Overview

overview

10

Static

static

3

2025-04-03...da.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    106s
  • max time network
    132s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/04/2025, 21:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-04-03_0cf5491278c7d87e8c3fc88c7f9f26ff_rhysida.exe

  • Size

    908KB

  • MD5

    0cf5491278c7d87e8c3fc88c7f9f26ff

  • SHA1

    db1d9f161f331d07bbb626acf7d4f8f6e1a2c742

  • SHA256

    9ddb239d7c1ca00e5cf13cd6b1f816bdba30792b1f26cef2ca807336bd0b3802

  • SHA512

    6bda8ea0fe42eb032d0c81e49e7c1a3d8d321185615bae41aca265b53d63191274c8ec6b646663668ab78d4b4ed5986ca73fcd85c2e212cde075d324f5a2c66f

  • SSDEEP

    6144:xcQQbTJ0huBKxmueLQ320SlmQ2Gz3bJo47/T8MF3KSUEtQGG4P4T:bqLQ320SlmQ2GzW47vKSry14P

Score
10/10
rhysidacredential_accessdiscoveryransomwarespywarestealer

Malware Config

Signatures

  • Detects Rhysida ransom note 1 IoCs
  • Rhysida

    Rhysida is a ransomware that is written in C++ and discovered in 2023.

    ransomwarerhysida
  • Rhysida family
    rhysida
  • Renames multiple (9764) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Deletes itself 1 IoCs
  • Drops startup file 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-04-03_0cf5491278c7d87e8c3fc88c7f9f26ff_rhysida.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-04-03_0cf5491278c7d87e8c3fc88c7f9f26ff_rhysida.exe"
    1⤵
    • Drops startup file
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5464
    • C:\Windows\SYSTEM32\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp/tmpf193.dll,run C:\Users\Admin\AppData\Local\Temp\2025-04-03_0cf5491278c7d87e8c3fc88c7f9f26ff_rhysida.exe
      2⤵
      • Deletes itself
      • Loads dropped DLL
      PID:428

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\CriticalBreachDetected.pdf
    Filesize

    111KB

    MD5

    49379b7b592a53fba1af809f38e0c8be

    SHA1

    dace11e0bad3da3a6315ed6e72e66dce004df13d

    SHA256

    20de3fa257de804c635184416d72e0b941e4b390a7c34f5a240aeaa5f5ef67eb

    SHA512

    ea88fdeb46ae9435524975ee52e80210b56b9c4c974018736602804bbadc7b3a7d441fd550c0113c628407f6167995644d6e7dda2b4af835134fd0227f771a4b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\tmpf193.dll
    Filesize

    2KB

    MD5

    634a9af8d3f2fa0d38820d577fb0fbeb

    SHA1

    cd6e84a3c4f81fc9df8b82449db8b2e87130e3fd

    SHA256

    c9920e995fbc98cd3883ef4c4520300d5e82bab5d2a5c781e9e9fe694a43e82f

    SHA512

    abca2e016ff5a53395f95ba75c96f5bfa102086e92a8e2647bd2584a75e4a81a59596848d1abfab8e37981a6adb021a35074d4dc99868cc30c9c4e2a4666c50a

    Download Submit

  • memory/5464-7484-0x0000000000400000-0x00000000004F2000-memory.dmp

    Filesize

    968KB

    Download

  • memory/5464-15256-0x0000000000400000-0x00000000004F2000-memory.dmp

    Filesize

    968KB

    Download

  • memory/5464-15257-0x0000000000400000-0x00000000004F2000-memory.dmp

    Filesize

    968KB

    Download

  • memory/5464-15258-0x0000000000400000-0x00000000004F2000-memory.dmp

    Filesize

    968KB

    Download

  • memory/5464-15262-0x0000000000400000-0x00000000004F2000-memory.dmp

    Filesize

    968KB

    Download