Analysis
-
max time kernel
38s -
max time network
35s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
20/04/2023, 00:36
Static task
static1
Behavioral task
behavioral1
Sample
setup.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
setup.exe
Resource
win10v2004-20230221-en
General
-
Target
setup.exe
-
Size
298KB
-
MD5
df16d5e9904bbaff20a19abc2649cde9
-
SHA1
9a9b44f7ac4b5ec6a31faa61444e906ef47e8467
-
SHA256
411ae76fa21378768d5038fa423837cf9909e5f91fa15e04e9a1c4a364b5b3a7
-
SHA512
67335a822f25e5f87c9ed03f3945dc92ee8cdf06326a60cfa9083b16c4ec9d8721731dcf145e281b02c7e4a252fb2e2bd9a785286164bade0b4c0d02c808dc9c
-
SSDEEP
6144:AiUlFQB0QCCJuve4fOQH+5abvsc74Rzxhl0asJg4/ve3:AFFBYx4fvKcEJa
Malware Config
Extracted
rhadamanthys
http://179.43.142.201/img/favicon.png
Signatures
-
Detect rhadamanthys stealer shellcode 4 IoCs
resource yara_rule behavioral1/memory/1480-59-0x00000000002F0000-0x000000000030C000-memory.dmp family_rhadamanthys behavioral1/memory/1480-60-0x00000000002F0000-0x000000000030C000-memory.dmp family_rhadamanthys behavioral1/memory/1480-62-0x00000000002F0000-0x000000000030C000-memory.dmp family_rhadamanthys behavioral1/memory/1480-71-0x00000000002F0000-0x000000000030C000-memory.dmp family_rhadamanthys -
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook dllhost.exe Key opened \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook dllhost.exe Key opened \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook dllhost.exe Key opened \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook dllhost.exe Key opened \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook dllhost.exe Key opened \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook dllhost.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 dllhost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dllhost.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1480 setup.exe 1480 setup.exe 1708 dllhost.exe 1708 dllhost.exe 1708 dllhost.exe 1708 dllhost.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1480 wrote to memory of 1708 1480 setup.exe 28 PID 1480 wrote to memory of 1708 1480 setup.exe 28 PID 1480 wrote to memory of 1708 1480 setup.exe 28 PID 1480 wrote to memory of 1708 1480 setup.exe 28 PID 1480 wrote to memory of 1708 1480 setup.exe 28 PID 1480 wrote to memory of 1708 1480 setup.exe 28 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook dllhost.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook dllhost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\system32\dllhost.exe"C:\Windows\system32\dllhost.exe"2⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- outlook_office_path
- outlook_win_path
PID:1708
-