Analysis

  • max time kernel
    141s
  • max time network
    143s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    14/04/2023, 23:10

General

  • Target

    1fc88500422917840f534cba0275b2d13a9b78ec791e445b7c6e53fa88fc351d.exe

  • Size

    423KB

  • MD5

    8aa3b8f3bfe27c28a62d9cff03b9320e

  • SHA1

    581cf8b925b2321b9a27f615787454d682942f07

  • SHA256

    1fc88500422917840f534cba0275b2d13a9b78ec791e445b7c6e53fa88fc351d

  • SHA512

    7ef7860c1e9c62c4d51bc54b7333e285cc031df36ee4e76d2223eec26acee2044cf8363cc0a44a022168da69e8cc988d8b76850c21c0c752cef8f9641134e540

  • SSDEEP

    6144:7wNxDechb6OnPlIFtpMt65h/P+FdD6qYfOcXApVUIxCWxi:7wXeIpnPlStph1PMD6PXDn

Malware Config

Extracted

Family

rhadamanthys

C2

http://179.43.142.201/img/favicon.png

Signatures

  • Detect rhadamanthys stealer shellcode 4 IoCs
  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

  • Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1fc88500422917840f534cba0275b2d13a9b78ec791e445b7c6e53fa88fc351d.exe
    "C:\Users\Admin\AppData\Local\Temp\1fc88500422917840f534cba0275b2d13a9b78ec791e445b7c6e53fa88fc351d.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3640
    • C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • outlook_office_path
      • outlook_win_path
      PID:4640

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/3640-136-0x0000000000AB0000-0x0000000000ACC000-memory.dmp

          Filesize

          112KB

        • memory/3640-135-0x0000000000400000-0x000000000080E000-memory.dmp

          Filesize

          4.1MB

        • memory/3640-124-0x0000000000AB0000-0x0000000000ACC000-memory.dmp

          Filesize

          112KB

        • memory/3640-125-0x0000000000AB0000-0x0000000000ACC000-memory.dmp

          Filesize

          112KB

        • memory/3640-126-0x0000000002570000-0x0000000002572000-memory.dmp

          Filesize

          8KB

        • memory/3640-127-0x0000000000AB0000-0x0000000000ACC000-memory.dmp

          Filesize

          112KB

        • memory/3640-120-0x0000000000A80000-0x0000000000AAE000-memory.dmp

          Filesize

          184KB

        • memory/3640-129-0x0000000002570000-0x0000000002573000-memory.dmp

          Filesize

          12KB

        • memory/3640-121-0x0000000000400000-0x000000000080E000-memory.dmp

          Filesize

          4.1MB

        • memory/4640-131-0x00007FF6B3F90000-0x00007FF6B408A000-memory.dmp

          Filesize

          1000KB

        • memory/4640-130-0x0000022435D00000-0x0000022435D07000-memory.dmp

          Filesize

          28KB

        • memory/4640-134-0x00007FF6B3F90000-0x00007FF6B408A000-memory.dmp

          Filesize

          1000KB

        • memory/4640-128-0x0000022435D50000-0x0000022435D51000-memory.dmp

          Filesize

          4KB

        • memory/4640-137-0x00007FF6B3F90000-0x00007FF6B408A000-memory.dmp

          Filesize

          1000KB

        • memory/4640-138-0x00007FF6B3F90000-0x00007FF6B408A000-memory.dmp

          Filesize

          1000KB

        • memory/4640-139-0x00007FF6B3F90000-0x00007FF6B408A000-memory.dmp

          Filesize

          1000KB

        • memory/4640-140-0x00007FF6B3F90000-0x00007FF6B408A000-memory.dmp

          Filesize

          1000KB