Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/04/2023, 12:39

General

  • Target

    e56cbf4cd824b44a3917c63d492c768e.exe

  • Size

    315KB

  • MD5

    e56cbf4cd824b44a3917c63d492c768e

  • SHA1

    f29b7e77d3a5f72f9be167b6f80f002a202d181d

  • SHA256

    996ae2564d05f89a89a93ea723c94e3ea978386acdc085fe6c2e49252625c3be

  • SHA512

    5f2ef29f17b1bd124587fc8873a9f56714db893832b3ea202da548210419fa50625da154d72993f405bd04d10ce8d407da5ee78a43f6654d4fb21b1d42e7e226

  • SSDEEP

    6144:BPPVsutvu1Umc9W9zLsB3jgW+/v8LNa10+6RuZtkjt:BnVsuNu1Bc9Y3cTB+/v8ha1xSuGt

Malware Config

Signatures

  • Detect rhadamanthys stealer shellcode 4 IoCs
  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

  • Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e56cbf4cd824b44a3917c63d492c768e.exe
    "C:\Users\Admin\AppData\Local\Temp\e56cbf4cd824b44a3917c63d492c768e.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2480
    • C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • outlook_office_path
      • outlook_win_path
      PID:4556
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 700
      2⤵
      • Program crash
      PID:2352
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2480 -ip 2480
    1⤵
      PID:5092

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2480-149-0x00000000025A0000-0x00000000025BC000-memory.dmp

      Filesize

      112KB

    • memory/2480-148-0x0000000000400000-0x0000000000803000-memory.dmp

      Filesize

      4.0MB

    • memory/2480-138-0x00000000025A0000-0x00000000025BC000-memory.dmp

      Filesize

      112KB

    • memory/2480-140-0x00000000025A0000-0x00000000025BC000-memory.dmp

      Filesize

      112KB

    • memory/2480-141-0x0000000000920000-0x0000000000922000-memory.dmp

      Filesize

      8KB

    • memory/2480-142-0x00000000028F0000-0x00000000038F0000-memory.dmp

      Filesize

      16.0MB

    • memory/2480-143-0x00000000025A0000-0x00000000025BC000-memory.dmp

      Filesize

      112KB

    • memory/2480-134-0x0000000002550000-0x000000000257E000-memory.dmp

      Filesize

      184KB

    • memory/2480-135-0x0000000000400000-0x0000000000803000-memory.dmp

      Filesize

      4.0MB

    • memory/4556-146-0x00007FF4D1920000-0x00007FF4D1A1A000-memory.dmp

      Filesize

      1000KB

    • memory/4556-145-0x00000280C82B0000-0x00000280C82B7000-memory.dmp

      Filesize

      28KB

    • memory/4556-147-0x00007FF4D1920000-0x00007FF4D1A1A000-memory.dmp

      Filesize

      1000KB

    • memory/4556-144-0x00000280C8190000-0x00000280C8191000-memory.dmp

      Filesize

      4KB

    • memory/4556-150-0x00007FF4D1920000-0x00007FF4D1A1A000-memory.dmp

      Filesize

      1000KB

    • memory/4556-151-0x00007FF4D1920000-0x00007FF4D1A1A000-memory.dmp

      Filesize

      1000KB

    • memory/4556-152-0x00007FF4D1920000-0x00007FF4D1A1A000-memory.dmp

      Filesize

      1000KB

    • memory/4556-153-0x00007FF4D1920000-0x00007FF4D1A1A000-memory.dmp

      Filesize

      1000KB