Analysis
- max time kernel
31s - max time network
34s - platform
windows7_x64 - resource
win7-20230220-en - resource tags
- submitted
27/02/2023, 16:29
General
- Target file.exe
- Size 250KB
- Sample230227-ty883aee87
- SHA256 b552cc179a2eed96fb9c0e315459707f0af0fc96cbe20fc37904456fbd51f771
Malware Config
Signatures
- Detect rhadamanthys stealer shellcode 3 IoCs
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
- Blocklisted process makes network request 1 IoCs
- Loads dropped DLL 4 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Users\Admin\AppData\Roaming\nsis_uns6c20f9.dll",PrintUIEntry |5CQkOhmAAAA|1TKr5GsMwYD|67sDqg8OAAl|xYmwxC0TNSO|1k8B3tZkgiyf2sAZQByAG4XAP9sADMAMgAuAKVkHwBs8|AtBQPz8Gv|AEYAUwAwAHbrAEojAGghAEYAd+8ANABvKwRZSIP|7CjoBAIAAEj|g8Qow8zMzEz|iUQkGEiJVCS|EEiJTCQIXQFI|4tEJDBIiQQk9oEBOEhvAAhIx0TbJBAtAesOgQEQSNeDwAGPARCBAUBI7TmWAHMlnwOLDCT|SAPISIvBSIv1TKsBVHsAA9FIi3|KigmICOvBZgW|ZUiLBCVg8|Az|8lIi1AYSDvR|3Q2SIPCIEiL|wJIO8J0KmaD|3hIGHUaTItA|1BmQYM4a3QH7hERS3UIERB4EC7|dAVIiwDr1Ujri0j9AMFqAEBTVf9WV0FUQVVBVvtBV10BZoE5TVr|TYv4TIvySIvv2Q+F|PPwTGNJ|zxBgTwJUEUA7wAPherz8EGLhPsJiPPwhcBIjTzvAQ+E1moRg7wJ3YwtAQ+Ex|PwRIv|ZyBEi18ci3f|JESLTxhMA+H|TAPZSAPxM8m|RYXJD4Sk8|BN|4vEQYsQRTPS|0gD04oChMB0|x1BwcoND77A3voAAUQD0L8Rdez|QYH6qvwNfHT|DoPBAUmDwAT|QTvJc2nrxov|wQ+3DE5Fiyz|i0wD63RYM+2+qhB0UUGLFMEA0|8zyYoCTIvC67cPwcnIEQPI5RAB90GKANUQ7TPAM5|2QTsMtuAQpgCD|8YBg|gIcu7r|wpIi8tB|9VJ34kE94PF5BDEBN87bxhyr2YBQV||QV5BXUFcX177XVszF0iB7GAB|mQAi+noZv7||79IhcAPhJh1IEz1ja8BiysQyDP|6P2bfSCNXwRMjUX|RjPSi8v|VCT9aIAgTIvgD4RrenUgRagQM8CL05EgX0iJfCQgpiBwgCA|SIvwD4RLdSCmIP9QSI1WCESNR99ASI2MJIURSIvv2Oh8|X4gjVZIat4gEOIhzPPw6GfvID9EiwaNVwhBIKYgvVjKIYmEJICHEt728|CLDtogWImMJNhxEQcwkSDoMe8gi5z+LTJMi106SIP7+2xIiiAwTIlkJO84TIukGjJMiVxuhAGEJNyHEYaSjRG7jUdLMIwk8PPwSd+L1Ojp|AUwipzueDJIjYR4MkGA838hjU9sRDAYpAJ|g+kBdfOBvHgy|yFSZXh1TYuEuyT0IjGUJPg1AcL|SDvYcjiD+my|djNEjUlA+gCUp0G4AJgApiBAyiL453QZRLYwwDFJjVT7JGyRIEmD6Gzo3WuCMEiLzqYgeEj|hf90EotVQkz8jjAbMUiNTCRA|w|XSIHEdCFhJC0ILQE=2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
nsis_uns6c20f9.dll
nsis_uns6c20f9.dll
nsis_uns6c20f9.dll
nsis_uns6c20f9.dll
nsis_uns6c20f9.dll
memory/1920-73-0x0000000000400000-0x0000000000582000-memory.dmp
memory/1920-60-0x0000000000680000-0x000000000069D000-memory.dmp
memory/1920-57-0x0000000000680000-0x000000000069D000-memory.dmp
memory/1920-55-0x00000000001B0000-0x00000000001D5000-memory.dmp
memory/1920-58-0x0000000000280000-0x0000000000281000-memory.dmp
memory/1920-74-0x0000000000680000-0x000000000069D000-memory.dmp
memory/1976-69-0x000007FFFFEB0000-0x000007FFFFFAA000-memory.dmp
memory/1976-70-0x000007FFFFEB0000-0x000007FFFFFAA000-memory.dmp
memory/1976-71-0x000007FFFFEB0000-0x000007FFFFFAA000-memory.dmp
memory/1976-72-0x000007FFFFEB0000-0x000007FFFFFAA000-memory.dmp
memory/1976-68-0x000007FFFFEB0000-0x000007FFFFFAA000-memory.dmp
memory/1976-67-0x0000000000420000-0x0000000000427000-memory.dmp
memory/1976-75-0x000007FFFFEB0000-0x000007FFFFFAA000-memory.dmp
memory/1976-76-0x000007FEFAF00000-0x000007FEFAF12000-memory.dmp