Analysis
-
max time kernel
2s -
max time network
6s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-01-2025 13:35
Behavioral task
behavioral1
Sample
RubixLauncher.exe
Resource
win10v2004-20241007-en
General
-
Target
RubixLauncher.exe
-
Size
355KB
-
MD5
8a6f1580a5b9b94d7cd47cc6b1af1b9a
-
SHA1
e68768afd59e18091d345cb300e859572e8d4c5c
-
SHA256
bb1464e75c750d90c0c49d148c9e64eefe0c29b2f670d708c8085ddd3104dbfe
-
SHA512
1663a9e0868b3f5d7e1edd30259024e419c2d190ec8c31e76e66aef0c8a0e02da0c829584214b9e2f76cbd349a53bf77d01d03e9b0e9c8a99eb18021b1d53309
-
SSDEEP
6144:g2qezd2ab1/RuHk+M3k8M3W7XomjOJCqshrOlumY6DMIewgxQfqhsb:gf2R/EEkCQFYDwRqW
Malware Config
Extracted
rhadamanthys
https://185.125.50.38:3034/739bd3e91cd40ca83/pancake.api
Signatures
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Rhadamanthys family
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 2000 created 2664 2000 RubixLauncher.exe 44 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dialer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RubixLauncher.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2000 RubixLauncher.exe 2000 RubixLauncher.exe 3120 dialer.exe 3120 dialer.exe 3120 dialer.exe 3120 dialer.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2000 wrote to memory of 3120 2000 RubixLauncher.exe 83 PID 2000 wrote to memory of 3120 2000 RubixLauncher.exe 83 PID 2000 wrote to memory of 3120 2000 RubixLauncher.exe 83 PID 2000 wrote to memory of 3120 2000 RubixLauncher.exe 83 PID 2000 wrote to memory of 3120 2000 RubixLauncher.exe 83
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2664
-
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3120
-
-
C:\Users\Admin\AppData\Local\Temp\RubixLauncher.exe"C:\Users\Admin\AppData\Local\Temp\RubixLauncher.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2000