rhadamanthys | 88cb7c954db8b07a3c50405f106a13327811a476b8640b8c04a2b2952fcee84d

Resubmissions

07-10-2024 17:00

241007-vjaydszgnk 10

07-10-2024 16:55

241007-vfa4zsthjf 1

07-10-2024 16:31

241007-t1gxlatfrf 1

07-10-2024 16:22

241007-tvn4qazeqr 10

Analysis

max time kernel
198s
max time network
205s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-10-2024 16:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

rhada_pwsh.txt
Size

472KB
MD5

499f45aaf086179501deec2015d2f13c
SHA1

a8f8fd84721a4ed88f70c3680970a99c53c5eddc
SHA256

88cb7c954db8b07a3c50405f106a13327811a476b8640b8c04a2b2952fcee84d
SHA512

b8866b50a53e6983c79806b5a3c8e114654b7511ddafdf1eac582ae86695a2fbcb9fa1f5500b8e6cb98cd898a469daf14586a9fc76075865d9d3477c9791158c
SSDEEP

12288:1CQgw6wrf68klS1+t/WPwqwp1pQbQFtw1nT3DCOLZLtomL:1C/w6we8qY3wTpQmtEnT3DVjZ

Score

10^/10

rhadamanthys execution stealer

Malware Config

Extracted

Family

rhadamanthys

https://indscpm.xyz/bbb76d0e13310f0/b91e92i9.75aq5

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

Processes:

powershell.exe

pid	Process
1388	powershell.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

Processes:

NOTEPAD.EXE

pid	Process
4252	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid	Process
1896	powershell.exe
1896	powershell.exe
1388	powershell.exe
1636	powershell.exe
2376	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

description	pid	Process
Token: SeDebugPrivilege	1896	powershell.exe
Token: SeDebugPrivilege	1388	powershell.exe
Token: SeDebugPrivilege	1636	powershell.exe
Token: SeDebugPrivilege	2376	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

powershell.exe

description	pid	Process	procid_target
PID 1896 wrote to memory of 1388	1896	powershell.exe	90
PID 1896 wrote to memory of 1388	1896	powershell.exe	90
PID 1896 wrote to memory of 1636	1896	powershell.exe	91
PID 1896 wrote to memory of 1636	1896	powershell.exe	91
PID 1896 wrote to memory of 2376	1896	powershell.exe	92
PID 1896 wrote to memory of 2376	1896	powershell.exe	92

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\rhada_pwsh.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4252

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1404

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -file .\rhada_pwsh.txt
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -c
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1636
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -c
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
64B

MD5
446dd1cf97eaba21cf14d03aebc79f27

SHA1
36e4cc7367e0c7b40f4a8ace272941ea46373799

SHA256
a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

SHA512
a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_w3ibhfkc.pb4.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1896-7-0x00000263753F0000-0x0000026375412000-memory.dmp

Filesize
136KB

Download
memory/1896-12-0x0000026377B90000-0x0000026377BD4000-memory.dmp

Filesize
272KB

Download
memory/1896-13-0x0000026377C60000-0x0000026377CD6000-memory.dmp

Filesize
472KB

Download
memory/1896-15-0x00000263756A0000-0x00000263756BE000-memory.dmp

Filesize
120KB

Download
memory/1896-21-0x0000026377BE0000-0x0000026377C3E000-memory.dmp

Filesize
376KB

Download