Analysis

  • max time kernel
    148s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-08-2023 03:05

General

  • Target

    Project.exe

  • Size

    1.5MB

  • MD5

    b5f6c8e7070b1ee1fc60579e148daf1b

  • SHA1

    e2a7cf6d9f8d52cd0a8b469b58c268226971ce46

  • SHA256

    9a192de2a9b75fc4be67d9109678f47c8f26666e8aa9d70310d1d4960b202cf0

  • SHA512

    d95c3c9aabf43cae621f9ff69d3b46bfa9cc8eac5da2ba3387fdbfbd954e617a4009d58176a29f04ed38a94ad23f82f36593948ed3a17a62af1ec83b27e11c66

  • SSDEEP

    24576:LE9kR+dwrLhSjOBGfE0wsEcBDm4YFnjycqQxjtGOPyIzjR47cNAlO:LEoi5wEBDmvnj/xE0yIJ/NAM

Malware Config

Extracted

Family

redline

Botnet

Duc Chim To

C2

37.220.87.42:42870

Attributes
  • auth_value

    d9fe4a9a9a6e66623fb33c09b6303d5a

Extracted

Family

rhadamanthys

C2

http://179.43.142.248/update/libssl.dll

Signatures

  • Detect rhadamanthys stealer shellcode 4 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 48 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\system32\taskhostw.exe
    taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
    1⤵
      PID:2888
      • C:\Windows\SysWOW64\fontview.exe
        "C:\Windows\SYSWOW64\fontview.exe"
        2⤵
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        PID:3032
    • C:\Users\Admin\AppData\Local\Temp\Project.exe
      "C:\Users\Admin\AppData\Local\Temp\Project.exe"
      1⤵
      • Suspicious use of NtCreateUserProcessOtherParentProcess
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4900
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"
        2⤵
          PID:3568
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4900 -s 528
          2⤵
          • Program crash
          PID:4908
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4900 -s 1248
          2⤵
          • Program crash
          PID:2992
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4900 -ip 4900
        1⤵
          PID:4620
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4900 -ip 4900
          1⤵
            PID:1700

          Network

          MITRE ATT&CK Matrix ATT&CK v13

          Discovery

          Query Registry

          1
          T1012

          Peripheral Device Discovery

          1
          T1120

          System Information Discovery

          1
          T1082

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\240618515.dll
            Filesize

            334KB

            MD5

            60884dcd2970580729433008409b3e91

            SHA1

            cd5db5a80a0ddd8c5643a5557ea2535767358748

            SHA256

            41d9a97a75187b5505a81efb9142722775a13a0b2c101d4372a2683195e210fa

            SHA512

            2c269f4ae1a7087fe3d9e02775423dbd01412b266f45485642f9d69a8b7ba7eb3c20595ce16f019c3cbe442d5e1bce4dce6cdc1c945127102b2088ed52664619

          • memory/3032-16-0x0000000000CA0000-0x0000000000CD3000-memory.dmp
            Filesize

            204KB

          • memory/3032-23-0x0000000000CA0000-0x0000000000CD3000-memory.dmp
            Filesize

            204KB

          • memory/3032-32-0x0000000000CA0000-0x0000000000CD3000-memory.dmp
            Filesize

            204KB

          • memory/3032-31-0x0000000002850000-0x000000000286C000-memory.dmp
            Filesize

            112KB

          • memory/3032-30-0x0000000002830000-0x0000000002833000-memory.dmp
            Filesize

            12KB

          • memory/3032-28-0x0000000002850000-0x000000000286C000-memory.dmp
            Filesize

            112KB

          • memory/3032-11-0x0000000000CA0000-0x0000000000CD3000-memory.dmp
            Filesize

            204KB

          • memory/3032-27-0x0000000002830000-0x0000000002832000-memory.dmp
            Filesize

            8KB

          • memory/3032-26-0x0000000002850000-0x000000000286C000-memory.dmp
            Filesize

            112KB

          • memory/3032-25-0x0000000000F80000-0x0000000001080000-memory.dmp
            Filesize

            1024KB

          • memory/3568-13-0x0000000073A30000-0x00000000741E0000-memory.dmp
            Filesize

            7.7MB

          • memory/3568-17-0x0000000004FE0000-0x00000000050EA000-memory.dmp
            Filesize

            1.0MB

          • memory/3568-18-0x0000000005240000-0x0000000005250000-memory.dmp
            Filesize

            64KB

          • memory/3568-19-0x0000000004F10000-0x0000000004F4C000-memory.dmp
            Filesize

            240KB

          • memory/3568-4-0x0000000000400000-0x000000000041E000-memory.dmp
            Filesize

            120KB

          • memory/3568-6-0x0000000000400000-0x000000000041E000-memory.dmp
            Filesize

            120KB

          • memory/3568-22-0x0000000073A30000-0x00000000741E0000-memory.dmp
            Filesize

            7.7MB

          • memory/3568-14-0x00000000053F0000-0x0000000005A08000-memory.dmp
            Filesize

            6.1MB

          • memory/3568-15-0x0000000004E70000-0x0000000004E82000-memory.dmp
            Filesize

            72KB

          • memory/4900-0-0x00000000028D0000-0x0000000002A23000-memory.dmp
            Filesize

            1.3MB

          • memory/4900-2-0x000000000B110000-0x000000000B24B000-memory.dmp
            Filesize

            1.2MB

          • memory/4900-1-0x00000000028D0000-0x0000000002A23000-memory.dmp
            Filesize

            1.3MB

          • memory/4900-21-0x000000000B110000-0x000000000B24B000-memory.dmp
            Filesize

            1.2MB

          • memory/4900-20-0x00000000028D0000-0x0000000002A23000-memory.dmp
            Filesize

            1.3MB

          • memory/4900-3-0x000000000B110000-0x000000000B24B000-memory.dmp
            Filesize

            1.2MB

          • memory/4900-34-0x00000000028D0000-0x0000000002A23000-memory.dmp
            Filesize

            1.3MB