Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
07-08-2023 09:05
General
-
Target
SecuriteInfo.com.Trojan.DownLoader45.64415.16073.8707.exe
-
Size
495KB
-
MD5
4c224ad23e402d58bbd23023bf883dc0
-
SHA1
67cbaf4b24ccf90ca845626d1ed97831ef0dd55b
-
SHA256
74a434ab27dee2234cc149fa8d34c6d5af5beaa0060ffad7523fde8ec923f983
-
SHA512
5aad2b848d6098c8cdbf58ce115ac832826e82f803aaaca5625197c445d3849f6cb256aaeeebed4bd3a5b0db92f0f957ee5de79312f4fc4b9769f8deae0b5766
-
SSDEEP
12288:hwp22VqKfpoJfgq+mugd256TJzxpQodc5X:hwp26PfOJfgbmBT5c5
Malware Config
Extracted
systembc
discordcdn8839248.com:4327
chinabar821994.com:4327
Signatures
-
Detect rhadamanthys stealer shellcode 5 IoCs
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
-
SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
-
Executes dropped EXE 1 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoader45.64415.16073.8707.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoader45.64415.16073.8707.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3004 -s 7403⤵
- Program crash
-
-
-
C:\Windows\system32\certreq.exe"C:\Windows\system32\certreq.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3004 -ip 30041⤵
-
C:\Users\Admin\AppData\Local\Microsoft\H$EtWeY.exe"C:\Users\Admin\AppData\Local\Microsoft\H$EtWeY.exe"1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
274KB
MD50ec87a33cee1594c1808267bc677d827
SHA11e078fb607d12ccdd11da03f9503ca64cb9fde32
SHA256111cc14cd4d6e43d11cd1bef261e75313c9f7f9528abf6dc0f98878cc14b189a
SHA51203613e2615d47701893e784f39a82fdcb8d30f563d65f3f890d73e0ccfd07a38cbcd2e8976cabc64478880b03cf3c334e4712f6c20ed25f2c562ea942abf4551
-
Filesize
274KB
MD50ec87a33cee1594c1808267bc677d827
SHA11e078fb607d12ccdd11da03f9503ca64cb9fde32
SHA256111cc14cd4d6e43d11cd1bef261e75313c9f7f9528abf6dc0f98878cc14b189a
SHA51203613e2615d47701893e784f39a82fdcb8d30f563d65f3f890d73e0ccfd07a38cbcd2e8976cabc64478880b03cf3c334e4712f6c20ed25f2c562ea942abf4551
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
20KB
-
Filesize
1.2MB
-
Filesize
2.0MB
-
Filesize
12KB
-
Filesize
1.2MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
12KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
20KB
-
Filesize
1024KB
-
Filesize
30.9MB
-
Filesize
1024KB
-
Filesize
216KB
-
Filesize
448KB
-
Filesize
31.1MB
-
Filesize
4.0MB
-
Filesize
31.1MB
-
Filesize
1024KB
-
Filesize
31.1MB
-
Filesize
448KB
-
Filesize
28KB
-
Filesize
216KB
-
Filesize
1024KB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB