92-0x0000000072A00000-0x00000000731B1000-memory.dmp

Filesize
7.7MB

Download
memory/4972-23-0x0000000002FF0000-0x0000000003026000-memory.dmp

Filesize
216KB

Download
memory/4972-41-0x0000000006CF0000-0x0000000006D0A000-memory.dmp

Filesize
104KB

Download
memory/4972-42-0x0000000006D40000-0x0000000006D62000-memory.dmp

Filesize
136KB

Download
memory/4972-24-0x0000000072A00000-0x00000000731B1000-memory.dmp

Filesize
7.7MB

Download
memory/4972-26-0x0000000005A20000-0x0000000005A42000-memory.dmp

Filesize
136KB

Download
memory/4972-27-0x00000000061F0000-0x0000000006256000-memory.dmp

Filesize
408KB

Download
memory/4972-28-0x0000000006260000-0x00000000062C6000-memory.dmp

Filesize
408KB

Download
memory/5700-4059-0x0000000000A30000-0x0000000000AD4000-memory.dmp

Filesize
656KB

Download