Analysis
-
max time kernel
223s -
max time network
298s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
17-01-2023 00:12
Static task
static1
Behavioral task
behavioral1
Sample
cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe
Resource
win10v2004-20220812-en
General
-
Target
cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe
-
Size
404.2MB
-
MD5
fcb4b9dfe2f6ed4504410160001d03a7
-
SHA1
2b66273ea2797e5ba3e33582da6d0f91f5e7833c
-
SHA256
cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6
-
SHA512
3373699f165aab7cccfb6062ac3c3a49d76fc7591f971a76ce4e6d3eb7e1f0fdfad2d71a7632bd5013a44d8b718ef510f3198c87572f58d828c5d68a613a9efa
-
SSDEEP
49152:At33d2m6BN4NPGonVbx5Y3Va5i/QWKxLBNZZcAt:iQozTG3Va5iYJxLB7ZcA
Malware Config
Extracted
systembc
45.147.197.24:4001
80.89.234.122:4001
Signatures
-
Detect rhadamanthys stealer shellcode 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2340-159-0x0000000000BB0000-0x0000000000BCD000-memory.dmp family_rhadamanthys behavioral2/memory/2340-160-0x00000000026D0000-0x00000000036D0000-memory.dmp family_rhadamanthys behavioral2/memory/2340-162-0x0000000000BB0000-0x0000000000BCD000-memory.dmp family_rhadamanthys -
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exedescription pid process target process PID 3544 created 2420 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe taskhostw.exe -
Executes dropped EXE 1 IoCs
Processes:
Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exepid process 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe -
Loads dropped DLL 1 IoCs
Processes:
Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exepid process 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
Processes:
fontview.exepid process 2340 fontview.exe 2340 fontview.exe 2340 fontview.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exedescription pid process target process PID 3544 set thread context of 3656 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe ngentask.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3132 3544 WerFault.exe Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe 392 3544 WerFault.exe Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
fontview.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 fontview.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID fontview.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fontview.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fontview.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fontview.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 50 IoCs
Processes:
cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exeJamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exepid process 4512 cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe 4512 cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe 4512 cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe 4512 cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe 4512 cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe 4512 cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe 4512 cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe 4512 cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe 4512 cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe 4512 cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
fontview.exedescription pid process Token: SeShutdownPrivilege 2340 fontview.exe Token: SeCreatePagefilePrivilege 2340 fontview.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.execmd.exeJamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exedescription pid process target process PID 4512 wrote to memory of 5052 4512 cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe schtasks.exe PID 4512 wrote to memory of 5052 4512 cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe schtasks.exe PID 4512 wrote to memory of 5052 4512 cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe schtasks.exe PID 4512 wrote to memory of 3544 4512 cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe PID 4512 wrote to memory of 3544 4512 cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe PID 4512 wrote to memory of 3544 4512 cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe PID 4512 wrote to memory of 3884 4512 cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe cmd.exe PID 4512 wrote to memory of 3884 4512 cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe cmd.exe PID 4512 wrote to memory of 3884 4512 cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe cmd.exe PID 3884 wrote to memory of 3928 3884 cmd.exe chcp.com PID 3884 wrote to memory of 3928 3884 cmd.exe chcp.com PID 3884 wrote to memory of 3928 3884 cmd.exe chcp.com PID 3884 wrote to memory of 3592 3884 cmd.exe PING.EXE PID 3884 wrote to memory of 3592 3884 cmd.exe PING.EXE PID 3884 wrote to memory of 3592 3884 cmd.exe PING.EXE PID 3544 wrote to memory of 3656 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe ngentask.exe PID 3544 wrote to memory of 3656 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe ngentask.exe PID 3544 wrote to memory of 3656 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe ngentask.exe PID 3544 wrote to memory of 3656 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe ngentask.exe PID 3544 wrote to memory of 3656 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe ngentask.exe PID 3544 wrote to memory of 2340 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe fontview.exe PID 3544 wrote to memory of 2340 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe fontview.exe PID 3544 wrote to memory of 2340 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe fontview.exe PID 3544 wrote to memory of 2340 3544 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe fontview.exe
Processes
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\SysWOW64\fontview.exe"C:\Windows\SYSWOW64\fontview.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe"C:\Users\Admin\AppData\Local\Temp\cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn COMSurrogate /f /sc onlogon /rl highest /tr "C:\Users\Admin\Pedadak moquihi kevevor ceg koxo mevologi\Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\Pedadak moquihi kevevor ceg koxo mevologi\Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe"C:\Users\Admin\Pedadak moquihi kevevor ceg koxo mevologi\Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 5763⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 12763⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3544 -ip 35441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3544 -ip 35441⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\240615062.dllFilesize
442KB
MD5acf51213c2e0b564c28cf0db859c9e38
SHA10ec6d956dd0299a8d26bd4671af11c9c3fbe2ca0
SHA256643044a62d07c6725a73bce3ee702ad0c15f0fe332165821c5e7f73937f898b7
SHA51215f30f50afdc2838ebdc4f38199f9857c1b9bc43350588abed404dcaef039698a2533dd5c074d2bfc88448a578c2202c033073592a9c551f7a7e4d263e293eed
-
C:\Users\Admin\Pedadak moquihi kevevor ceg koxo mevologi\Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exeFilesize
1210.2MB
MD54ae3a6bc5a292dd96a365bb7356be231
SHA1cabfa1f7ce383921cac2e1a50d917b2d2414bd44
SHA2567d7dbf63e548d2a9f1c39af623693755229f89f752ac0b6b69ee562c22687c98
SHA51201672f0e37cb412e2d128850ce2ac2f8cd390c1d8d0c1e4efb51a186cc861dd74a477d9eef23dcc51e303752c0c16bc093ff15cdc261be04231dafe570ff708d
-
C:\Users\Admin\Pedadak moquihi kevevor ceg koxo mevologi\Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exeFilesize
1210.2MB
MD54ae3a6bc5a292dd96a365bb7356be231
SHA1cabfa1f7ce383921cac2e1a50d917b2d2414bd44
SHA2567d7dbf63e548d2a9f1c39af623693755229f89f752ac0b6b69ee562c22687c98
SHA51201672f0e37cb412e2d128850ce2ac2f8cd390c1d8d0c1e4efb51a186cc861dd74a477d9eef23dcc51e303752c0c16bc093ff15cdc261be04231dafe570ff708d
-
memory/2340-158-0x0000000000865000-0x0000000000867000-memory.dmpFilesize
8KB
-
memory/2340-153-0x0000000000000000-mapping.dmp
-
memory/2340-162-0x0000000000BB0000-0x0000000000BCD000-memory.dmpFilesize
116KB
-
memory/2340-152-0x0000000000420000-0x0000000000455000-memory.dmpFilesize
212KB
-
memory/2340-161-0x0000000000420000-0x0000000000455000-memory.dmpFilesize
212KB
-
memory/2340-160-0x00000000026D0000-0x00000000036D0000-memory.dmpFilesize
16.0MB
-
memory/2340-159-0x0000000000BB0000-0x0000000000BCD000-memory.dmpFilesize
116KB
-
memory/2340-154-0x0000000000420000-0x0000000000455000-memory.dmpFilesize
212KB
-
memory/2340-157-0x0000000000865000-0x0000000000867000-memory.dmpFilesize
8KB
-
memory/3544-142-0x000000000F130000-0x000000000F18E000-memory.dmpFilesize
376KB
-
memory/3544-144-0x000000000F130000-0x000000000F18E000-memory.dmpFilesize
376KB
-
memory/3544-143-0x00000000033F0000-0x0000000003550000-memory.dmpFilesize
1.4MB
-
memory/3544-156-0x000000000F130000-0x000000000F18E000-memory.dmpFilesize
376KB
-
memory/3544-155-0x00000000033F0000-0x0000000003550000-memory.dmpFilesize
1.4MB
-
memory/3544-135-0x0000000000000000-mapping.dmp
-
memory/3544-163-0x00000000033F0000-0x0000000003550000-memory.dmpFilesize
1.4MB
-
memory/3592-141-0x0000000000000000-mapping.dmp
-
memory/3656-146-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/3656-150-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/3656-148-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/3656-145-0x0000000000000000-mapping.dmp
-
memory/3884-138-0x0000000000000000-mapping.dmp
-
memory/3928-140-0x0000000000000000-mapping.dmp
-
memory/4512-132-0x0000000003290000-0x00000000033F0000-memory.dmpFilesize
1.4MB
-
memory/4512-139-0x0000000003290000-0x00000000033F0000-memory.dmpFilesize
1.4MB
-
memory/4512-133-0x0000000003290000-0x00000000033F0000-memory.dmpFilesize
1.4MB
-
memory/5052-134-0x0000000000000000-mapping.dmp