Analysis
- max time kernel
52s - max time network
73s - platform
windows10-1703_x64 - resource
win10-20230220-en - resource tags
- submitted
18/04/2023, 23:41
General
- Target 3d7566812366cea0ea926397e36f469b1b8ff5abd26fa0841dbecfbc7691530e.exe
- Size 423KB
- Sample230418-3ptlpagg6v
- SHA256 3d7566812366cea0ea926397e36f469b1b8ff5abd26fa0841dbecfbc7691530e
Malware Config
Extracted
-
rhadamanthys
-
http://179.43.142.201/img/favicon.png
Signatures
- Detect rhadamanthys stealer shellcode 4 IoCs
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
- Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d7566812366cea0ea926397e36f469b1b8ff5abd26fa0841dbecfbc7691530e.exe"C:\Users\Admin\AppData\Local\Temp\3d7566812366cea0ea926397e36f469b1b8ff5abd26fa0841dbecfbc7691530e.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\dllhost.exe"C:\Windows\system32\dllhost.exe"2⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3608-133-0x0000000002570000-0x000000000258C000-memory.dmp
memory/3608-132-0x0000000000400000-0x000000000080F000-memory.dmp
memory/3608-121-0x0000000002570000-0x000000000258C000-memory.dmp
memory/3608-122-0x0000000002570000-0x000000000258C000-memory.dmp
memory/3608-123-0x00000000001D0000-0x00000000001D2000-memory.dmp
memory/3608-124-0x0000000002570000-0x000000000258C000-memory.dmp
memory/3608-117-0x0000000002540000-0x000000000256E000-memory.dmp
memory/3608-128-0x00000000001D0000-0x00000000001D3000-memory.dmp
memory/3608-118-0x0000000000400000-0x000000000080F000-memory.dmp
memory/4856-130-0x00007FF64BC70000-0x00007FF64BD6A000-memory.dmp
memory/4856-129-0x000001ABE6770000-0x000001ABE6777000-memory.dmp
memory/4856-131-0x00007FF64BC70000-0x00007FF64BD6A000-memory.dmp
memory/4856-125-0x000001ABE67C0000-0x000001ABE67C1000-memory.dmp
memory/4856-134-0x00007FF64BC70000-0x00007FF64BD6A000-memory.dmp
memory/4856-135-0x00007FF64BC70000-0x00007FF64BD6A000-memory.dmp
memory/4856-136-0x00007FF64BC70000-0x00007FF64BD6A000-memory.dmp
memory/4856-137-0x00007FF64BC70000-0x00007FF64BD6A000-memory.dmp