Analysis
-
max time kernel
42s -
max time network
39s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
19/04/2023, 01:14
Static task
static1
Behavioral task
behavioral1
Sample
setup.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
setup.exe
Resource
win10v2004-20230220-en
General
-
Target
setup.exe
-
Size
424KB
-
MD5
d8bca64c81e628b416c5e99e57561664
-
SHA1
a8c69936126344413837595f8d71d861cce221a6
-
SHA256
3da7899a97dcce17b1625b2193f870f8f568b39fe520adbde6f61f7e63f5c0ae
-
SHA512
8b0d9a5faad5dd08441ed81b7c908b0fef82eea205a93c3ca41d2bc2cbd7eef19dc04e788005e6dec491e2050209fd9d3295523ae12efc5507889f26a2177147
-
SSDEEP
6144:uJw69lf7YLckt0tIetvwF6LiqpSPO/2t1imYEBLePwKT2fqxwkIv:uJnlDY1t8Ie9a6FpSBd5eIKHWfv
Malware Config
Extracted
rhadamanthys
http://179.43.142.201/img/favicon.png
Signatures
-
Detect rhadamanthys stealer shellcode 4 IoCs
resource yara_rule behavioral1/memory/1484-59-0x00000000001D0000-0x00000000001EC000-memory.dmp family_rhadamanthys behavioral1/memory/1484-61-0x00000000001D0000-0x00000000001EC000-memory.dmp family_rhadamanthys behavioral1/memory/1484-62-0x00000000001D0000-0x00000000001EC000-memory.dmp family_rhadamanthys behavioral1/memory/1484-69-0x00000000001D0000-0x00000000001EC000-memory.dmp family_rhadamanthys -
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook dllhost.exe Key opened \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook dllhost.exe Key opened \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook dllhost.exe Key opened \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook dllhost.exe Key opened \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook dllhost.exe Key opened \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook dllhost.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 dllhost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dllhost.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1484 setup.exe 1484 setup.exe 1260 dllhost.exe 1260 dllhost.exe 1260 dllhost.exe 1260 dllhost.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1484 wrote to memory of 1260 1484 setup.exe 27 PID 1484 wrote to memory of 1260 1484 setup.exe 27 PID 1484 wrote to memory of 1260 1484 setup.exe 27 PID 1484 wrote to memory of 1260 1484 setup.exe 27 PID 1484 wrote to memory of 1260 1484 setup.exe 27 PID 1484 wrote to memory of 1260 1484 setup.exe 27 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook dllhost.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook dllhost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\system32\dllhost.exe"C:\Windows\system32\dllhost.exe"2⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- outlook_office_path
- outlook_win_path
PID:1260
-