Analysis
-
max time kernel
36s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
28-03-2023 06:14
Static task
static1
Behavioral task
behavioral1
Sample
f065e29b36913d2895d59ca7bafb1adf.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
f065e29b36913d2895d59ca7bafb1adf.exe
Resource
win10v2004-20230220-en
General
-
Target
f065e29b36913d2895d59ca7bafb1adf.exe
-
Size
328KB
-
MD5
f065e29b36913d2895d59ca7bafb1adf
-
SHA1
2343abf4653cc0204b2c83c62f3d7f22c9fd1313
-
SHA256
49a63228b6b573e791851eda054dd17b8397ec6eef267e882dbe5b7e788c08e1
-
SHA512
e24b0e9824a81fd4271e374e84eddf119c2751b4d4d79211854fa4abfdb68b1596aa6cdba0f227f56ba71219f5103f804cd933eb92f0412c93890ae5e03234ed
-
SSDEEP
6144:zZ5y8KQhLRjkeMtoPcAi3af05Jnb/H1ZqNquL:bAQhFjkesoUNZbf+Nqu
Malware Config
Signatures
-
Detect rhadamanthys stealer shellcode 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1768-59-0x0000000000280000-0x000000000029C000-memory.dmp family_rhadamanthys behavioral1/memory/1768-61-0x0000000000280000-0x000000000029C000-memory.dmp family_rhadamanthys behavioral1/memory/1768-63-0x0000000000280000-0x000000000029C000-memory.dmp family_rhadamanthys behavioral1/memory/1768-72-0x0000000000280000-0x000000000029C000-memory.dmp family_rhadamanthys -
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
Processes:
dllhost.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook dllhost.exe Key opened \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook dllhost.exe Key opened \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook dllhost.exe Key opened \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook dllhost.exe Key opened \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook dllhost.exe Key opened \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook dllhost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
Processes:
f065e29b36913d2895d59ca7bafb1adf.exepid process 1768 f065e29b36913d2895d59ca7bafb1adf.exe 1768 f065e29b36913d2895d59ca7bafb1adf.exe 1768 f065e29b36913d2895d59ca7bafb1adf.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
dllhost.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 dllhost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dllhost.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
f065e29b36913d2895d59ca7bafb1adf.exedllhost.exepid process 1768 f065e29b36913d2895d59ca7bafb1adf.exe 1768 f065e29b36913d2895d59ca7bafb1adf.exe 1184 dllhost.exe 1184 dllhost.exe 1184 dllhost.exe 1184 dllhost.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
f065e29b36913d2895d59ca7bafb1adf.exedescription pid process target process PID 1768 wrote to memory of 1184 1768 f065e29b36913d2895d59ca7bafb1adf.exe dllhost.exe PID 1768 wrote to memory of 1184 1768 f065e29b36913d2895d59ca7bafb1adf.exe dllhost.exe PID 1768 wrote to memory of 1184 1768 f065e29b36913d2895d59ca7bafb1adf.exe dllhost.exe PID 1768 wrote to memory of 1184 1768 f065e29b36913d2895d59ca7bafb1adf.exe dllhost.exe PID 1768 wrote to memory of 1184 1768 f065e29b36913d2895d59ca7bafb1adf.exe dllhost.exe PID 1768 wrote to memory of 1184 1768 f065e29b36913d2895d59ca7bafb1adf.exe dllhost.exe -
outlook_office_path 1 IoCs
Processes:
dllhost.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook dllhost.exe -
outlook_win_path 1 IoCs
Processes:
dllhost.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook dllhost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f065e29b36913d2895d59ca7bafb1adf.exe"C:\Users\Admin\AppData\Local\Temp\f065e29b36913d2895d59ca7bafb1adf.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\dllhost.exe"C:\Windows\system32\dllhost.exe"2⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1184-70-0x000007FFFFEB0000-0x000007FFFFFAA000-memory.dmpFilesize
1000KB
-
memory/1184-64-0x0000000000050000-0x0000000000051000-memory.dmpFilesize
4KB
-
memory/1184-73-0x000007FFFFEB0000-0x000007FFFFFAA000-memory.dmpFilesize
1000KB
-
memory/1184-69-0x000007FFFFEB0000-0x000007FFFFFAA000-memory.dmpFilesize
1000KB
-
memory/1184-66-0x000007FFFFEB0000-0x000007FFFFFAA000-memory.dmpFilesize
1000KB
-
memory/1184-68-0x000007FFFFEB0000-0x000007FFFFFAA000-memory.dmpFilesize
1000KB
-
memory/1184-67-0x000007FFFFEB0000-0x000007FFFFFAA000-memory.dmpFilesize
1000KB
-
memory/1184-65-0x00000000000E0000-0x00000000000E7000-memory.dmpFilesize
28KB
-
memory/1768-61-0x0000000000280000-0x000000000029C000-memory.dmpFilesize
112KB
-
memory/1768-56-0x0000000000400000-0x0000000000714000-memory.dmpFilesize
3.1MB
-
memory/1768-63-0x0000000000280000-0x000000000029C000-memory.dmpFilesize
112KB
-
memory/1768-62-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/1768-55-0x00000000001C0000-0x00000000001EE000-memory.dmpFilesize
184KB
-
memory/1768-71-0x0000000000400000-0x0000000000714000-memory.dmpFilesize
3.1MB
-
memory/1768-72-0x0000000000280000-0x000000000029C000-memory.dmpFilesize
112KB
-
memory/1768-59-0x0000000000280000-0x000000000029C000-memory.dmpFilesize
112KB