Analysis

  • max time kernel
    57s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/04/2023, 11:20

General

  • Target

    4db45dd088c5399bba9a0a89aa5cfad1a11bf57c0e7a870d76e84000cc025af1.exe

  • Size

    298KB

  • MD5

    2da57ef6b403fc6698ff7b95a9ce9362

  • SHA1

    7218e330e5ed923dce0575673fe51c67727b2699

  • SHA256

    4db45dd088c5399bba9a0a89aa5cfad1a11bf57c0e7a870d76e84000cc025af1

  • SHA512

    e6330a5ca330ad065ce7766bff79427d16b9eb7903ba694b24bb6b87b08d498e429e65c201c53f12447fdfc572e7986972c4211518646abcc3c39b45e2f58a1e

  • SSDEEP

    6144:TR9dkPnr96XT/taFvSxC6szUttiCYPDWJB:vGPnrAT4HPzqd

Malware Config

Extracted

Family

rhadamanthys

C2

http://179.43.142.201/img/favicon.png

Signatures

  • Detect rhadamanthys stealer shellcode 3 IoCs
  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

  • Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4db45dd088c5399bba9a0a89aa5cfad1a11bf57c0e7a870d76e84000cc025af1.exe
    "C:\Users\Admin\AppData\Local\Temp\4db45dd088c5399bba9a0a89aa5cfad1a11bf57c0e7a870d76e84000cc025af1.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4700
    • C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • outlook_office_path
      • outlook_win_path
      PID:1864

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1864-149-0x00007FF4AA4E0000-0x00007FF4AA5DA000-memory.dmp

          Filesize

          1000KB

        • memory/1864-146-0x00007FF4AA4E0000-0x00007FF4AA5DA000-memory.dmp

          Filesize

          1000KB

        • memory/1864-153-0x00007FF4AA4E0000-0x00007FF4AA5DA000-memory.dmp

          Filesize

          1000KB

        • memory/1864-152-0x00007FF4AA4E0000-0x00007FF4AA5DA000-memory.dmp

          Filesize

          1000KB

        • memory/1864-151-0x00007FF4AA4E0000-0x00007FF4AA5DA000-memory.dmp

          Filesize

          1000KB

        • memory/1864-142-0x000001C447080000-0x000001C447081000-memory.dmp

          Filesize

          4KB

        • memory/1864-150-0x00007FF4AA4E0000-0x00007FF4AA5DA000-memory.dmp

          Filesize

          1000KB

        • memory/1864-144-0x000001C447390000-0x000001C447397000-memory.dmp

          Filesize

          28KB

        • memory/1864-145-0x00007FF4AA4E0000-0x00007FF4AA5DA000-memory.dmp

          Filesize

          1000KB

        • memory/4700-147-0x0000000000400000-0x0000000002BA4000-memory.dmp

          Filesize

          39.6MB

        • memory/4700-135-0x0000000000400000-0x0000000002BA4000-memory.dmp

          Filesize

          39.6MB

        • memory/4700-148-0x0000000002C20000-0x0000000002C3C000-memory.dmp

          Filesize

          112KB

        • memory/4700-134-0x00000000047E0000-0x000000000480E000-memory.dmp

          Filesize

          184KB

        • memory/4700-143-0x0000000004830000-0x0000000004832000-memory.dmp

          Filesize

          8KB

        • memory/4700-141-0x0000000002C20000-0x0000000002C3C000-memory.dmp

          Filesize

          112KB

        • memory/4700-140-0x0000000002C50000-0x0000000002C6A000-memory.dmp

          Filesize

          104KB

        • memory/4700-139-0x0000000002C20000-0x0000000002C3C000-memory.dmp

          Filesize

          112KB