Analysis
-
max time kernel
54s -
max time network
83s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
22-01-2023 02:00
Static task
static1
Behavioral task
behavioral1
Sample
a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe
Resource
win10-20220812-en
General
-
Target
a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe
-
Size
1.8MB
-
MD5
800564a52d3834a9353b51b0fb4b5e96
-
SHA1
729830eb7053a06017062274a9b3deffa4314d41
-
SHA256
a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2
-
SHA512
bb47b1e7a92270f382aa2a2106b5d97d486ab2bed69aebcab5bb1582d467b3ccee9f0893261c067197eb5b5397bb0c5acef1a88f9845a1106f3a642c1275b9a7
-
SSDEEP
24576:96oZfKa9OEJ4J56LXaVBf8qFQ4HqiIYV+MfpU2tFD3c1eGDGVqk8ZVjrSOP+U:96opKa9zdLXaVBf5dqir23DGckLO2U
Malware Config
Signatures
-
Detect rhadamanthys stealer shellcode 1 IoCs
Processes:
resource yara_rule behavioral1/memory/5080-279-0x0000000000DE0000-0x0000000000E03000-memory.dmp family_rhadamanthys -
Detects LgoogLoader payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/4720-240-0x00000000005F0000-0x00000000005FD000-memory.dmp family_lgoogloader -
LgoogLoader
A downloader capable of dropping and executing other malware families.
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exedescription pid process target process PID 2668 created 2876 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe taskhostw.exe -
Loads dropped DLL 1 IoCs
Processes:
a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exepid process 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
Processes:
fontview.exepid process 5080 fontview.exe 5080 fontview.exe 5080 fontview.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exedescription pid process target process PID 2668 set thread context of 4720 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe ngentask.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4888 2668 WerFault.exe a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
fontview.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fontview.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fontview.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 fontview.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID fontview.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fontview.exe -
Suspicious behavior: EnumeratesProcesses 46 IoCs
Processes:
a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exepid process 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
fontview.exedescription pid process Token: SeShutdownPrivilege 5080 fontview.exe Token: SeCreatePagefilePrivilege 5080 fontview.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exedescription pid process target process PID 2668 wrote to memory of 4720 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe ngentask.exe PID 2668 wrote to memory of 4720 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe ngentask.exe PID 2668 wrote to memory of 4720 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe ngentask.exe PID 2668 wrote to memory of 4720 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe ngentask.exe PID 2668 wrote to memory of 4720 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe ngentask.exe PID 2668 wrote to memory of 5080 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe fontview.exe PID 2668 wrote to memory of 5080 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe fontview.exe PID 2668 wrote to memory of 5080 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe fontview.exe PID 2668 wrote to memory of 5080 2668 a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe fontview.exe
Processes
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2876
-
C:\Windows\SYSWOW64\fontview.exe"C:\Windows\SYSWOW64\fontview.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5080
-
C:\Users\Admin\AppData\Local\Temp\a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe"C:\Users\Admin\AppData\Local\Temp\a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"2⤵PID:4720
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 9242⤵
- Program crash
PID:4888
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\240546000.dllFilesize
335KB
MD5af92bfcb7e4c67628a686accbf4231df
SHA1e5b392743d1731ca6fbe6b344d88028588548cac
SHA256959bd4b08d3f72347082976e5e6b5ad2a04201cda4a4b67d27dc3dfe04c73ebe
SHA512553c992234635a6e1463ce99107346200c8fbdcfc41421021761321a5e4621db774a6a0e7df0b3883bd1d367c0a58d031443ced015e01875b88e3695fb71f23c
-
memory/2668-154-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-143-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-120-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-121-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-122-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-123-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-124-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-125-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-126-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-127-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-128-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-129-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-130-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-131-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-132-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-133-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-134-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-135-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-136-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-137-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-138-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-139-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-140-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-141-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-142-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-157-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-144-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-145-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-146-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-147-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-148-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-150-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-149-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-151-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-152-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-118-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-156-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-155-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-119-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-158-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-159-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-160-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-161-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-162-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-163-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-164-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-153-0x0000000002C10000-0x0000000002D98000-memory.dmpFilesize
1.5MB
-
memory/2668-165-0x000000000EEF0000-0x000000000F1E2000-memory.dmpFilesize
2.9MB
-
memory/2668-166-0x000000000EEF0000-0x000000000F1E2000-memory.dmpFilesize
2.9MB
-
memory/2668-181-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-281-0x0000000002C10000-0x0000000002D98000-memory.dmpFilesize
1.5MB
-
memory/2668-282-0x000000000EEF0000-0x000000000F1E2000-memory.dmpFilesize
2.9MB
-
memory/4720-170-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4720-169-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4720-167-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4720-172-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4720-171-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4720-173-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4720-174-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4720-175-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4720-176-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4720-177-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4720-178-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4720-182-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4720-183-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4720-179-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/4720-240-0x00000000005F0000-0x00000000005FD000-memory.dmpFilesize
52KB
-
memory/4720-239-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5080-184-0x0000000002F00000-0x0000000002F35000-memory.dmpFilesize
212KB
-
memory/5080-186-0x0000000000000000-mapping.dmp
-
memory/5080-246-0x0000000002F00000-0x0000000002F35000-memory.dmpFilesize
212KB
-
memory/5080-279-0x0000000000DE0000-0x0000000000E03000-memory.dmpFilesize
140KB
-
memory/5080-280-0x0000000004750000-0x0000000004998000-memory.dmpFilesize
2.3MB
-
memory/5080-331-0x0000000002F00000-0x0000000002F35000-memory.dmpFilesize
212KB