Analysis
-
max time kernel
93s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-12-2024 02:53
Behavioral task
behavioral1
Sample
6a45de9005c3af696b8b4e9493b51ffdd7fe815acdd9dc3afc52401f612ae630.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
6a45de9005c3af696b8b4e9493b51ffdd7fe815acdd9dc3afc52401f612ae630.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
⌚/maaxx.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
⌚/maaxx.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
⌚/withrobot.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
⌚/withrobot.exe
Resource
win10v2004-20241007-en
General
-
Target
6a45de9005c3af696b8b4e9493b51ffdd7fe815acdd9dc3afc52401f612ae630.exe
-
Size
13.8MB
-
MD5
371e947f5d28b083c86a5db933d392a0
-
SHA1
0855077258e3377f4af707ab0e33818799187234
-
SHA256
6a45de9005c3af696b8b4e9493b51ffdd7fe815acdd9dc3afc52401f612ae630
-
SHA512
9fafbaecdbdff56484e189fcec575e2a23c38b8054ed5d8206982b9b8650f5bbec2990e710a29a1134a53c060a2c2cd85b3fba6fac718c5bb213a7cea9403184
-
SSDEEP
393216:cSXdOirfXtcAxWCigfnjhxqFEzHVNuXvufFJi0+0mxIMLvVFJeEMQbJAQdZ:cyLrfXtZxWLAjPqGzVNGu6xPSmVFJDMa
Malware Config
Extracted
rhadamanthys
https://83.217.208.134/9fcc2685c3ccafd/mau3oarl.3v7qf
Signatures
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Rhadamanthys family
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 1660 created 2580 1660 maaxx.exe 43 -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 884 powershell.exe -
Creates new service(s) 2 TTPs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation 6a45de9005c3af696b8b4e9493b51ffdd7fe815acdd9dc3afc52401f612ae630.exe -
Executes dropped EXE 2 IoCs
pid Process 1660 maaxx.exe 2052 withrobot.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\MRT.exe withrobot.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 660 sc.exe 1512 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6a45de9005c3af696b8b4e9493b51ffdd7fe815acdd9dc3afc52401f612ae630.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language maaxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openwith.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 6a45de9005c3af696b8b4e9493b51ffdd7fe815acdd9dc3afc52401f612ae630.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1660 maaxx.exe 1660 maaxx.exe 3348 openwith.exe 3348 openwith.exe 3348 openwith.exe 3348 openwith.exe 2052 withrobot.exe 2052 withrobot.exe 2052 withrobot.exe 884 powershell.exe 884 powershell.exe 2052 withrobot.exe 2052 withrobot.exe 2052 withrobot.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 884 powershell.exe Token: SeDebugPrivilege 2052 withrobot.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3208 wrote to memory of 1660 3208 6a45de9005c3af696b8b4e9493b51ffdd7fe815acdd9dc3afc52401f612ae630.exe 82 PID 3208 wrote to memory of 1660 3208 6a45de9005c3af696b8b4e9493b51ffdd7fe815acdd9dc3afc52401f612ae630.exe 82 PID 3208 wrote to memory of 1660 3208 6a45de9005c3af696b8b4e9493b51ffdd7fe815acdd9dc3afc52401f612ae630.exe 82 PID 3208 wrote to memory of 2052 3208 6a45de9005c3af696b8b4e9493b51ffdd7fe815acdd9dc3afc52401f612ae630.exe 83 PID 3208 wrote to memory of 2052 3208 6a45de9005c3af696b8b4e9493b51ffdd7fe815acdd9dc3afc52401f612ae630.exe 83 PID 1660 wrote to memory of 3348 1660 maaxx.exe 84 PID 1660 wrote to memory of 3348 1660 maaxx.exe 84 PID 1660 wrote to memory of 3348 1660 maaxx.exe 84 PID 1660 wrote to memory of 3348 1660 maaxx.exe 84 PID 1660 wrote to memory of 3348 1660 maaxx.exe 84 PID 3428 wrote to memory of 2688 3428 cmd.exe 98 PID 3428 wrote to memory of 2688 3428 cmd.exe 98
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2580
-
C:\Windows\SysWOW64\openwith.exe"C:\Windows\system32\openwith.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3348
-
-
C:\Users\Admin\AppData\Local\Temp\6a45de9005c3af696b8b4e9493b51ffdd7fe815acdd9dc3afc52401f612ae630.exe"C:\Users\Admin\AppData\Local\Temp\6a45de9005c3af696b8b4e9493b51ffdd7fe815acdd9dc3afc52401f612ae630.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Users\Admin\AppData\Roaming\maaxx.exe"C:\Users\Admin\AppData\Roaming\maaxx.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1660
-
-
C:\Users\Admin\AppData\Roaming\withrobot.exe"C:\Users\Admin\AppData\Roaming\withrobot.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2052 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:884
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart3⤵
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart4⤵PID:2688
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "RuntimeBroker"3⤵
- Launches sc.exe
PID:660
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "RuntimeBroker" binpath= "C:\ProgramData\RuntimeBroker.exe" start= "auto"3⤵
- Launches sc.exe
PID:1512
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
423KB
MD5b06511bb7fd960041b3feed3eb41ba10
SHA183eae46ba9f85fa7380411aff1745d6476fad1c9
SHA256e74aeaf93a550857cbf3d1fe9d13c420919c4d92ea9c7b2e0ce580ae8057955f
SHA512ad6c1c4bdb45db4baafc3fa3c49d998a8b8adf70a4a71b3739fe890fdc4c47c3f2cfc9bb97049492177a07e8a025405b78990283f27df9136cf35e0f56f31030
-
Filesize
14.8MB
MD502071fe1b9c8d6ade8dafa0a71600503
SHA15b547e72386e43c291bceea5b7d0e8f51469cd3c
SHA25600c32e90c14f9c866a30256c8499e753397c7385e4a3fbcdc86515b9ee563faf
SHA5121c4b1c1cb788f08dea954b795d4e0bbd7c028aa5655ce23af805243d06d1c96ef687b0788343182c1d0307e9c76088e4d53e4506e5a4f8d1707001e6549b487a