Analysis
-
max time kernel
36s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
19/04/2023, 09:24
Static task
static1
Behavioral task
behavioral1
Sample
cc.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
cc.exe
Resource
win10v2004-20230220-en
General
-
Target
cc.exe
-
Size
297KB
-
MD5
13f5cf4add70ef94cfc51508e2c618d3
-
SHA1
ac1f705b7d6bb55b8f7ba7c9d236362db5abc162
-
SHA256
a2fa00ab0203eefb3229cc6afdcc4a5a34e6501bc5d64cab6b022a63e48852f1
-
SHA512
d9e9d41c5ee4d5393628e927cf35b0ee2cac780607a4a2bc0dd1914aa5fb49d35dd21968d389d73eefc3dc162cdcc27ecba8c23499420a217ff77c00e6221078
-
SSDEEP
6144:daRxPJp7aDsBApMLQ8zkcVFzQzsNDYC5Gsa3ZSBIjmYPDWJ:iJJp7RiDqVFBNcCM3gB
Malware Config
Extracted
rhadamanthys
http://179.43.142.201/img/favicon.png
Signatures
-
Detect rhadamanthys stealer shellcode 4 IoCs
resource yara_rule behavioral1/memory/1808-59-0x00000000002E0000-0x00000000002FC000-memory.dmp family_rhadamanthys behavioral1/memory/1808-60-0x00000000002E0000-0x00000000002FC000-memory.dmp family_rhadamanthys behavioral1/memory/1808-62-0x00000000002E0000-0x00000000002FC000-memory.dmp family_rhadamanthys behavioral1/memory/1808-71-0x00000000002E0000-0x00000000002FC000-memory.dmp family_rhadamanthys -
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook dllhost.exe Key opened \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook dllhost.exe Key opened \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook dllhost.exe Key opened \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook dllhost.exe Key opened \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook dllhost.exe Key opened \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook dllhost.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 dllhost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dllhost.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1808 cc.exe 1808 cc.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1808 wrote to memory of 1976 1808 cc.exe 28 PID 1808 wrote to memory of 1976 1808 cc.exe 28 PID 1808 wrote to memory of 1976 1808 cc.exe 28 PID 1808 wrote to memory of 1976 1808 cc.exe 28 PID 1808 wrote to memory of 1976 1808 cc.exe 28 PID 1808 wrote to memory of 1976 1808 cc.exe 28 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook dllhost.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook dllhost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc.exe"C:\Users\Admin\AppData\Local\Temp\cc.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\system32\dllhost.exe"C:\Windows\system32\dllhost.exe"2⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- outlook_office_path
- outlook_win_path
PID:1976
-