Analysis

  • max time kernel
    91s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/01/2023, 14:26

General

  • Target

    b1a344376e55c7c93928dd79e69f9aa3.exe

  • Size

    5.3MB

  • MD5

    b1a344376e55c7c93928dd79e69f9aa3

  • SHA1

    7274777ea6e14d7c81a163bc48bec63c184532bd

  • SHA256

    63043e1230b491042c4a30039ae44055b99134597aaf5f659822dc321489992d

  • SHA512

    d0466fdeab8ccc3299da24aea54c9404afca965f2c5ee7730c6f9490ca06940db74aeff1bb25c15f9f8782b686eead8512d990df4fa617e5c05965ec1174fd00

  • SSDEEP

    98304:Bvk3ipZhMK/1fc3qjFhQ+bJduoBUxxMRdrxEpJwp:Bvk3cZhPpJHJdLBUDMLrxEp2p

Malware Config

Signatures

  • Aurora

    Aurora is a crypto wallet stealer written in Golang.

  • Detect rhadamanthys stealer shellcode 2 IoCs
  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Windows\system32\taskhostw.exe
    taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
    1⤵
      PID:2396
      • C:\Windows\SysWOW64\fontview.exe
        "C:\Windows\SYSWOW64\fontview.exe"
        2⤵
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Checks SCSI registry key(s)
        PID:4276
    • C:\Users\Admin\AppData\Local\Temp\b1a344376e55c7c93928dd79e69f9aa3.exe
      "C:\Users\Admin\AppData\Local\Temp\b1a344376e55c7c93928dd79e69f9aa3.exe"
      1⤵
      • Suspicious use of NtCreateUserProcessOtherParentProcess
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1336
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1960
        • C:\Windows\SysWOW64\Wbem\wmic.exe
          wmic os get Caption
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:740
        • C:\Windows\SysWOW64\cmd.exe
          cmd /C "wmic path win32_VideoController get name"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4544
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic path win32_VideoController get name
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:3992
        • C:\Windows\SysWOW64\cmd.exe
          cmd /C "wmic cpu get name"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3872
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic cpu get name
            4⤵
              PID:4916

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\240576375.dll

        Filesize

        442KB

        MD5

        acf51213c2e0b564c28cf0db859c9e38

        SHA1

        0ec6d956dd0299a8d26bd4671af11c9c3fbe2ca0

        SHA256

        643044a62d07c6725a73bce3ee702ad0c15f0fe332165821c5e7f73937f898b7

        SHA512

        15f30f50afdc2838ebdc4f38199f9857c1b9bc43350588abed404dcaef039698a2533dd5c074d2bfc88448a578c2202c033073592a9c551f7a7e4d263e293eed

      • memory/1336-136-0x000000000E750000-0x0000000010C7A000-memory.dmp

        Filesize

        37.2MB

      • memory/1336-137-0x000000000E750000-0x0000000010C7A000-memory.dmp

        Filesize

        37.2MB

      • memory/1336-162-0x0000000002F80000-0x000000000347F000-memory.dmp

        Filesize

        5.0MB

      • memory/1336-150-0x000000000E750000-0x0000000010C7A000-memory.dmp

        Filesize

        37.2MB

      • memory/1336-135-0x0000000002F80000-0x000000000347F000-memory.dmp

        Filesize

        5.0MB

      • memory/1336-146-0x0000000002F80000-0x000000000347F000-memory.dmp

        Filesize

        5.0MB

      • memory/1960-143-0x0000000000400000-0x000000000089C000-memory.dmp

        Filesize

        4.6MB

      • memory/1960-163-0x0000000000400000-0x000000000089C000-memory.dmp

        Filesize

        4.6MB

      • memory/1960-141-0x0000000000400000-0x000000000089C000-memory.dmp

        Filesize

        4.6MB

      • memory/1960-139-0x0000000000400000-0x000000000089C000-memory.dmp

        Filesize

        4.6MB

      • memory/1960-144-0x0000000000400000-0x000000000089C000-memory.dmp

        Filesize

        4.6MB

      • memory/4276-154-0x0000000000785000-0x0000000000787000-memory.dmp

        Filesize

        8KB

      • memory/4276-151-0x0000000000450000-0x0000000000485000-memory.dmp

        Filesize

        212KB

      • memory/4276-157-0x0000000000785000-0x0000000000787000-memory.dmp

        Filesize

        8KB

      • memory/4276-158-0x0000000000750000-0x000000000076D000-memory.dmp

        Filesize

        116KB

      • memory/4276-159-0x0000000002610000-0x0000000003610000-memory.dmp

        Filesize

        16.0MB

      • memory/4276-160-0x0000000000450000-0x0000000000485000-memory.dmp

        Filesize

        212KB

      • memory/4276-161-0x0000000000750000-0x000000000076D000-memory.dmp

        Filesize

        116KB

      • memory/4276-147-0x0000000000450000-0x0000000000485000-memory.dmp

        Filesize

        212KB