Analysis

  • max time kernel
    158s
  • max time network
    170s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-05-2023 12:14

General

  • Target

    bcbdacb.exe

  • Size

    1.2MB

  • MD5

    b99290063c63c1449c6d61c62f95528d

  • SHA1

    dc80d751832030dbe05bb34e691a6237e2a224b5

  • SHA256

    162833c025dda5b2154fc193bc71bc3e375794e13f6392f387839599df9d90e0

  • SHA512

    4f6b717d1c18042243f7f62009e2638fa51e2a7139285a8469e3ba2458dc658ef6ccc8401b7c1ade0742c4dd6dd7ab98c487165f0142558191e9a7192c57c19c

  • SSDEEP

    12288:UPqvdlwvVVmpmiUkWnbaczXSisUFhiqNnuJCbM/C3irgP92vjy9jhBvcS5K+xlBW:Uy5iV7bTEyhBVdhPTyITdOqa

Score
10/10

Malware Config

Signatures

  • Detect rhadamanthys stealer shellcode 3 IoCs
  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bcbdacb.exe
    "C:\Users\Admin\AppData\Local\Temp\bcbdacb.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4176
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:2508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2508-135-0x0000000000400000-0x0000000000434000-memory.dmp

    Filesize

    208KB

  • memory/2508-138-0x0000000000400000-0x0000000000434000-memory.dmp

    Filesize

    208KB

  • memory/2508-139-0x0000000000400000-0x0000000000434000-memory.dmp

    Filesize

    208KB

  • memory/2508-141-0x0000000000F60000-0x0000000000F7D000-memory.dmp

    Filesize

    116KB

  • memory/2508-142-0x0000000001090000-0x00000000010AA000-memory.dmp

    Filesize

    104KB

  • memory/2508-144-0x00000000030D0000-0x00000000040D0000-memory.dmp

    Filesize

    16.0MB

  • memory/2508-145-0x0000000000400000-0x0000000000434000-memory.dmp

    Filesize

    208KB

  • memory/2508-146-0x0000000000F60000-0x0000000000F7D000-memory.dmp

    Filesize

    116KB

  • memory/2508-147-0x0000000001090000-0x00000000010AA000-memory.dmp

    Filesize

    104KB

  • memory/2508-148-0x00000000030D0000-0x00000000040D0000-memory.dmp

    Filesize

    16.0MB

  • memory/4176-133-0x0000020BBC120000-0x0000020BBC258000-memory.dmp

    Filesize

    1.2MB

  • memory/4176-134-0x0000020BBDF70000-0x0000020BBDF80000-memory.dmp

    Filesize

    64KB