Analysis
- max time kernel
52s - max time network
135s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
- submitted
19/01/2023, 13:13
General
- Target 431269a3dd7a19c25a668b6c63b79549.exe
- Size 249KB
- Sample230119-qf4dbaga65
- SHA256 8a8bf4a261ae984007e0da758f9c8c9c609beb83041e91d036ff4ef0ed1bb328
Malware Config
Signatures
- Detect rhadamanthys stealer shellcode 2 IoCs
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
- Blocklisted process makes network request 1 IoCs
- Loads dropped DLL 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Program crash 2 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\431269a3dd7a19c25a668b6c63b79549.exe"C:\Users\Admin\AppData\Local\Temp\431269a3dd7a19c25a668b6c63b79549.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Users\Admin\AppData\Roaming\nsis_unse56762f.dll",PrintUIEntry |5CQkOhmAAAA|1TKr5GsMwYD|67sDqg8OAAl|xYmwxC0TNSO|1k8B3tZkgiyf2sAZQByAG4XAP9sADMAMgAuAKVkHwBs8|AtBQPz8Dn|AHkAdQBOADG+GQBFAGEAMCcAU|MAVD8A8vEAAFlI|4PsKOgEAgAA|0iDxCjDzMzM|0yJRCQYSIlUfyQQSIlMJAhdAf9Ii0QkMEiJBO0kgQE4SG8ACEjHt0QkEC0B6w6BARCvSIPAAY8BEIEBQNtIOZYAcyWfA4sM|yRIA8hIi8FI64tMqwFUewAD0Uj|i8qKCYgI68F+ZgVlSIsEJWDz8P8zyUiLUBhIO||RdDZIg8IgSP+LAkg7wnQqZv+DeEgYdRpMi|9AUGZBgzhrdN0HERFLdQgREHgQ|y50BUiLAOvV10iLSP0AwWoAQFP|VVZXQVRBVUH3VkFXXQFmgTlN|1pNi|hMi|JI34vZD4X88|BMY|9JPEGBPAlQRd8AAA+F6vPwQYv3hAmI8|CFwEiN3zwBD4TWahGDvLsJjC0BD4TH8|BE|4tnIESLXxyL|3ckRItPGEwD|+FMA9lIA|Ezf8lFhckPhKTz8P9Ni8RBixBFM||SSAPTigKEwP90HUHByg0Pvr3A+gABRAPQvxF1|+xBgfqq|A18|3QOg8EBSYPA|wRBO8lzaevG|4vBD7cMTkWL|yyLTAPrdFgzfe2qEHRRQYsUwQD|0zPJigJMi8Jv6w|BycgRA8jlEO8BQYoA1RDtM8A|M|ZBOwy24BCmAP+DxgGD+Ahy7v|rCkiLy0H|1b9JiQT3g8XkEMS|BDtvGHKvZgFB|19BXkFdQVxf915dWzMXSIHsYP0BZACL6ehm|v9||0iFwA+EmHUg60yNrwGLKxDIM||76Jt9II1fBEyN|0VGM9KLy|9U+yRogCBMi+APhPVrdSBFqBAzwIvTvpEgSIl8JCCmIHB+gCBIi|APhEt1IP6mIFBIjVYIRI2|R0BIjYwkhRFI34vY6Hz9fiCNVtVI3iAQ4iHM8|DoZ37vIESLBo1XCEEgeqYgWMohiYQkgIcS7d7z8IsO2iBYiYyxJHERBzCRIOgx7yCL|ZwtMkyLXTpIg|f7bEiKIDBMiWTfJDhMi6QaMkyJ3VyEAYQk3IcRhpJ2jRGNR0swjCTw8|C|SYvU6On8BTCK3Zx4MkiNhHgyQYD|8yGNT2xEMBj+pAKD6QF184G8|ngyIVJleHVNi3eEJPQiMZQk+DUB|8JIO9hyOIP6f2x2M0SNSUD6AE+UQbgAmACmIEDKIs|4dBlEtjDAMUmN91QkbJEgSYPobLvoa4IwSIvOpiB4|0iF|3QSi1VC+UyOMBsxSI1MJEAf|9dIgcR0IWEkLQgALQE=2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- outlook_office_path
- outlook_win_path
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4788 -s 7043⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 7162⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2144 -ip 21441⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 440 -p 4788 -ip 47881⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
nsis_unse56762f.dll
nsis_unse56762f.dll
memory/2144-136-0x0000000004AB0000-0x0000000004ACD000-memory.dmp
memory/2144-143-0x0000000002DEE000-0x0000000002E0E000-memory.dmp
memory/2144-132-0x0000000002DEE000-0x0000000002E0E000-memory.dmp
memory/2144-137-0x0000000002E0E000-0x0000000002E20000-memory.dmp
memory/2144-147-0x0000000000400000-0x0000000002BA6000-memory.dmp
memory/2144-134-0x0000000002E0E000-0x0000000002E20000-memory.dmp
memory/2144-133-0x00000000048E0000-0x0000000004905000-memory.dmp
memory/2144-146-0x0000000004AB0000-0x0000000004ACD000-memory.dmp
memory/2144-145-0x0000000002E0E000-0x0000000002E20000-memory.dmp
memory/2144-135-0x0000000000400000-0x0000000002BA6000-memory.dmp
memory/2144-144-0x00000000048E0000-0x0000000004905000-memory.dmp
memory/4788-142-0x00007FF443AE0000-0x00007FF443BDA000-memory.dmp
memory/4788-141-0x0000029CC7E40000-0x0000029CC7E47000-memory.dmp
memory/4788-148-0x00007FF443AE0000-0x00007FF443BDA000-memory.dmp
memory/4788-149-0x00007FF443AE0000-0x00007FF443BDA000-memory.dmp
memory/4788-150-0x00007FF8807B0000-0x00007FF8807C2000-memory.dmp