Analysis
-
max time kernel
45s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
16-01-2023 07:01
General
-
Target
27e35d0b2563dfe2784a9e953d99bc4dba2ab9b9.exe
-
Size
6.7MB
-
MD5
0572de40b29c53ebe8df22f6875bba9d
-
SHA1
27e35d0b2563dfe2784a9e953d99bc4dba2ab9b9
-
SHA256
e809a311f3bbfcfc796b37783b4bdbd76c4bd59657252ee3fd20150f8a76ccea
-
SHA512
9d9e6a35bb3a0db5b9bc6702f1fe764cbee79f23caed718a51642a1dde342424ea861c52ce8eea59c66655b84202dc705165dc1cbb3ba5177762033a7fa6a5c1
-
SSDEEP
196608:ech1JnwRSDaTvKuXwk2SA9lE6PI/GR8x1MA8Ra:dJOBKZk2S0P6hvMXa
Score
10/10
Malware Config
Signatures
-
Detect rhadamanthys stealer shellcode 2 IoCs
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\27e35d0b2563dfe2784a9e953d99bc4dba2ab9b9.exe"C:\Users\Admin\AppData\Local\Temp\27e35d0b2563dfe2784a9e953d99bc4dba2ab9b9.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
10.1MB
-
Filesize
10.1MB
-
Filesize
100KB
-
Filesize
116KB
-
Filesize
10.1MB
-
Filesize
16.0MB
-
Filesize
116KB
-
Filesize
10.1MB