Analysis
-
max time kernel
48s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
19/04/2023, 01:16
Static task
static1
Behavioral task
behavioral1
Sample
setup.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
setup.exe
Resource
win10v2004-20230220-en
General
-
Target
setup.exe
-
Size
424KB
-
MD5
216277e82f9eefaa3f01f6e941d86edf
-
SHA1
3667fd08ac1afbf3fefda60315fb9b6c4bbc9c25
-
SHA256
000927343397bd9ae9b8520a13d1915cf029e7bb5b2217bf42d7240dddbbb203
-
SHA512
095ca03f0c5e156e1c640ed505c35cdd581da7c51c8825950c6f152ad0760e83e670ae184af979a1bca947711cb08d30d39e15f289d6de109670e0f1e7ed8354
-
SSDEEP
6144:oE+7+CiPfzR4uJmYIN3jNjH5OFXUi9vafi6xs2A8W69shIv:oE5jjR4uJ1INTNj5YXVQf/N9sSv
Malware Config
Extracted
rhadamanthys
http://179.43.142.201/img/favicon.png
Signatures
-
Detect rhadamanthys stealer shellcode 4 IoCs
resource yara_rule behavioral1/memory/1724-59-0x0000000000280000-0x000000000029C000-memory.dmp family_rhadamanthys behavioral1/memory/1724-60-0x0000000000280000-0x000000000029C000-memory.dmp family_rhadamanthys behavioral1/memory/1724-62-0x0000000000280000-0x000000000029C000-memory.dmp family_rhadamanthys behavioral1/memory/1724-72-0x0000000000280000-0x000000000029C000-memory.dmp family_rhadamanthys -
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook dllhost.exe Key opened \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook dllhost.exe Key opened \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook dllhost.exe Key opened \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook dllhost.exe Key opened \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook dllhost.exe Key opened \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook dllhost.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dllhost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 dllhost.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1724 setup.exe 1724 setup.exe 432 dllhost.exe 432 dllhost.exe 432 dllhost.exe 432 dllhost.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1724 wrote to memory of 432 1724 setup.exe 28 PID 1724 wrote to memory of 432 1724 setup.exe 28 PID 1724 wrote to memory of 432 1724 setup.exe 28 PID 1724 wrote to memory of 432 1724 setup.exe 28 PID 1724 wrote to memory of 432 1724 setup.exe 28 PID 1724 wrote to memory of 432 1724 setup.exe 28 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook dllhost.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook dllhost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\system32\dllhost.exe"C:\Windows\system32\dllhost.exe"2⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- outlook_office_path
- outlook_win_path
PID:432
-