Analysis
-
max time kernel
89s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
18-03-2023 15:01
Static task
static1
Behavioral task
behavioral1
Sample
915701f1afb2c06b564be989ba6f78997b34bbe5ddf85e9edfc617487870a0be.exe
Resource
win10v2004-20230220-en
General
-
Target
915701f1afb2c06b564be989ba6f78997b34bbe5ddf85e9edfc617487870a0be.exe
-
Size
354KB
-
MD5
5b3b11362caf1ead03bb3a40c1187e12
-
SHA1
6fa8308e677dc9513f1611ce69f6d2a4f9ede2ab
-
SHA256
915701f1afb2c06b564be989ba6f78997b34bbe5ddf85e9edfc617487870a0be
-
SHA512
28bff49f32b13ef3dbbcf25c9951375a62976ab6395922cf3db82a4b7584c5a15ccbff5f6b9d02d2770bd2a0ae79a1727152fe2eb47db88b52fc69659c6d0b5a
-
SSDEEP
3072:JvgJJMFLOuP929W2iJCEYg8KpByirihhWBXuhN/e+ybwcbHn1AFzNO75MRtCcyK:GJMFLOu129/WpB4DW+yn+jUK
Malware Config
Signatures
-
Detect rhadamanthys stealer shellcode 3 IoCs
resource yara_rule behavioral1/memory/3120-139-0x0000000002CD0000-0x0000000002CEC000-memory.dmp family_rhadamanthys behavioral1/memory/3120-141-0x0000000002CD0000-0x0000000002CEC000-memory.dmp family_rhadamanthys behavioral1/memory/3120-144-0x0000000002CD0000-0x0000000002CEC000-memory.dmp family_rhadamanthys -
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 3120 915701f1afb2c06b564be989ba6f78997b34bbe5ddf85e9edfc617487870a0be.exe 3120 915701f1afb2c06b564be989ba6f78997b34bbe5ddf85e9edfc617487870a0be.exe 3120 915701f1afb2c06b564be989ba6f78997b34bbe5ddf85e9edfc617487870a0be.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1868 3120 WerFault.exe 85 -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 915701f1afb2c06b564be989ba6f78997b34bbe5ddf85e9edfc617487870a0be.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID 915701f1afb2c06b564be989ba6f78997b34bbe5ddf85e9edfc617487870a0be.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 915701f1afb2c06b564be989ba6f78997b34bbe5ddf85e9edfc617487870a0be.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 915701f1afb2c06b564be989ba6f78997b34bbe5ddf85e9edfc617487870a0be.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 915701f1afb2c06b564be989ba6f78997b34bbe5ddf85e9edfc617487870a0be.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 3120 915701f1afb2c06b564be989ba6f78997b34bbe5ddf85e9edfc617487870a0be.exe Token: SeCreatePagefilePrivilege 3120 915701f1afb2c06b564be989ba6f78997b34bbe5ddf85e9edfc617487870a0be.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\915701f1afb2c06b564be989ba6f78997b34bbe5ddf85e9edfc617487870a0be.exe"C:\Users\Admin\AppData\Local\Temp\915701f1afb2c06b564be989ba6f78997b34bbe5ddf85e9edfc617487870a0be.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3120 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 6682⤵
- Program crash
PID:1868
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3120 -ip 31201⤵PID:1688