Analysis
-
max time kernel
52s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
18-06-2023 11:06
Static task
static1
Behavioral task
behavioral1
Sample
06250599.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
06250599.exe
Resource
win10v2004-20230220-en
General
-
Target
06250599.exe
-
Size
508KB
-
MD5
83243eae62ea7c139eb7850db2349334
-
SHA1
a9d0036539416423716cbc7d9cf09d44ae066b81
-
SHA256
07e766f67125c99500dac7dc2a2eab8ab38db92722ec949b1f4d18f55b717aa6
-
SHA512
4e68e82714de7df8a1f4e8fdd3a0576078fe314d4272f2e09b4d173b63ac7c28c8ab3fcb72268283d3663647c81293b725b3244747b3671c51c40f968f3767e4
-
SSDEEP
6144:vclsfJOrA4dB1oPqw2yaG6S+fXaROmJRmpvA5N89jjBVahQk666RDTBr:vcmBO072HSbErvD9jjBsWXDr
Malware Config
Signatures
-
Detect rhadamanthys stealer shellcode 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1516-57-0x00000000024F0000-0x00000000028F0000-memory.dmp family_rhadamanthys behavioral1/memory/1516-58-0x00000000024F0000-0x00000000028F0000-memory.dmp family_rhadamanthys -
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
06250599.exedescription pid process target process PID 1516 created 1240 1516 06250599.exe Explorer.EXE -
Deletes itself 1 IoCs
Processes:
certreq.exepid process 700 certreq.exe -
Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
Processes:
certreq.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook certreq.exe Key opened \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook certreq.exe Key opened \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook certreq.exe Key opened \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook certreq.exe Key opened \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook certreq.exe Key opened \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook certreq.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
certreq.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString certreq.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 certreq.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
06250599.execertreq.exepid process 1516 06250599.exe 1516 06250599.exe 1516 06250599.exe 1516 06250599.exe 700 certreq.exe 700 certreq.exe 700 certreq.exe 700 certreq.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
06250599.exedescription pid process target process PID 1516 wrote to memory of 700 1516 06250599.exe certreq.exe PID 1516 wrote to memory of 700 1516 06250599.exe certreq.exe PID 1516 wrote to memory of 700 1516 06250599.exe certreq.exe PID 1516 wrote to memory of 700 1516 06250599.exe certreq.exe PID 1516 wrote to memory of 700 1516 06250599.exe certreq.exe PID 1516 wrote to memory of 700 1516 06250599.exe certreq.exe -
outlook_office_path 1 IoCs
Processes:
certreq.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook certreq.exe -
outlook_win_path 1 IoCs
Processes:
certreq.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook certreq.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\06250599.exe"C:\Users\Admin\AppData\Local\Temp\06250599.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\certreq.exe"C:\Windows\system32\certreq.exe"2⤵
- Deletes itself
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/700-74-0x000007FFFFE80000-0x000007FFFFFAD000-memory.dmpFilesize
1.2MB
-
memory/700-82-0x000007FFFFE80000-0x000007FFFFFAD000-memory.dmpFilesize
1.2MB
-
memory/700-69-0x0000000000060000-0x0000000000063000-memory.dmpFilesize
12KB
-
memory/700-70-0x00000000002B0000-0x00000000002B7000-memory.dmpFilesize
28KB
-
memory/700-81-0x000007FFFFE80000-0x000007FFFFFAD000-memory.dmpFilesize
1.2MB
-
memory/700-80-0x000007FFFFE80000-0x000007FFFFFAD000-memory.dmpFilesize
1.2MB
-
memory/700-60-0x0000000000060000-0x0000000000063000-memory.dmpFilesize
12KB
-
memory/700-79-0x000007FFFFE80000-0x000007FFFFFAD000-memory.dmpFilesize
1.2MB
-
memory/700-78-0x000007FFFFE80000-0x000007FFFFFAD000-memory.dmpFilesize
1.2MB
-
memory/700-71-0x000007FFFFE80000-0x000007FFFFFAD000-memory.dmpFilesize
1.2MB
-
memory/700-77-0x000007FFFFE80000-0x000007FFFFFAD000-memory.dmpFilesize
1.2MB
-
memory/700-75-0x000007FFFFE80000-0x000007FFFFFAD000-memory.dmpFilesize
1.2MB
-
memory/700-73-0x000007FFFFE80000-0x000007FFFFFAD000-memory.dmpFilesize
1.2MB
-
memory/700-72-0x000007FFFFE80000-0x000007FFFFFAD000-memory.dmpFilesize
1.2MB
-
memory/1516-68-0x0000000000400000-0x0000000000964000-memory.dmpFilesize
5.4MB
-
memory/1516-54-0x0000000000220000-0x0000000000269000-memory.dmpFilesize
292KB
-
memory/1516-55-0x0000000000270000-0x00000000002E1000-memory.dmpFilesize
452KB
-
memory/1516-56-0x0000000000320000-0x0000000000327000-memory.dmpFilesize
28KB
-
memory/1516-67-0x0000000002450000-0x0000000002486000-memory.dmpFilesize
216KB
-
memory/1516-61-0x0000000002450000-0x0000000002486000-memory.dmpFilesize
216KB
-
memory/1516-59-0x0000000000400000-0x0000000000964000-memory.dmpFilesize
5.4MB
-
memory/1516-58-0x00000000024F0000-0x00000000028F0000-memory.dmpFilesize
4.0MB
-
memory/1516-57-0x00000000024F0000-0x00000000028F0000-memory.dmpFilesize
4.0MB