Analysis
-
max time kernel
31s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
30-05-2023 10:09
General
-
Target
c4a708cd4c0a21ec777c1933a4347d16.exe
-
Size
4.2MB
-
MD5
c4a708cd4c0a21ec777c1933a4347d16
-
SHA1
33334d0fbee53016b1385078816d21c70abeb1a5
-
SHA256
d5de4cb74e865fdf0a79cfa5d636bd8158bf461ba4e0c59261fe7d133bdd9407
-
SHA512
518e4ef04c78791f788faa8e2c0384818a769d8b411b6e0a2327855b31f2128ecddd88aae4ead2f0fc684b8d85115faf69c077a24a169b66109401a79026beb7
-
SSDEEP
6144:5WC6Lf8HuLk5z2TPQIonfaFi9G0ei+jvbalhZV9W71:5WC6DiUk5zq4ffaFQG0qjvWPZW
Score
10/10
Malware Config
Extracted
Family
rhadamanthys
C2
http://31.220.57.50/abctop/oy7xup.thms
Signatures
-
Detect rhadamanthys stealer shellcode 3 IoCs
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4a708cd4c0a21ec777c1933a4347d16.exe"C:\Users\Admin\AppData\Local\Temp\c4a708cd4c0a21ec777c1933a4347d16.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
184KB
-
Filesize
3.1MB
-
Filesize
112KB
-
Filesize
112KB
-
Filesize
4KB
-
Filesize
3.1MB
-
Filesize
112KB