Overview

overview

10

Static

static

3

HWID_Changer.exe

windows7-x64

10

HWID_Changer.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    HWID_Changer.exe

  • Size

    102.0MB

  • Sample

    240619-e8g51atgjf

  • MD5

    0dcd6d29ce1ed0448b7cd946e7858611

  • SHA1

    e938dbff736ea13453da389ebd944dcb28bb4e22

  • SHA256

    e49912beac8783d8d815e2d85019d98819abdabcde1a5bc6f3ce93a5a467ddb9

  • SHA512

    7fc04b03bb3ba119e1bc13ffe288cab016a63011fa4c7ca3ee063f11e2323696374009baaca8bbef9ea556fddbc65891a6c60960b82982fc7c7c1bb52c7faa0c

  • SSDEEP

    12288:MUZ6c25lke0kjcwIdfx5j+uvTJkDRGGF1qLF8yXPeJDBT79fLsaO:ZZ6/wTgcwIdDHJkfAF8gPerT7uaO

Score
10/10
rhadamanthysevasionexecutionpersistenceprivilege_escalationstealertrojan

Malware Config

Targets

    • Target

      HWID_Changer.exe

    • Size

      102.0MB

    • MD5

      0dcd6d29ce1ed0448b7cd946e7858611

    • SHA1

      e938dbff736ea13453da389ebd944dcb28bb4e22

    • SHA256

      e49912beac8783d8d815e2d85019d98819abdabcde1a5bc6f3ce93a5a467ddb9

    • SHA512

      7fc04b03bb3ba119e1bc13ffe288cab016a63011fa4c7ca3ee063f11e2323696374009baaca8bbef9ea556fddbc65891a6c60960b82982fc7c7c1bb52c7faa0c

    • SSDEEP

      12288:MUZ6c25lke0kjcwIdfx5j+uvTJkDRGGF1qLF8yXPeJDBT79fLsaO:ZZ6/wTgcwIdDHJkfAF8gPerT7uaO

    Score
    10/10
    rhadamanthysstealerevasionexecutionpersistenceprivilege_escalationtrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Modifies visibility of file extensions in Explorer

      evasion

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

      stealerrhadamanthys

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Creates new service(s)

      persistenceexecution

    • Downloads MZ/PE file

    • Stops running service(s)

      evasionexecution

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

System Services

2
T1569

Service Execution

2
T1569.002

Persistence

Create or Modify System Process

3
T1543

Windows Service

3
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Create or Modify System Process

3
T1543

Windows Service

3
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Modify Registry

4
T1112

Impair Defenses

2
T1562

Disable or Modify Tools

1
T1562.001

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Discovery

Query Registry

3
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Service Stop

1
T1489

Resource Development

Reconnaissance

Tasks