Analysis
-
max time kernel
135s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
19/04/2023, 01:16
Static task
static1
Behavioral task
behavioral1
Sample
setup.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
setup.exe
Resource
win10v2004-20230221-en
General
-
Target
setup.exe
-
Size
424KB
-
MD5
f9916f55a46a20c8510b200e234ba773
-
SHA1
9a23bd0f39833053746b27d8f2a03eeba3b2f57d
-
SHA256
dc40df8ce62ea7db5eb023b523dfc987645557e69d4b359ef80df36f200d599c
-
SHA512
c50757b3ceb70ca8e429ddc73f91e12eb17830b6b46ebe7e09a7516df863cd75c9d38309ca27bf296d5cb8a508fb360fd44ea911d976aa703e98bddc24439de6
-
SSDEEP
6144:RdPOqD+awlv1QLShpF6Pv6EOMiNi3S1gx3KKqqs/QTTEhFzReqRIv:RdxDev1QLYj63Olvubqqs/QvIpgqCv
Malware Config
Extracted
rhadamanthys
http://179.43.142.201/img/favicon.png
Signatures
-
Detect rhadamanthys stealer shellcode 4 IoCs
resource yara_rule behavioral2/memory/4196-139-0x0000000000940000-0x000000000095C000-memory.dmp family_rhadamanthys behavioral2/memory/4196-140-0x0000000000940000-0x000000000095C000-memory.dmp family_rhadamanthys behavioral2/memory/4196-142-0x0000000000940000-0x000000000095C000-memory.dmp family_rhadamanthys behavioral2/memory/4196-150-0x0000000000940000-0x000000000095C000-memory.dmp family_rhadamanthys -
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook dllhost.exe Key opened \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook dllhost.exe Key opened \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook dllhost.exe Key opened \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook dllhost.exe Key opened \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook dllhost.exe Key opened \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook dllhost.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1232 4196 WerFault.exe 84 -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 dllhost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dllhost.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4196 setup.exe 4196 setup.exe 4136 dllhost.exe 4136 dllhost.exe 4136 dllhost.exe 4136 dllhost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4196 wrote to memory of 4136 4196 setup.exe 91 PID 4196 wrote to memory of 4136 4196 setup.exe 91 PID 4196 wrote to memory of 4136 4196 setup.exe 91 PID 4196 wrote to memory of 4136 4196 setup.exe 91 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook dllhost.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook dllhost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Windows\system32\dllhost.exe"C:\Windows\system32\dllhost.exe"2⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- outlook_office_path
- outlook_win_path
PID:4136
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 8282⤵
- Program crash
PID:1232
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4196 -ip 41961⤵PID:2140