Analysis date (UTC): 20 August 2024, 07:37Analysis environment: Windows 10 Pro, build 19045, x64

702ab38086350094b28c8df1b670f84f.exe

MD5:702AB38086350094B28C8DF1B670F84F

SHA1:3A6FF038D4E70D9F5E4A48F617612F9FC330BC03

SHA256:8B738C9057BAA2C3219120919226E95659CCCEC0DC61ACA579BBA58C7090719E

Analysis result

Threat level:Malicious activity

Tags:

rhadamanthysstealershellcode

Full analysis:Analysis 702ab38086350094b28c8df1b670f84f.exe (MD5: 702AB38086350094B28C8DF1B670F84F) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Antivirus name has been found in the command line (generic signature)

findstr.exe (PID: 6428)
findstr.exe (PID: 7056)

Create files in the Startup directory

cmd.exe (PID: 6164)

RHADAMANTHYS has been detected (SURICATA)

OpenWith.exe (PID: 6992)
dllhost.exe (PID: 7024)
OOBE-Maintenance.exe (PID: 6364)

Actions looks like stealing of personal data

OOBE-Maintenance.exe (PID: 6364)

RHADAMANTHYS has been detected (YARA)

OOBE-Maintenance.exe (PID: 6364)

Stealers network behavior

OOBE-Maintenance.exe (PID: 6364)

SUSPICIOUS

Drops a file with a rarely used extension (PIF)

cmd.exe (PID: 6968)
Internet.pif (PID: 5492)

Application launched itself

cmd.exe (PID: 6968)

Using 'findstr.exe' to search for text patterns in files and output

cmd.exe (PID: 6968)

Starts CMD.EXE for commands execution

702ab38086350094b28c8df1b670f84f.exe (PID: 6884)
cmd.exe (PID: 6968)

Executing commands from ".cmd" file

702ab38086350094b28c8df1b670f84f.exe (PID: 6884)

Get information on the list of running processes

cmd.exe (PID: 6968)

Drops the executable file immediately after the start

702ab38086350094b28c8df1b670f84f.exe (PID: 6884)
cmd.exe (PID: 6968)
Internet.pif (PID: 5492)

Reads the date of Windows installation

702ab38086350094b28c8df1b670f84f.exe (PID: 6884)

Reads security settings of Internet Explorer

702ab38086350094b28c8df1b670f84f.exe (PID: 6884)

Executable content was dropped or overwritten

cmd.exe (PID: 6968)
Internet.pif (PID: 5492)

The executable file from the user directory is run by the CMD process

Internet.pif (PID: 5492)

Starts application with an unusual extension

cmd.exe (PID: 6968)

Contacting a server suspected of hosting an CnC

OpenWith.exe (PID: 6992)
OOBE-Maintenance.exe (PID: 6364)
dllhost.exe (PID: 7024)

Executes application which crashes

Internet.pif (PID: 5492)

The process checks if it is being run in the virtual environment

OpenWith.exe (PID: 6992)

Searches for installed software

OOBE-Maintenance.exe (PID: 6364)

Connects to unusual port

OpenWith.exe (PID: 6992)
OOBE-Maintenance.exe (PID: 6364)

Loads DLL from Mozilla Firefox

OOBE-Maintenance.exe (PID: 6364)

INFO

Reads the computer name

702ab38086350094b28c8df1b670f84f.exe (PID: 6884)
Internet.pif (PID: 5492)

Create files in a temporary directory

702ab38086350094b28c8df1b670f84f.exe (PID: 6884)

Process checks computer location settings

702ab38086350094b28c8df1b670f84f.exe (PID: 6884)

Checks supported languages

702ab38086350094b28c8df1b670f84f.exe (PID: 6884)
Internet.pif (PID: 5492)
wmpshare.exe (PID: 3304)

Manual execution by a user

OpenWith.exe (PID: 6992)
cmd.exe (PID: 6164)
OOBE-Maintenance.exe (PID: 6364)

Reads mouse settings

Internet.pif (PID: 5492)

Creates files or folders in the user directory

Internet.pif (PID: 5492)

Reads the machine GUID from the registry

wmpshare.exe (PID: 3304)

Threats

PID	Process	Class	Message
6364	OOBE-Maintenance.exe	A Network Trojan was detected	STEALER [ANY.RUN] Rhadamanthys SSL Certificate and JA3s
6364	OOBE-Maintenance.exe	A Network Trojan was detected	STEALER [ANY.RUN] Rhadamanthys SSL Certificate and JA3s