Analysis
- max time kernel
149s - max time network
53s - platform
windows11-21h2_x64 - resource
win11-20251015-en - resource tags
- submitted
03/12/2025, 18:06
General
- Target _17f1708d36917a3095a76e3c6dc49d345fb0d95309894ca3ac54097f2e22d104.exe
- Size 1.5MB
- Sample251203-wp3e9ssjb1
- SHA256 17f1708d36917a3095a76e3c6dc49d345fb0d95309894ca3ac54097f2e22d104
Malware Config
Signatures
- Detects Rhadamanthys Payload 1 IoCs
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
- Rhadamanthys family
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Enumerates processes with tasklist 1 TTPs 1 IoCs
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\SysWOW64\openwith.exe"C:\Windows\system32\openwith.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\_17f1708d36917a3095a76e3c6dc49d345fb0d95309894ca3ac54097f2e22d104.exe"C:\Users\Admin\AppData\Local\Temp\_17f1708d36917a3095a76e3c6dc49d345fb0d95309894ca3ac54097f2e22d104.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c cmd < Tutorial.midi2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr "SophosHealth nsWscSvc ekrn bdservicehost AvastUI AVGUI & if not errorlevel 1 Set iexPPZIPqNdhssaRpmwdTqtdVSvZbl=AutoIt3.exe & Set WpaRScwaW=.a3x & Set hwCzmbPPGHwxfoOEtCucLZfxCbNHPHDrtgs=3004⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\extrac32.exeextrac32 /Y Dragon.midi *.*4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr /V "diploma" Drew4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\630235\Warren.comWarren.com s4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4408 -s 9845⤵
- Program crash
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4408 -ip 44081⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Warren.com
s
Alphabetical.midi
Ar
Beatles
Challenges
Charles.midi
Charts
Conventional
Determining
Dragon.midi
Drew
Mfg.midi
Moisture.midi
Pace
Professionals.midi
Sensitive.midi
Teams
Tutorial.midi
Waterproof
nsExec.dll
memory/4408-75-0x0000000004A10000-0x0000000004AA5000-memory.dmp
memory/4408-72-0x0000000004A10000-0x0000000004AA5000-memory.dmp
memory/4408-73-0x0000000004A10000-0x0000000004AA5000-memory.dmp
memory/4408-71-0x0000000004A10000-0x0000000004AA5000-memory.dmp
memory/4408-74-0x0000000004A10000-0x0000000004AA5000-memory.dmp
memory/4408-76-0x0000000001530000-0x0000000001930000-memory.dmp
memory/4408-77-0x0000000001530000-0x0000000001930000-memory.dmp
memory/4408-80-0x0000000077110000-0x0000000077362000-memory.dmp
memory/4408-78-0x00007FF850AA0000-0x00007FF850CA9000-memory.dmp
memory/5200-81-0x00000000003B0000-0x00000000003BA000-memory.dmp
memory/5200-83-0x0000000002290000-0x0000000002690000-memory.dmp
memory/5200-86-0x0000000077110000-0x0000000077362000-memory.dmp
memory/5200-84-0x00007FF850AA0000-0x00007FF850CA9000-memory.dmp