Overview

overview

10

Static

static

3

Prova dei ...do.exe

windows7-x64

10

Prova dei ...do.exe

windows10-2004-x64

10

msimg32.dll

windows7-x64

3

msimg32.dll

windows10-2004-x64

3

Resubmissions

31-01-2025 10:14

250131-l9xemsvmdn 10

31-01-2025 10:10

250131-l7qt3sspat 10

Analysis

  • max time kernel
    150s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    31-01-2025 10:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Prova dei diritti di proprietà che stai violando.exe

  • Size

    6.1MB

  • MD5

    4864a55cff27f686023456a22371e790

  • SHA1

    6ed30c0371fe167d38411bfa6d720fcdcacc4f4c

  • SHA256

    08c7fb6067acc8ac207d28ab616c9ea5bc0d394956455d6a3eecb73f8010f7a2

  • SHA512

    4bd3a16435cca6ce7a7aa829eb967619a8b7c02598474e634442cffc55935870d54d844a04496bf9c7e8c29c40fae59ac6eb39c8550c091d06a28211491d0bfb

  • SSDEEP

    98304:VZQIM+/nv/CDoAkYwpAa5ge1zZ/jtdZwUkQ:bJCKlA2VKUz

Score
10/10
rhadamanthysdiscoverypersistencestealer

Malware Config

Signatures

  • Detects Rhadamanthys payload 2 IoCs
  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys
  • Rhadamanthys family
    rhadamanthys
  • Suspicious use of NtCreateUserProcessOtherParentProcess 10 IoCs
  • Adds Run key to start application 2 TTPs 10 IoCs
    persistence
  • System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1172
      • C:\Users\Admin\AppData\Local\Temp\Prova dei diritti di proprietà che stai violando.exe
        "C:\Users\Admin\AppData\Local\Temp\Prova dei diritti di proprietà che stai violando.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2384
        • C:\Users\Admin\AppData\Local\Temp\Prova dei diritti di proprietà che stai violando.exe
          "C:\Users\Admin\AppData\Local\Temp\Prova dei diritti di proprietà che stai violando.exe"
          3⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:836
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Palo Alto Network Sensor" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\PaloAlto943034.dll",EntryPoint /f & exit
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2408
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Palo Alto Network Sensor" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\PaloAlto943034.dll",EntryPoint /f
            4⤵
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            PID:2688
      • C:\Users\Admin\AppData\Local\Temp\Prova dei diritti di proprietà che stai violando.exe
        "C:\Users\Admin\AppData\Local\Temp\Prova dei diritti di proprietà che stai violando.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2216
        • C:\Users\Admin\AppData\Local\Temp\Prova dei diritti di proprietà che stai violando.exe
          "C:\Users\Admin\AppData\Local\Temp\Prova dei diritti di proprietà che stai violando.exe"
          3⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2452
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Palo Alto Network Sensor" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\PaloAlto943034.dll",EntryPoint /f & exit
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2616
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Palo Alto Network Sensor" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\PaloAlto943034.dll",EntryPoint /f
            4⤵
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            PID:2956
      • C:\Users\Admin\AppData\Local\Temp\Prova dei diritti di proprietà che stai violando.exe
        "C:\Users\Admin\AppData\Local\Temp\Prova dei diritti di proprietà che stai violando.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2808
        • C:\Users\Admin\AppData\Local\Temp\Prova dei diritti di proprietà che stai violando.exe
          "C:\Users\Admin\AppData\Local\Temp\Prova dei diritti di proprietà che stai violando.exe"
          3⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1712
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Palo Alto Network Sensor" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\PaloAlto943034.dll",EntryPoint /f & exit
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:376
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Palo Alto Network Sensor" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\PaloAlto943034.dll",EntryPoint /f
            4⤵
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            PID:2156
      • C:\Users\Admin\AppData\Local\Temp\Prova dei diritti di proprietà che stai violando.exe
        "C:\Users\Admin\AppData\Local\Temp\Prova dei diritti di proprietà che stai violando.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2600
        • C:\Users\Admin\AppData\Local\Temp\Prova dei diritti di proprietà che stai violando.exe
          "C:\Users\Admin\AppData\Local\Temp\Prova dei diritti di proprietà che stai violando.exe"
          3⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2008
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Palo Alto Network Sensor" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\PaloAlto943034.dll",EntryPoint /f & exit
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1444
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Palo Alto Network Sensor" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\PaloAlto943034.dll",EntryPoint /f
            4⤵
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            PID:340
      • C:\Users\Admin\AppData\Local\Temp\Prova dei diritti di proprietà che stai violando.exe
        "C:\Users\Admin\AppData\Local\Temp\Prova dei diritti di proprietà che stai violando.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2944
        • C:\Users\Admin\AppData\Local\Temp\Prova dei diritti di proprietà che stai violando.exe
          "C:\Users\Admin\AppData\Local\Temp\Prova dei diritti di proprietà che stai violando.exe"
          3⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:1644
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Palo Alto Network Sensor" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\PaloAlto943034.dll",EntryPoint /f & exit
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1936
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Palo Alto Network Sensor" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\PaloAlto943034.dll",EntryPoint /f
            4⤵
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            PID:2872
      • C:\Users\Admin\AppData\Local\Temp\Prova dei diritti di proprietà che stai violando.exe
        "C:\Users\Admin\AppData\Local\Temp\Prova dei diritti di proprietà che stai violando.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:536
        • C:\Users\Admin\AppData\Local\Temp\Prova dei diritti di proprietà che stai violando.exe
          "C:\Users\Admin\AppData\Local\Temp\Prova dei diritti di proprietà che stai violando.exe"
          3⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2940
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Palo Alto Network Sensor" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\PaloAlto943034.dll",EntryPoint /f & exit
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1968
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Palo Alto Network Sensor" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\PaloAlto943034.dll",EntryPoint /f
            4⤵
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            PID:1224
      • C:\Users\Admin\AppData\Local\Temp\Prova dei diritti di proprietà che stai violando.exe
        "C:\Users\Admin\AppData\Local\Temp\Prova dei diritti di proprietà che stai violando.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:3056
        • C:\Users\Admin\AppData\Local\Temp\Prova dei diritti di proprietà che stai violando.exe
          "C:\Users\Admin\AppData\Local\Temp\Prova dei diritti di proprietà che stai violando.exe"
          3⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:960
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Palo Alto Network Sensor" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\PaloAlto943034.dll",EntryPoint /f & exit
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1868
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Palo Alto Network Sensor" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\PaloAlto943034.dll",EntryPoint /f
            4⤵
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            PID:1828
      • C:\Users\Admin\AppData\Local\Temp\Prova dei diritti di proprietà che stai violando.exe
        "C:\Users\Admin\AppData\Local\Temp\Prova dei diritti di proprietà che stai violando.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:1840
        • C:\Users\Admin\AppData\Local\Temp\Prova dei diritti di proprietà che stai violando.exe
          "C:\Users\Admin\AppData\Local\Temp\Prova dei diritti di proprietà che stai violando.exe"
          3⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:1456
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Palo Alto Network Sensor" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\PaloAlto943034.dll",EntryPoint /f & exit
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1568
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Palo Alto Network Sensor" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\PaloAlto943034.dll",EntryPoint /f
            4⤵
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            PID:1504
      • C:\Users\Admin\AppData\Local\Temp\Prova dei diritti di proprietà che stai violando.exe
        "C:\Users\Admin\AppData\Local\Temp\Prova dei diritti di proprietà che stai violando.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2264
        • C:\Users\Admin\AppData\Local\Temp\Prova dei diritti di proprietà che stai violando.exe
          "C:\Users\Admin\AppData\Local\Temp\Prova dei diritti di proprietà che stai violando.exe"
          3⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:1400
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Palo Alto Network Sensor" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\PaloAlto943034.dll",EntryPoint /f & exit
          3⤵
          • System Location Discovery: System Language Discovery
          PID:2404
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Palo Alto Network Sensor" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\PaloAlto943034.dll",EntryPoint /f
            4⤵
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            PID:2504
      • C:\Users\Admin\AppData\Local\Temp\Prova dei diritti di proprietà che stai violando.exe
        "C:\Users\Admin\AppData\Local\Temp\Prova dei diritti di proprietà che stai violando.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:328
        • C:\Users\Admin\AppData\Local\Temp\Prova dei diritti di proprietà che stai violando.exe
          "C:\Users\Admin\AppData\Local\Temp\Prova dei diritti di proprietà che stai violando.exe"
          3⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2068
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Palo Alto Network Sensor" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\PaloAlto943034.dll",EntryPoint /f & exit
          3⤵
          • System Location Discovery: System Language Discovery
          PID:2376
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Palo Alto Network Sensor" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\PaloAlto943034.dll",EntryPoint /f
            4⤵
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            PID:2348
      • C:\Users\Admin\AppData\Local\Temp\Prova dei diritti di proprietà che stai violando.exe
        "C:\Users\Admin\AppData\Local\Temp\Prova dei diritti di proprietà che stai violando.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:1604
        • C:\Users\Admin\AppData\Local\Temp\Prova dei diritti di proprietà che stai violando.exe
          "C:\Users\Admin\AppData\Local\Temp\Prova dei diritti di proprietà che stai violando.exe"
          3⤵
            PID:2488
        • C:\Users\Admin\AppData\Local\Temp\Prova dei diritti di proprietà che stai violando.exe
          "C:\Users\Admin\AppData\Local\Temp\Prova dei diritti di proprietà che stai violando.exe"
          2⤵
            PID:2768

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\Documents\PaloAlto943034.dll
          Filesize

          42.6MB

          MD5

          774f23f2abfa59b196af762383abe606

          SHA1

          62766fa96d2800d4c83a6446bd3cc850a17913d0

          SHA256

          46c92438d6f6fb21091621ba0e0175402880d8c5f90b22004a9d32167936d3d4

          SHA512

          23865d5163fbed5a6366bd2e4e581605feebed18803ddc101c6910d895f4dfa6aee7b995e1fd69549f1a60d53f94d728266cfd1167f3f2444ac88eaf186777ae

          Download Submit

        • memory/836-11-0x0000000077471000-0x0000000077572000-memory.dmp

          Filesize

          1.0MB

          Download

        • memory/836-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

          Download

        • memory/836-4-0x00000000001C0000-0x0000000000241000-memory.dmp

          Filesize

          516KB

          Download

        • memory/836-5-0x00000000001C0000-0x0000000000241000-memory.dmp

          Filesize

          516KB

          Download

        • memory/836-6-0x0000000000D90000-0x0000000001190000-memory.dmp

          Filesize

          4.0MB

          Download

        • memory/836-8-0x0000000000D90000-0x0000000001190000-memory.dmp

          Filesize

          4.0MB

          Download

        • memory/836-7-0x0000000000D90000-0x0000000001190000-memory.dmp

          Filesize

          4.0MB

          Download

        • memory/836-9-0x0000000077470000-0x0000000077619000-memory.dmp

          Filesize

          1.7MB

          Download

        • memory/836-13-0x0000000075510000-0x0000000075557000-memory.dmp

          Filesize

          284KB

          Download

        • memory/836-10-0x0000000000D90000-0x0000000001190000-memory.dmp

          Filesize

          4.0MB

          Download

        • memory/836-15-0x0000000000D90000-0x0000000001190000-memory.dmp

          Filesize

          4.0MB

          Download

        • memory/960-83-0x0000000077470000-0x0000000077619000-memory.dmp

          Filesize

          1.7MB

          Download

        • memory/960-82-0x0000000000EF0000-0x00000000012F0000-memory.dmp

          Filesize

          4.0MB

          Download

        • memory/960-85-0x0000000075510000-0x0000000075557000-memory.dmp

          Filesize

          284KB

          Download

        • memory/1644-58-0x0000000000C90000-0x0000000001090000-memory.dmp

          Filesize

          4.0MB

          Download

        • memory/1644-59-0x0000000077470000-0x0000000077619000-memory.dmp

          Filesize

          1.7MB

          Download

        • memory/1644-61-0x0000000075510000-0x0000000075557000-memory.dmp

          Filesize

          284KB

          Download

        • memory/1712-35-0x0000000077470000-0x0000000077619000-memory.dmp

          Filesize

          1.7MB

          Download

        • memory/1712-34-0x0000000000E90000-0x0000000001290000-memory.dmp

          Filesize

          4.0MB

          Download

        • memory/1712-37-0x0000000075510000-0x0000000075557000-memory.dmp

          Filesize

          284KB

          Download

        • memory/2008-46-0x0000000000ED0000-0x00000000012D0000-memory.dmp

          Filesize

          4.0MB

          Download

        • memory/2008-49-0x0000000075510000-0x0000000075557000-memory.dmp

          Filesize

          284KB

          Download

        • memory/2008-47-0x0000000077470000-0x0000000077619000-memory.dmp

          Filesize

          1.7MB

          Download

        • memory/2216-16-0x0000000010000000-0x0000000012AA2000-memory.dmp

          Filesize

          42.6MB

          Download

        • memory/2216-14-0x00000000001C0000-0x00000000001CA000-memory.dmp

          Filesize

          40KB

          Download

        • memory/2384-0-0x0000000010000000-0x0000000012AA2000-memory.dmp

          Filesize

          42.6MB

          Download

        • memory/2384-17-0x0000000000380000-0x00000000003DE000-memory.dmp

          Filesize

          376KB

          Download

        • memory/2384-1-0x0000000000230000-0x000000000025D000-memory.dmp

          Filesize

          180KB

          Download

        • memory/2452-25-0x0000000075510000-0x0000000075557000-memory.dmp

          Filesize

          284KB

          Download

        • memory/2452-23-0x0000000000EB0000-0x00000000012B0000-memory.dmp

          Filesize

          4.0MB

          Download

        • memory/2940-70-0x0000000000F70000-0x0000000001370000-memory.dmp

          Filesize

          4.0MB

          Download

        • memory/2940-73-0x0000000075510000-0x0000000075557000-memory.dmp

          Filesize

          284KB

          Download

        • memory/2940-71-0x0000000077470000-0x0000000077619000-memory.dmp

          Filesize

          1.7MB

          Download