Analysis
- max time kernel
28s - max time network
30s - platform
windows7_x64 - resource
win7-20230220-en - resource tags
- submitted
22/02/2023, 11:20
General
- Target a4aed7853d05c6eaa0c15223d2ee6a7d.exe
- Size 257KB
- Sample230222-nffadabb34
- SHA256 5931fac14fecb22cacb5cd495e2b49ead9bd6354ca9678257a5bc7929395db98
Malware Config
Signatures
- Detect rhadamanthys stealer shellcode 4 IoCs
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
- Blocklisted process makes network request 1 IoCs
- Loads dropped DLL 4 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4aed7853d05c6eaa0c15223d2ee6a7d.exe"C:\Users\Admin\AppData\Local\Temp\a4aed7853d05c6eaa0c15223d2ee6a7d.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Users\Admin\AppData\Roaming\nsis_uns6c2ff7.dll",PrintUIEntry |5CQkOhmAAAA|1TKr5GsMwYD|67sDqg8OAAl|xYmwxC0TNSO|1k8B3tZkgiyf2sAZQByAG4XAP9sADMAMgAuAKVkHwBs8|AtBQPz8DT|AHMAYgBqAHf|AE4AUABTAFKvADYAS0EANCsEWf9Ig+wo6AQCAP8ASIPEKMPMzP|MTIlEJBhIif9UJBBIiUwkCP5dAUiLRCQwSInbBCSBAThIbwAISG|HRCQQLQHrDoEBXxBIg8ABjwEQgQG3QEg5lgBzJZ8Di|8MJEgDyEiLwddIi0yrAVR7AAPR|0iLyooJiAjr|cFmBWVIiwQlYP7z8DPJSItQGEj|O9F0NkiDwiD|SIsCSDvCdCr|ZoN4SBh1Gkz|i0BQZkGDOGu7dAcREUt1CBEQeP8QLnQFSIsA66|VSItI|QDBagBA|1NVVldBVEFV70FWQVddAWaBOf9NWk2L+EyL8r9Ii9kPhfzz8Ez|Y0k8QYE8CVC|RQAAD4Xq8|BB74uECYjz8IXASL+NPAEPhNZqEYN3vAmMLQEPhMfz8P9Ei2cgRItfHP+LdyREi08YTP8D4UwD2UgD8f8zyUWFyQ+EpP7z8E2LxEGLEEX|M9JIA9OKAoT|wHQdQcHKDQ97vsD6AAFEA9C|Ef917EGB+qr8Df98dA6DwQFJg||ABEE7yXNp6||Gi8EPtwxORf+LLItMA+t0WPsz7aoQdFFBixT+wQDTM8mKAkyL38LrD8HJyBEDyN7lEAFBigDVEO0zf8Az9kE7DLbgEP6mAIPGAYP4CHL|7usKSIvLQf9|1UmJBPeDxeQQf8QEO28Ycq9mAf9BX0FeQV1BXO9fXl1bMxdIgez7YAFkAIvp6Gb+||||SIXAD4SY1nUgTI2vAYsrEMgz9||om30gjV8ETP+NRUYz0ovL||dUJGiAIEyL4A|rhGt1IEWoEDPAi33TkSBIiXwkIKYg|XCAIEiL8A+ES|x1IKYgUEiNVghEf41HQEiNjCSFEb9Ii9jofP1+II2rVkjeIBDiIczz8Oj9Z+8gRIsGjVcI9EEgpiBYyiGJhCSA2ocS3vPwiw7aIFiJY4wkcREHMJEg6DHvIPuLnC0yTItdOkjvg|tsSIogMEyJv2QkOEyLpBoyTLuJXIQBhCTchxGG7ZKNEY1HSzCMJPB+8|BJi9To6fwFMLuKnHgySI2EeDJB|4DzIY1PbEQw|RikAoPpAXXzgf28eDIhUmV4dU3vi4Qk9CIxlCT4|jUBwkg72HI4g||6bHYzRI1JQJ76AJRBuACYAKYgQJ7KIvh0GUS2MMAxSe+NVCRskSBJg+h3bOhrgjBIi86mIP94SIX|dBKLVfNCTI4wGzFIjUwkP0D|10iBxHQhYSQALQgtAQ==2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
nsis_uns6c2ff7.dll
nsis_uns6c2ff7.dll
nsis_uns6c2ff7.dll
nsis_uns6c2ff7.dll
nsis_uns6c2ff7.dll
memory/1440-67-0x0000000000110000-0x0000000000117000-memory.dmp
memory/1440-72-0x000007FFFFEB0000-0x000007FFFFFAA000-memory.dmp
memory/1440-76-0x000007FEFACD0000-0x000007FEFACE2000-memory.dmp
memory/1440-75-0x000007FFFFEB0000-0x000007FFFFFAA000-memory.dmp
memory/1440-71-0x000007FFFFEB0000-0x000007FFFFFAA000-memory.dmp
memory/1440-70-0x000007FFFFEB0000-0x000007FFFFFAA000-memory.dmp
memory/1440-68-0x000007FFFFEB0000-0x000007FFFFFAA000-memory.dmp
memory/1440-69-0x000007FFFFEB0000-0x000007FFFFFAA000-memory.dmp
memory/2000-55-0x0000000000230000-0x0000000000255000-memory.dmp
memory/2000-57-0x00000000002F0000-0x000000000030D000-memory.dmp
memory/2000-60-0x00000000002F0000-0x000000000030D000-memory.dmp
memory/2000-73-0x0000000000400000-0x0000000000576000-memory.dmp
memory/2000-74-0x00000000002F0000-0x000000000030D000-memory.dmp
memory/2000-58-0x0000000000320000-0x0000000000321000-memory.dmp
memory/2000-59-0x00000000002F0000-0x000000000030D000-memory.dmp