Overview
overview
10Static
static
About/samp...et.exe
windows7-x64
1About/samp...et.exe
windows10-2004-x64
1About/samp...gs.exe
windows7-x64
1About/samp...gs.exe
windows10-2004-x64
1About/samp...ss.exe
windows7-x64
1About/samp...ss.exe
windows10-2004-x64
1About/samp...ey.exe
windows7-x64
1About/samp...ey.exe
windows10-2004-x64
1About/samp...et.exe
windows7-x64
1About/samp...et.exe
windows10-2004-x64
1About/samp...gs.exe
windows7-x64
1About/samp...gs.exe
windows10-2004-x64
1About/samp...ss.exe
windows7-x64
1About/samp...ss.exe
windows10-2004-x64
1About/samp...ey.exe
windows7-x64
1About/samp...ey.exe
windows10-2004-x64
1Audaclty l...ns.exe
windows7-x64
10Audaclty l...ns.exe
windows10-2004-x64
10Analysis
-
max time kernel
28s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
02/02/2023, 05:18
Static task
static1
Behavioral task
behavioral1
Sample
About/samples/aspnetmvc/.nuget/nuget.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
About/samples/aspnetmvc/.nuget/nuget.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
About/samples/aspnetmvc/libraries/Pscx/Apps/EchoArgs.exe
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
About/samples/aspnetmvc/libraries/Pscx/Apps/EchoArgs.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
About/samples/aspnetmvc/libraries/Pscx/Apps/less.exe
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
About/samples/aspnetmvc/libraries/Pscx/Apps/less.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
About/samples/aspnetmvc/libraries/Pscx/Apps/lesskey.exe
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
About/samples/aspnetmvc/libraries/Pscx/Apps/lesskey.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
About/samples/aspnetmvc4/.nuget/nuget.exe
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
About/samples/aspnetmvc4/.nuget/nuget.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral11
Sample
About/samples/aspnetmvc4/libraries/Pscx/Apps/EchoArgs.exe
Resource
win7-20220901-en
Behavioral task
behavioral12
Sample
About/samples/aspnetmvc4/libraries/Pscx/Apps/EchoArgs.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
About/samples/aspnetmvc4/libraries/Pscx/Apps/less.exe
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
About/samples/aspnetmvc4/libraries/Pscx/Apps/less.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral15
Sample
About/samples/aspnetmvc4/libraries/Pscx/Apps/lesskey.exe
Resource
win7-20221111-en
Behavioral task
behavioral16
Sample
About/samples/aspnetmvc4/libraries/Pscx/Apps/lesskey.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
Audaclty latest versions.exe
Resource
win7-20221111-en
Behavioral task
behavioral18
Sample
Audaclty latest versions.exe
Resource
win10v2004-20220901-en
General
-
Target
Audaclty latest versions.exe
-
Size
754.1MB
-
MD5
71143dc49774e3712f91d02bec493c09
-
SHA1
9e596fb4d6ede862ac38a6a9507102f3c560519f
-
SHA256
7571cc54653c769818a540b25537195176a4997a22ba273fab47d2429e8502ee
-
SHA512
e6988dbbb533ffd6e3b511b06e01925693ff1cf1bb9eb3228a83973adf44974e37b1d0155b4bb43074fec4ffda813ba36101d141ea691b90de65141725d7e97a
-
SSDEEP
6144:eRH6o+yOQn0PlBZCBjPeMfoT5krV555555555555555555555555555555555558:c6lyY9GCmAz
Malware Config
Signatures
-
Detect rhadamanthys stealer shellcode 2 IoCs
resource yara_rule behavioral17/memory/1224-55-0x0000000000220000-0x000000000023D000-memory.dmp family_rhadamanthys behavioral17/memory/1224-64-0x0000000000220000-0x000000000023D000-memory.dmp family_rhadamanthys -
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Blocklisted process makes network request 1 IoCs
flow pid Process 3 1176 rundll32.exe -
Loads dropped DLL 4 IoCs
pid Process 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1224 wrote to memory of 1176 1224 Audaclty latest versions.exe 28 PID 1224 wrote to memory of 1176 1224 Audaclty latest versions.exe 28 PID 1224 wrote to memory of 1176 1224 Audaclty latest versions.exe 28 PID 1224 wrote to memory of 1176 1224 Audaclty latest versions.exe 28 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook rundll32.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Audaclty latest versions.exe"C:\Users\Admin\AppData\Local\Temp\Audaclty latest versions.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Windows\system32\rundll32.exe"C:\Users\Admin\AppData\Roaming\vcredist_6c92ce.dll",Options_RunDLL 0800cc00-0000-0422-0d0f-9d2f7795873e2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- outlook_office_path
- outlook_win_path
PID:1176
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53KB
MD50ea7e1c7a37ca13114e7d7651ce6f535
SHA1262ea0d9b3f1c417c6818e072ec9a4bc753aa271
SHA256fceda69218cc7c52fbdb2b365155006ca5fcaf5315ad4471705595f6444c21db
SHA512924ff0b08b25414106659d3b4ea784ef63bc0904818df36563c3ff26a6bd2378496f6a3919b5cb275e8c637556e1b5f1ec96ee40769420b4007abb7954f6171d
-
Filesize
53KB
MD50ea7e1c7a37ca13114e7d7651ce6f535
SHA1262ea0d9b3f1c417c6818e072ec9a4bc753aa271
SHA256fceda69218cc7c52fbdb2b365155006ca5fcaf5315ad4471705595f6444c21db
SHA512924ff0b08b25414106659d3b4ea784ef63bc0904818df36563c3ff26a6bd2378496f6a3919b5cb275e8c637556e1b5f1ec96ee40769420b4007abb7954f6171d
-
Filesize
53KB
MD50ea7e1c7a37ca13114e7d7651ce6f535
SHA1262ea0d9b3f1c417c6818e072ec9a4bc753aa271
SHA256fceda69218cc7c52fbdb2b365155006ca5fcaf5315ad4471705595f6444c21db
SHA512924ff0b08b25414106659d3b4ea784ef63bc0904818df36563c3ff26a6bd2378496f6a3919b5cb275e8c637556e1b5f1ec96ee40769420b4007abb7954f6171d
-
Filesize
53KB
MD50ea7e1c7a37ca13114e7d7651ce6f535
SHA1262ea0d9b3f1c417c6818e072ec9a4bc753aa271
SHA256fceda69218cc7c52fbdb2b365155006ca5fcaf5315ad4471705595f6444c21db
SHA512924ff0b08b25414106659d3b4ea784ef63bc0904818df36563c3ff26a6bd2378496f6a3919b5cb275e8c637556e1b5f1ec96ee40769420b4007abb7954f6171d
-
Filesize
53KB
MD50ea7e1c7a37ca13114e7d7651ce6f535
SHA1262ea0d9b3f1c417c6818e072ec9a4bc753aa271
SHA256fceda69218cc7c52fbdb2b365155006ca5fcaf5315ad4471705595f6444c21db
SHA512924ff0b08b25414106659d3b4ea784ef63bc0904818df36563c3ff26a6bd2378496f6a3919b5cb275e8c637556e1b5f1ec96ee40769420b4007abb7954f6171d