Analysis Overview
SHA256
48ede0e3a4e2b696205f639bb5f826825d83f587c5b86d5b6fea31ef5ae4e1dc
Threat Level: Known bad
The file taskexec323Ewe.zip was found to be: Known bad.
Malicious Activity Summary
Rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess
Loads dropped DLL
Executes dropped EXE
Suspicious use of SetThreadContext
System Location Discovery: System Language Discovery
Unsigned PE
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious behavior: MapViewOfSection
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-10-20 23:43
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-10-20 23:43
Reported
2024-10-20 23:49
Platform
win10v2004-20241007-en
Max time kernel
278s
Max time network
285s
Command Line
Signatures
Rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess
| Description | Indicator | Process | Target |
| PID 2316 created 2696 | N/A | C:\Windows\SysWOW64\explorer.exe | C:\Windows\system32\sihost.exe |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\ProgramData\downloaddemo_test\msn.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\ProgramData\downloaddemo_test\msn.exe | N/A |
| N/A | N/A | C:\ProgramData\downloaddemo_test\msn.exe | N/A |
| N/A | N/A | C:\ProgramData\downloaddemo_test\msn.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2468 set thread context of 1736 | N/A | C:\ProgramData\downloaddemo_test\msn.exe | C:\Windows\SysWOW64\cmd.exe |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\openwith.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\msn.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\ProgramData\downloaddemo_test\msn.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\explorer.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\msn.exe | N/A |
| N/A | N/A | C:\ProgramData\downloaddemo_test\msn.exe | N/A |
| N/A | N/A | C:\ProgramData\downloaddemo_test\msn.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\explorer.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\explorer.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\openwith.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\openwith.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\openwith.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\openwith.exe | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\ProgramData\downloaddemo_test\msn.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Windows\system32\sihost.exe
sihost.exe
C:\Users\Admin\AppData\Local\Temp\msn.exe
"C:\Users\Admin\AppData\Local\Temp\msn.exe"
C:\ProgramData\downloaddemo_test\msn.exe
C:\ProgramData\downloaddemo_test\msn.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.58.199.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.163.245.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 83.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 10.28.171.150.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.173.189.20.in-addr.arpa | udp |
Files
memory/4932-0-0x0000000074470000-0x00000000745EB000-memory.dmp
memory/4932-1-0x00007FFF53130000-0x00007FFF53325000-memory.dmp
C:\ProgramData\downloaddemo_test\msn.exe
| MD5 | 537915708fe4e81e18e99d5104b353ed |
| SHA1 | 128ddb7096e5b748c72dc13f55b593d8d20aa3fb |
| SHA256 | 6dc7275f2143d1de0ca66c487b0f2ebff3d4c6a79684f03b9619bf23143ecf74 |
| SHA512 | 9ceaaf7aa5889be9f5606646403133782d004b9d78ef83d7007dfce67c0f4f688d7931aebc74f1fc30aac2f1dd6281bdadfb52bc3ea46aca33b334adb4067ae2 |
C:\ProgramData\downloaddemo_test\msidcrl40.dll
| MD5 | f1f8d156bbdd5945a4f933ac7fa7cc41 |
| SHA1 | e581235e9f1a3a8a63b8a470eaed882bc93b9085 |
| SHA256 | 344ac8e5debb1a496c3648f941801cdc6ffdfcc7eef8ed38e62270a2e20b1c3a |
| SHA512 | 86d799af3be251edecf6a552f473b94a0ba2d738b7b5f4a84c31bb34db4ea458f5e50090370bdf82f945e684dd5d66b88ebe3c902305bb0a435aca1331cb4ad9 |
C:\ProgramData\downloaddemo_test\contactsUX.dll
| MD5 | 54ee6a204238313dc6aca21c7e036c17 |
| SHA1 | 531fd1c18e2e4984c72334eb56af78a1048da6c7 |
| SHA256 | 0abf68b8409046a1555d48ac506fd26fda4b29d8d61e07bc412a4e21de2782fd |
| SHA512 | 19a2e371712aab54b75059d39a9aea6e7de2eb69b3ffc0332e60df617ebb9de61571b2ca722cddb75c9cbc79f8200d03f73539f21f69366eae3c7641731c7820 |
C:\ProgramData\downloaddemo_test\msncore.dll
| MD5 | deaa38a71c85d2f9d4ba71343d1603da |
| SHA1 | bdbb492512cee480794e761d1bea718db14013ec |
| SHA256 | 1dc120f34b294e964eee949c4d1ebd9c271715d46b38ae082fec2f1d505e8d65 |
| SHA512 | 87b152b642a020e07ad46e9ed5b4a462c12cf0918f82025c230f662eddb3bf4b2d3aa15ca770970beae5988dd5d5d9b7bcaf7a77c6d2f3acf6d12826f3a9ead7 |
C:\ProgramData\downloaddemo_test\gld
| MD5 | 06a62106f0d01ed3a971415b57366a8b |
| SHA1 | 9d905a38a4f53961a3828b2f759062b428dd25a9 |
| SHA256 | 6c5fb0f5e586cac39cf4e06e918dad243053cb103a82afeed32d92732834cc93 |
| SHA512 | 4565dfe2e72a4a08d2a66722cb3ab736a2fa45f0c0ad368805d778f57f3bade2c82b2f8eab3006e4258cf5be84e96a46233e68be4d14fec50382cd94c13a4d74 |
C:\ProgramData\downloaddemo_test\bqbr
| MD5 | 0180c5a2f5b002e8755c60a3786c4975 |
| SHA1 | 64bcbe91e3dd1dcd21709cbf189c032bb47501a2 |
| SHA256 | 6eff0ca0c63ce6c712dc5f1f892b68d43894d13b681f75ab585b6c611dc16476 |
| SHA512 | 8dbdfef7906be474ecadb7848042f3736483ef9b4ea05f4f60a3ae049a99bf1a8bcd57507b334e229c972784b6355b9dcf647c5992e56518a35d9ff0d639e1ff |
memory/2468-20-0x0000000074470000-0x00000000745EB000-memory.dmp
memory/2468-21-0x00007FFF53130000-0x00007FFF53325000-memory.dmp
memory/2468-23-0x0000000074470000-0x00000000745EB000-memory.dmp
memory/2468-22-0x0000000074483000-0x0000000074485000-memory.dmp
memory/2468-24-0x0000000074470000-0x00000000745EB000-memory.dmp
memory/1736-26-0x0000000074470000-0x00000000745EB000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\26f9bc40
| MD5 | 4789c3f75a32f8f49fbff3dec6c395b1 |
| SHA1 | a40516bad94caaa6201bf6dd6b0f99fed2475e2d |
| SHA256 | f779df1a499c86a3b644d3dcf1a6a8e56b5a481f16e14ff9da6287f09adb2e9b |
| SHA512 | 1b218e36a3d81fca9874e1ac2abfc3bab1274569c01cb221eaab3b8953302e7a00af04ca85c0b0d66103db59e8dd85d833aa36241ebae57b6ebfa883ce407a41 |
memory/1736-29-0x0000000074470000-0x00000000745EB000-memory.dmp
memory/1736-28-0x00007FFF53130000-0x00007FFF53325000-memory.dmp
memory/1736-30-0x0000000074470000-0x00000000745EB000-memory.dmp
memory/1736-32-0x0000000074470000-0x00000000745EB000-memory.dmp
memory/1736-33-0x0000000074470000-0x00000000745EB000-memory.dmp
memory/1736-35-0x0000000074470000-0x00000000745EB000-memory.dmp
memory/2316-36-0x00000000007D0000-0x0000000000850000-memory.dmp
memory/2316-37-0x00007FFF53130000-0x00007FFF53325000-memory.dmp
memory/2316-38-0x00000000007D0000-0x0000000000850000-memory.dmp
memory/2316-40-0x00000000043C0000-0x00000000047C0000-memory.dmp
memory/2316-41-0x00000000007D0000-0x0000000000850000-memory.dmp
memory/2316-42-0x00000000043C0000-0x00000000047C0000-memory.dmp
memory/2316-45-0x00000000756F0000-0x0000000075905000-memory.dmp
memory/1924-46-0x00000000001F0000-0x00000000001F9000-memory.dmp
memory/1924-48-0x0000000002050000-0x0000000002450000-memory.dmp
memory/1924-51-0x00000000756F0000-0x0000000075905000-memory.dmp
memory/2316-53-0x00000000007D0000-0x0000000000850000-memory.dmp
memory/1924-49-0x00007FFF53130000-0x00007FFF53325000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-10-20 23:43
Reported
2024-10-20 23:49
Platform
win11-20241007-en
Max time kernel
92s
Max time network
202s
Command Line
Signatures
Rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess
| Description | Indicator | Process | Target |
| PID 5048 created 2904 | N/A | C:\Windows\SysWOW64\explorer.exe | C:\Windows\system32\sihost.exe |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\ProgramData\downloaddemo_test\msn.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\ProgramData\downloaddemo_test\msn.exe | N/A |
| N/A | N/A | C:\ProgramData\downloaddemo_test\msn.exe | N/A |
| N/A | N/A | C:\ProgramData\downloaddemo_test\msn.exe | N/A |
| N/A | N/A | C:\ProgramData\downloaddemo_test\msn.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2672 set thread context of 1392 | N/A | C:\ProgramData\downloaddemo_test\msn.exe | C:\Windows\SysWOW64\cmd.exe |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\ProgramData\downloaddemo_test\msn.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\openwith.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\msn.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\msn.exe | N/A |
| N/A | N/A | C:\ProgramData\downloaddemo_test\msn.exe | N/A |
| N/A | N/A | C:\ProgramData\downloaddemo_test\msn.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\explorer.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\explorer.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\openwith.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\openwith.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\openwith.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\openwith.exe | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\ProgramData\downloaddemo_test\msn.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Windows\system32\sihost.exe
sihost.exe
C:\Users\Admin\AppData\Local\Temp\msn.exe
"C:\Users\Admin\AppData\Local\Temp\msn.exe"
C:\ProgramData\downloaddemo_test\msn.exe
C:\ProgramData\downloaddemo_test\msn.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
Files
memory/2708-0-0x0000000073E30000-0x0000000073FAD000-memory.dmp
memory/2708-1-0x00007FFDD0DA0000-0x00007FFDD0FA9000-memory.dmp
C:\ProgramData\downloaddemo_test\msn.exe
| MD5 | 537915708fe4e81e18e99d5104b353ed |
| SHA1 | 128ddb7096e5b748c72dc13f55b593d8d20aa3fb |
| SHA256 | 6dc7275f2143d1de0ca66c487b0f2ebff3d4c6a79684f03b9619bf23143ecf74 |
| SHA512 | 9ceaaf7aa5889be9f5606646403133782d004b9d78ef83d7007dfce67c0f4f688d7931aebc74f1fc30aac2f1dd6281bdadfb52bc3ea46aca33b334adb4067ae2 |
C:\ProgramData\downloaddemo_test\msidcrl40.dll
| MD5 | f1f8d156bbdd5945a4f933ac7fa7cc41 |
| SHA1 | e581235e9f1a3a8a63b8a470eaed882bc93b9085 |
| SHA256 | 344ac8e5debb1a496c3648f941801cdc6ffdfcc7eef8ed38e62270a2e20b1c3a |
| SHA512 | 86d799af3be251edecf6a552f473b94a0ba2d738b7b5f4a84c31bb34db4ea458f5e50090370bdf82f945e684dd5d66b88ebe3c902305bb0a435aca1331cb4ad9 |
C:\ProgramData\downloaddemo_test\contactsUX.dll
| MD5 | 54ee6a204238313dc6aca21c7e036c17 |
| SHA1 | 531fd1c18e2e4984c72334eb56af78a1048da6c7 |
| SHA256 | 0abf68b8409046a1555d48ac506fd26fda4b29d8d61e07bc412a4e21de2782fd |
| SHA512 | 19a2e371712aab54b75059d39a9aea6e7de2eb69b3ffc0332e60df617ebb9de61571b2ca722cddb75c9cbc79f8200d03f73539f21f69366eae3c7641731c7820 |
C:\ProgramData\downloaddemo_test\gld
| MD5 | 06a62106f0d01ed3a971415b57366a8b |
| SHA1 | 9d905a38a4f53961a3828b2f759062b428dd25a9 |
| SHA256 | 6c5fb0f5e586cac39cf4e06e918dad243053cb103a82afeed32d92732834cc93 |
| SHA512 | 4565dfe2e72a4a08d2a66722cb3ab736a2fa45f0c0ad368805d778f57f3bade2c82b2f8eab3006e4258cf5be84e96a46233e68be4d14fec50382cd94c13a4d74 |
memory/2672-21-0x0000000073E30000-0x0000000073FAD000-memory.dmp
C:\ProgramData\downloaddemo_test\bqbr
| MD5 | 0180c5a2f5b002e8755c60a3786c4975 |
| SHA1 | 64bcbe91e3dd1dcd21709cbf189c032bb47501a2 |
| SHA256 | 6eff0ca0c63ce6c712dc5f1f892b68d43894d13b681f75ab585b6c611dc16476 |
| SHA512 | 8dbdfef7906be474ecadb7848042f3736483ef9b4ea05f4f60a3ae049a99bf1a8bcd57507b334e229c972784b6355b9dcf647c5992e56518a35d9ff0d639e1ff |
C:\ProgramData\downloaddemo_test\msncore.dll
| MD5 | deaa38a71c85d2f9d4ba71343d1603da |
| SHA1 | bdbb492512cee480794e761d1bea718db14013ec |
| SHA256 | 1dc120f34b294e964eee949c4d1ebd9c271715d46b38ae082fec2f1d505e8d65 |
| SHA512 | 87b152b642a020e07ad46e9ed5b4a462c12cf0918f82025c230f662eddb3bf4b2d3aa15ca770970beae5988dd5d5d9b7bcaf7a77c6d2f3acf6d12826f3a9ead7 |
memory/2672-22-0x00007FFDD0DA0000-0x00007FFDD0FA9000-memory.dmp
memory/2672-23-0x0000000073E43000-0x0000000073E45000-memory.dmp
memory/2672-24-0x0000000073E30000-0x0000000073FAD000-memory.dmp
memory/2672-25-0x0000000073E30000-0x0000000073FAD000-memory.dmp
memory/1392-27-0x0000000073E30000-0x0000000073FAD000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\f4dd73ef
| MD5 | a88065a131d9fc31922d788f7a996e89 |
| SHA1 | 534f1bcad5424d2c09c92e933fb58916348dc0d1 |
| SHA256 | c97986cf86da26260e8dc290f86e032fe5c0516263c0082b35f7bd103bf15d07 |
| SHA512 | 344a0f9373c199dacf9d2f2ca0b8fab9e4826c2b6d8e0c4900ef55e99cfd1deec95306a78137877c6f1727569963f014ff7d887e31a53e3d2d8342e23e7f134f |
memory/1392-29-0x00007FFDD0DA0000-0x00007FFDD0FA9000-memory.dmp
memory/1392-30-0x0000000073E30000-0x0000000073FAD000-memory.dmp
memory/1392-32-0x0000000073E30000-0x0000000073FAD000-memory.dmp
memory/5048-34-0x0000000000270000-0x00000000002F0000-memory.dmp
memory/5048-35-0x00007FFDD0DA0000-0x00007FFDD0FA9000-memory.dmp
memory/5048-36-0x0000000000270000-0x00000000002F0000-memory.dmp
memory/5048-38-0x0000000000270000-0x00000000002F0000-memory.dmp
memory/5048-39-0x00000000041F0000-0x00000000045F0000-memory.dmp
memory/5048-40-0x00000000041F0000-0x00000000045F0000-memory.dmp
memory/5048-43-0x00000000762E0000-0x0000000076532000-memory.dmp
memory/3140-44-0x0000000000900000-0x0000000000909000-memory.dmp
memory/3140-48-0x0000000002820000-0x0000000002C20000-memory.dmp
memory/5048-47-0x0000000000270000-0x00000000002F0000-memory.dmp
memory/3140-49-0x00007FFDD0DA0000-0x00007FFDD0FA9000-memory.dmp
memory/3140-51-0x00000000762E0000-0x0000000076532000-memory.dmp
memory/1392-52-0x0000000073E30000-0x0000000073FAD000-memory.dmp