Analysis

  • max time kernel
    89s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-03-2023 15:01

General

  • Target

    915701f1afb2c06b564be989ba6f78997b34bbe5ddf85e9edfc617487870a0be.exe

  • Size

    354KB

  • MD5

    5b3b11362caf1ead03bb3a40c1187e12

  • SHA1

    6fa8308e677dc9513f1611ce69f6d2a4f9ede2ab

  • SHA256

    915701f1afb2c06b564be989ba6f78997b34bbe5ddf85e9edfc617487870a0be

  • SHA512

    28bff49f32b13ef3dbbcf25c9951375a62976ab6395922cf3db82a4b7584c5a15ccbff5f6b9d02d2770bd2a0ae79a1727152fe2eb47db88b52fc69659c6d0b5a

  • SSDEEP

    3072:JvgJJMFLOuP929W2iJCEYg8KpByirihhWBXuhN/e+ybwcbHn1AFzNO75MRtCcyK:GJMFLOu129/WpB4DW+yn+jUK

Score
10/10

Malware Config

Signatures

  • Detect rhadamanthys stealer shellcode 3 IoCs
  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\915701f1afb2c06b564be989ba6f78997b34bbe5ddf85e9edfc617487870a0be.exe
    "C:\Users\Admin\AppData\Local\Temp\915701f1afb2c06b564be989ba6f78997b34bbe5ddf85e9edfc617487870a0be.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:3120
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 668
      2⤵
      • Program crash
      PID:1868
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3120 -ip 3120
    1⤵
      PID:1688

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3120-134-0x0000000002CA0000-0x0000000002CCE000-memory.dmp

      Filesize

      184KB

    • memory/3120-135-0x0000000000400000-0x0000000002B08000-memory.dmp

      Filesize

      39.0MB

    • memory/3120-136-0x0000000002CA0000-0x0000000002CCE000-memory.dmp

      Filesize

      184KB

    • memory/3120-139-0x0000000002CD0000-0x0000000002CEC000-memory.dmp

      Filesize

      112KB

    • memory/3120-138-0x0000000000400000-0x0000000002B08000-memory.dmp

      Filesize

      39.0MB

    • memory/3120-141-0x0000000002CD0000-0x0000000002CEC000-memory.dmp

      Filesize

      112KB

    • memory/3120-142-0x0000000002CF0000-0x0000000002CF2000-memory.dmp

      Filesize

      8KB

    • memory/3120-143-0x0000000004C80000-0x0000000005C80000-memory.dmp

      Filesize

      16.0MB

    • memory/3120-144-0x0000000002CD0000-0x0000000002CEC000-memory.dmp

      Filesize

      112KB