Analysis
-
max time kernel
135s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
15/03/2023, 21:32
General
-
Target
02c1445ae78d151ad1732b8764b7e73eab55f2fb1d5a35a3965b0bdfd09e328e.exe
-
Size
363KB
-
MD5
1170fd144bb40cdedf5359dca11e1d6b
-
SHA1
832135a9f88aa5bec5532d3ee8ed90ed3fc507c4
-
SHA256
02c1445ae78d151ad1732b8764b7e73eab55f2fb1d5a35a3965b0bdfd09e328e
-
SHA512
f028d07889889ac7c33483fd73b033f973fb5d4d308c4fb5e8667e7a6a384818717f59bc17ddd3344ac26e2d6505cf5c8d7a680c244dc153f9164abecd56e345
-
SSDEEP
6144:nHsQLQZOv4Y8/l9gNW7swjVBJA0/kh0R6:nnsZOvF8/l5NRS
Score
10/10
Malware Config
Signatures
-
Detect rhadamanthys stealer shellcode 3 IoCs
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\02c1445ae78d151ad1732b8764b7e73eab55f2fb1d5a35a3965b0bdfd09e328e.exe"C:\Users\Admin\AppData\Local\Temp\02c1445ae78d151ad1732b8764b7e73eab55f2fb1d5a35a3965b0bdfd09e328e.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
184KB
-
Filesize
39.1MB
-
Filesize
112KB
-
Filesize
112KB
-
Filesize
104KB
-
Filesize
16.0MB
-
Filesize
112KB
-
Filesize
39.1MB