Overview

overview

10

Static

static

3

Loader/Launcher.dll

windows7-x64

1

Loader/Launcher.dll

windows10-2004-x64

1

Loader/Loader.exe

windows7-x64

10

Loader/Loader.exe

windows10-2004-x64

10

Loader/mainf.dll

windows7-x64

1

Loader/mainf.dll

windows10-2004-x64

1

Resubmissions

23-06-2024 19:34

240623-yac8yazcph 3

23-06-2024 19:33

240623-x9rd6szcne 10

23-06-2024 19:32

240623-x895wstbkr 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Loader.rar

  • Size

    3.8MB

  • Sample

    240623-x9rd6szcne

  • MD5

    6708336a25163b73dd47bc09f57818fa

  • SHA1

    36a31642c5f77cba5c4c0de905063e0b033a4986

  • SHA256

    b1ee03942664668e5e21997036234359542ee889c8d51e2699cbe6c8727cd19d

  • SHA512

    34e8f4913a393f71032699b32deb65103268b72e830ca870003a117a0c4a9bd7d4fb2e60cb520788fbffc08ec6cb9b189d93995d5f93e864befe89cf7946cbf1

  • SSDEEP

    98304:Z+Vnp8HuN4umIeUr8A6dIoYzMl+/lHOlmvLYdZEyt:speulevALXZlI8GZEyt

Score
10/10
rhadamanthysevasionexecutionpersistencestealer

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

https://rentry.org/lem61111111111/raw

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://bitbucket.org/k34gk349g34g3/56j56j5j56j/raw/0f83a68fcbec53d90c5d0c17a582d7652b840e57/lemon.rar

Targets

    • Target

      Loader/Launcher.dll

    • Size

      7.5MB

    • MD5

      cbb81f28c5a509e4f7e3e44bc7da74f8

    • SHA1

      47145f07bc7d0083d3bd13a9da44bac740952029

    • SHA256

      413bf9c2cff6fe7b97eae199683df7f6d648fad4c25cb6d0b7dce335eb69edba

    • SHA512

      bc863ebb2f5fd66f342be8befb49889dd275adb15cff95ed378e185190091589c8d1d7a8902ca889a7b2af81588c731bfa0a930f074fecadd9b47a082966079c

    • SSDEEP

      98304:koD5geAsEDKN0xOLy2MsmCkQejop7PGXleggxF:kfD/mexOLy0GoNPGXledT

    Score
    1/10
    behavioral1behavioral2

    • Target

      Loader/Loader.exe

    • Size

      7KB

    • MD5

      b5e479d3926b22b59926050c29c4e761

    • SHA1

      a456cc6993d12abe6c44f2d453d7ae5da2029e24

    • SHA256

      fbc4058b92d9bc4dda2dbc64cc61d0b3f193415aad15c362a5d87c90ca1be30b

    • SHA512

      09d1aa9b9d7905c37b76a6b697de9f2230219e7f51951654de73b0ad47b8bb8f93cf63aa4688a958477275853b382a2905791db9dcb186cad7f96015b2909fe8

    • SSDEEP

      192:q+yk9cqvjX3xszdzztCbxbsIcaqc2Ng5vGIcaBSNtUqOwciQjdv:Tyk9Hv1O/Cbxbbcaqc2NidcaANt/dcio

    Score
    10/10
    executionrhadamanthysevasionpersistencestealer

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

      stealerrhadamanthys

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Creates new service(s)

      persistenceexecution

    • Downloads MZ/PE file

    • Stops running service(s)

      evasionexecution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Power Settings

      powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral3behavioral4

    • Target

      Loader/mainf.dll

    • Size

      6KB

    • MD5

      dfbad6728654395df7cdc4626686bdd7

    • SHA1

      63686f523d7b4bf33c6184ce7d870fa326ce4bba

    • SHA256

      ba7ee4cc8044c4aeac2c9b698a32a6d01020097e14730abc7040cd9f0ee0608c

    • SHA512

      e2ff8afcd090adc2a846152fa5f0055ade47b8d9a19e6d2ff1f20092b987db98729388142f56af716b8dc659e66188ecfa4ba35b55353e7636a58a78c7ce6abd

    • SSDEEP

      96:VUttOfbCgQSbvu/r8NfrHkuixR+0NGUA5ATvHV+f4zUh:V6FgGr8B2R+0M1+rV+Qg

    Score
    1/10
    behavioral5behavioral6

MITRE ATT&CK Matrix

Tasks