Analysis
- max time kernel
84s - max time network
87s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
- submitted
22/02/2023, 11:20
General
- Target a4aed7853d05c6eaa0c15223d2ee6a7d.exe
- Size 257KB
- Sample230222-nffadabb34
- SHA256 5931fac14fecb22cacb5cd495e2b49ead9bd6354ca9678257a5bc7929395db98
Malware Config
Signatures
- Detect rhadamanthys stealer shellcode 3 IoCs
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
- Blocklisted process makes network request 1 IoCs
- Loads dropped DLL 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Program crash 2 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4aed7853d05c6eaa0c15223d2ee6a7d.exe"C:\Users\Admin\AppData\Local\Temp\a4aed7853d05c6eaa0c15223d2ee6a7d.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Users\Admin\AppData\Roaming\nsis_unse567da1.dll",PrintUIEntry |5CQkOhmAAAA|1TKr5GsMwYD|67sDqg8OAAl|xYmwxC0TNSO|1k8B3tZkgiyf2sAZQByAG4XAP9sADMAMgAuAKVkHwBs8|AtBQPz8DP|ADcAMABwAEr|AHYAVwBLAFk+QQA4AEkAQicALQH|WUiD7CjoBAL|AABIg8Qow8z|zMxMiUQkGEj|iVQkEEiJTCT9CF0BSItEJDBIt4kEJIEBOEhvAAjfSMdEJBAtAesOvoEBEEiDwAGPARBugQFASDmWAHMlnwP|iwwkSAPISIuvwUiLTKsBVHsAA||RSIvKigmICPvrwWYFZUiLBCX9YDkByUiLUBhI|zvRdDZIg8Ig|0iLAkg7wnQq|2aDeEgYdRpM|4tAUGZBgzhru3QHERFLdQgREHj|EC50BUiLAOuv1UiLSP0AwWoAQP9TVVZXQVRBVe9BVkFXXQFmgTn|TVpNi|hMi|K|SIvZD4X88|BM|2NJPEGBPAlQv0UAAA+F6vPwQe+LhAmI8|CFwEi|jTwBD4TWahGDd7wJjC0BD4TH8|D|RItnIESLXxz|i3ckRItPGEz|A+FMA9lIA|H|M8lFhckPhKT+8|BNi8RBixBF|zPSSAPTigKE|8B0HUHByg0Pe77A+gABRAPQvxH|dexBgfqq|A3|fHQOg8EBSYP|wARBO8lzaev|xovBD7cMTkX|iyyLTAPrdFj7M+2qEHRRQYsU|sEA0zPJigJMi9|C6w|BycgRA8je5RABQYoA1RDtM3|AM|ZBOwy24BD+pgCDxgGD+Ahy|+7rCkiLy0H|f9VJiQT3g8XkEH|EBDtvGHKvZgH|QV9BXkFdQVzvX15dWzMXSIHs+2ABZACL6ehm|v|||0iFwA+EmNZ1IEyNrwGLKxDIM|f|6Jt9II1fBEz|jUVGM9KLy||3VCRogCBMi+AP64RrdSBFqBAzwIt905EgSIl8JCCmIP1wgCBIi|APhEv8dSCmIFBIjVYIRH+NR0BIjYwkhRG|SIvY6Hz9fiCNq1ZI3iAQ4iHM8|Do|WfvIESLBo1XCPRBIKYgWMohiYQkgNqHEt7z8IsO2iBYiWOMJHERBzCRIOgx7yD7i5wtMkyLXTpI74P7bEiKIDBMib9kJDhMi6QaMky7iVyEAYQk3IcRhu2SjRGNR0swjCTwfvPwSYvU6On8BTC7ipx4MkiNhHgyQf+A8yGNT2xEMP0YpAKD6QF184H9vHgyIVJleHVN74uEJPQiMZQk+P41AcJIO9hyOIP|+mx2M0SNSUCe+gCUQbgAmACmIECeyiL4dBlEtjDAMUnvjVQkbJEgSYPod2zoa4IwSIvOpiD|eEiF|3QSi1XzQkyOMBsxSI1MJD9A|9dIgcR0IWEkAC0ILQE=2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- outlook_office_path
- outlook_win_path
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1624 -s 5243⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 7082⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3404 -ip 34041⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 532 -p 1624 -ip 16241⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
nsis_unse567da1.dll
nsis_unse567da1.dll
memory/1624-145-0x00007FF458EF0000-0x00007FF458FEA000-memory.dmp
memory/1624-147-0x00007FF458EF0000-0x00007FF458FEA000-memory.dmp
memory/1624-152-0x00007FFA7B2F0000-0x00007FFA7B302000-memory.dmp
memory/1624-151-0x00007FF458EF0000-0x00007FF458FEA000-memory.dmp
memory/1624-143-0x00000288E3410000-0x00000288E3417000-memory.dmp
memory/1624-144-0x00007FF458EF0000-0x00007FF458FEA000-memory.dmp
memory/1624-150-0x00007FF458EF0000-0x00007FF458FEA000-memory.dmp
memory/1624-149-0x00007FF458EF0000-0x00007FF458FEA000-memory.dmp
memory/3404-148-0x0000000002360000-0x000000000237D000-memory.dmp
memory/3404-146-0x0000000000400000-0x0000000000576000-memory.dmp
memory/3404-139-0x0000000002360000-0x000000000237D000-memory.dmp
memory/3404-134-0x00000000022B0000-0x00000000022D5000-memory.dmp
memory/3404-136-0x0000000002360000-0x000000000237D000-memory.dmp
memory/3404-137-0x0000000002380000-0x000000000239A000-memory.dmp