Analysis

  • max time kernel
    119s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    13-08-2023 09:55

General

  • Target

    74a434ab27dee2234cc149fa8d34c6d5af5beaa0060ffad7523fde8ec923f983exeexe_JC.exe

  • Size

    495KB

  • MD5

    4c224ad23e402d58bbd23023bf883dc0

  • SHA1

    67cbaf4b24ccf90ca845626d1ed97831ef0dd55b

  • SHA256

    74a434ab27dee2234cc149fa8d34c6d5af5beaa0060ffad7523fde8ec923f983

  • SHA512

    5aad2b848d6098c8cdbf58ce115ac832826e82f803aaaca5625197c445d3849f6cb256aaeeebed4bd3a5b0db92f0f957ee5de79312f4fc4b9769f8deae0b5766

  • SSDEEP

    12288:hwp22VqKfpoJfgq+mugd256TJzxpQodc5X:hwp26PfOJfgbmBT5c5

Malware Config

Extracted

Family

systembc

C2

discordcdn8839248.com:4327

chinabar821994.com:4327

Signatures

  • Detect rhadamanthys stealer shellcode 5 IoCs
  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1312
      • C:\Users\Admin\AppData\Local\Temp\74a434ab27dee2234cc149fa8d34c6d5af5beaa0060ffad7523fde8ec923f983exeexe_JC.exe
        "C:\Users\Admin\AppData\Local\Temp\74a434ab27dee2234cc149fa8d34c6d5af5beaa0060ffad7523fde8ec923f983exeexe_JC.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2584
      • C:\Windows\system32\certreq.exe
        "C:\Windows\system32\certreq.exe"
        2⤵
        • Deletes itself
        • Suspicious behavior: EnumeratesProcesses
        PID:528
    • C:\Users\Admin\AppData\Local\Microsoft\%V98xcQu.exe
      "C:\Users\Admin\AppData\Local\Microsoft\%V98xcQu.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1512
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        2⤵
          PID:2808
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 108
          2⤵
          • Loads dropped DLL
          • Program crash
          PID:908

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\%V98xcQu.exe

        Filesize

        961KB

        MD5

        648e1bf1672068d725a9b8434627947e

        SHA1

        c21e0bd251e33d4464fdd376ae46fe4f01c533cf

        SHA256

        4a5fe40bf37ab130d9110fab42764841ee9f9b49af7f9bef1fb79bc377fa14e2

        SHA512

        c735fadc81e2851f930491095fbd0fb023da9a53037efdf7c989583952636023d4205aa72dd3c217935f44e53fb34cb7a0d5ef9e4baac192f4515780e59de725

      • \Users\Admin\AppData\Local\Microsoft\%V98xcQu.exe

        Filesize

        961KB

        MD5

        648e1bf1672068d725a9b8434627947e

        SHA1

        c21e0bd251e33d4464fdd376ae46fe4f01c533cf

        SHA256

        4a5fe40bf37ab130d9110fab42764841ee9f9b49af7f9bef1fb79bc377fa14e2

        SHA512

        c735fadc81e2851f930491095fbd0fb023da9a53037efdf7c989583952636023d4205aa72dd3c217935f44e53fb34cb7a0d5ef9e4baac192f4515780e59de725

      • \Users\Admin\AppData\Local\Microsoft\%V98xcQu.exe

        Filesize

        961KB

        MD5

        648e1bf1672068d725a9b8434627947e

        SHA1

        c21e0bd251e33d4464fdd376ae46fe4f01c533cf

        SHA256

        4a5fe40bf37ab130d9110fab42764841ee9f9b49af7f9bef1fb79bc377fa14e2

        SHA512

        c735fadc81e2851f930491095fbd0fb023da9a53037efdf7c989583952636023d4205aa72dd3c217935f44e53fb34cb7a0d5ef9e4baac192f4515780e59de725

      • \Users\Admin\AppData\Local\Microsoft\%V98xcQu.exe

        Filesize

        961KB

        MD5

        648e1bf1672068d725a9b8434627947e

        SHA1

        c21e0bd251e33d4464fdd376ae46fe4f01c533cf

        SHA256

        4a5fe40bf37ab130d9110fab42764841ee9f9b49af7f9bef1fb79bc377fa14e2

        SHA512

        c735fadc81e2851f930491095fbd0fb023da9a53037efdf7c989583952636023d4205aa72dd3c217935f44e53fb34cb7a0d5ef9e4baac192f4515780e59de725

      • memory/528-98-0x0000000076F90000-0x0000000077139000-memory.dmp

        Filesize

        1.7MB

      • memory/528-77-0x0000000000060000-0x0000000000063000-memory.dmp

        Filesize

        12KB

      • memory/528-90-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

        Filesize

        1.2MB

      • memory/528-92-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

        Filesize

        1.2MB

      • memory/528-63-0x0000000000060000-0x0000000000063000-memory.dmp

        Filesize

        12KB

      • memory/528-114-0x0000000076F90000-0x0000000077139000-memory.dmp

        Filesize

        1.7MB

      • memory/528-113-0x00000000000B0000-0x00000000000B2000-memory.dmp

        Filesize

        8KB

      • memory/528-89-0x0000000076F90000-0x0000000077139000-memory.dmp

        Filesize

        1.7MB

      • memory/528-93-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

        Filesize

        1.2MB

      • memory/528-78-0x00000000000B0000-0x00000000000B7000-memory.dmp

        Filesize

        28KB

      • memory/528-95-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

        Filesize

        1.2MB

      • memory/528-91-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

        Filesize

        1.2MB

      • memory/528-88-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

        Filesize

        1.2MB

      • memory/528-81-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

        Filesize

        1.2MB

      • memory/528-80-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

        Filesize

        1.2MB

      • memory/528-79-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

        Filesize

        1.2MB

      • memory/528-82-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

        Filesize

        1.2MB

      • memory/528-84-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

        Filesize

        1.2MB

      • memory/528-86-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

        Filesize

        1.2MB

      • memory/528-87-0x000007FFFFE80000-0x000007FFFFFAF000-memory.dmp

        Filesize

        1.2MB

      • memory/1512-97-0x0000000001010000-0x0000000001153000-memory.dmp

        Filesize

        1.3MB

      • memory/1512-99-0x0000000001010000-0x0000000001153000-memory.dmp

        Filesize

        1.3MB

      • memory/1512-115-0x0000000001010000-0x0000000001153000-memory.dmp

        Filesize

        1.3MB

      • memory/2584-71-0x0000000000400000-0x0000000002322000-memory.dmp

        Filesize

        31.1MB

      • memory/2584-58-0x00000000001C0000-0x00000000001C7000-memory.dmp

        Filesize

        28KB

      • memory/2584-61-0x0000000003D40000-0x0000000004140000-memory.dmp

        Filesize

        4.0MB

      • memory/2584-76-0x0000000000400000-0x0000000002322000-memory.dmp

        Filesize

        31.1MB

      • memory/2584-59-0x0000000003D40000-0x0000000004140000-memory.dmp

        Filesize

        4.0MB

      • memory/2584-75-0x0000000003D40000-0x0000000004140000-memory.dmp

        Filesize

        4.0MB

      • memory/2584-55-0x0000000000290000-0x0000000000390000-memory.dmp

        Filesize

        1024KB

      • memory/2584-73-0x0000000004810000-0x0000000004846000-memory.dmp

        Filesize

        216KB

      • memory/2584-62-0x0000000003D40000-0x0000000004140000-memory.dmp

        Filesize

        4.0MB

      • memory/2584-64-0x0000000000290000-0x0000000000390000-memory.dmp

        Filesize

        1024KB

      • memory/2584-65-0x0000000004810000-0x0000000004846000-memory.dmp

        Filesize

        216KB

      • memory/2584-56-0x0000000000400000-0x0000000002322000-memory.dmp

        Filesize

        31.1MB

      • memory/2584-57-0x0000000003AA0000-0x0000000003B10000-memory.dmp

        Filesize

        448KB

      • memory/2584-60-0x0000000003D40000-0x0000000004140000-memory.dmp

        Filesize

        4.0MB

      • memory/2808-109-0x0000000000090000-0x0000000000097000-memory.dmp

        Filesize

        28KB

      • memory/2808-108-0x0000000000090000-0x0000000000097000-memory.dmp

        Filesize

        28KB

      • memory/2808-106-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

        Filesize

        4KB

      • memory/2808-100-0x0000000000090000-0x0000000000097000-memory.dmp

        Filesize

        28KB

      • memory/2808-101-0x0000000000090000-0x0000000000097000-memory.dmp

        Filesize

        28KB