Analysis
-
max time kernel
127s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
18-09-2023 11:14
Static task
static1
Behavioral task
behavioral1
Sample
buildcreate.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
buildcreate.exe
Resource
win10v2004-20230915-en
General
-
Target
buildcreate.exe
-
Size
916KB
-
MD5
015f3b383e71a5e9c497bc04723ce7ac
-
SHA1
f2bd3a71e07524db00b657731db1e8326bc505e8
-
SHA256
28cfcf483bbe8d2325b9d5b837379d803207d21bfaccde025d5543fc895815a6
-
SHA512
807390c15267d5d82e3838ad4c399d67d40636078aef82b6e8617868ba1ca58ecc8218dd5841b0672383aad71931854ddbf6cd3574c6be389631549fb6a10d75
-
SSDEEP
24576:Cgj9azxeqTtcA9U8CY9whhbHHxDeqk9eEzjGGFQjc:Ta1N2A96hRleq1EzjGGFl
Malware Config
Signatures
-
Detect rhadamanthys stealer shellcode 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3736-31-0x0000000002A10000-0x0000000002E10000-memory.dmp family_rhadamanthys behavioral2/memory/3736-33-0x0000000002A10000-0x0000000002E10000-memory.dmp family_rhadamanthys behavioral2/memory/3736-34-0x0000000002A10000-0x0000000002E10000-memory.dmp family_rhadamanthys behavioral2/memory/3736-44-0x0000000002A10000-0x0000000002E10000-memory.dmp family_rhadamanthys -
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
AddInProcess32.exedescription pid process target process PID 3736 created 3120 3736 AddInProcess32.exe Explorer.EXE -
Executes dropped EXE 2 IoCs
Processes:
parentperformance.exeparenttperformance.exepid process 3200 parentperformance.exe 324 parenttperformance.exe -
Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
Processes:
certreq.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook certreq.exe Key opened \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook certreq.exe Key opened \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook certreq.exe Key opened \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook certreq.exe Key opened \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook certreq.exe Key opened \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook certreq.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
buildcreate.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" buildcreate.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
parentperformance.exedescription pid process target process PID 3200 set thread context of 3736 3200 parentperformance.exe AddInProcess32.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
certreq.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString certreq.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 certreq.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
parentperformance.exeparenttperformance.exeAddInProcess32.execertreq.exepid process 3200 parentperformance.exe 3200 parentperformance.exe 3200 parentperformance.exe 324 parenttperformance.exe 324 parenttperformance.exe 3736 AddInProcess32.exe 3736 AddInProcess32.exe 3736 AddInProcess32.exe 3736 AddInProcess32.exe 324 parenttperformance.exe 848 certreq.exe 848 certreq.exe 848 certreq.exe 848 certreq.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
parentperformance.exeparenttperformance.exedescription pid process Token: SeDebugPrivilege 3200 parentperformance.exe Token: SeDebugPrivilege 324 parenttperformance.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
buildcreate.exeparentperformance.exeAddInProcess32.exedescription pid process target process PID 4320 wrote to memory of 3200 4320 buildcreate.exe parentperformance.exe PID 4320 wrote to memory of 3200 4320 buildcreate.exe parentperformance.exe PID 4320 wrote to memory of 3200 4320 buildcreate.exe parentperformance.exe PID 3200 wrote to memory of 3736 3200 parentperformance.exe AddInProcess32.exe PID 3200 wrote to memory of 3736 3200 parentperformance.exe AddInProcess32.exe PID 3200 wrote to memory of 3736 3200 parentperformance.exe AddInProcess32.exe PID 3200 wrote to memory of 3736 3200 parentperformance.exe AddInProcess32.exe PID 3200 wrote to memory of 3736 3200 parentperformance.exe AddInProcess32.exe PID 3200 wrote to memory of 3736 3200 parentperformance.exe AddInProcess32.exe PID 3200 wrote to memory of 3736 3200 parentperformance.exe AddInProcess32.exe PID 3200 wrote to memory of 3736 3200 parentperformance.exe AddInProcess32.exe PID 4320 wrote to memory of 324 4320 buildcreate.exe parenttperformance.exe PID 4320 wrote to memory of 324 4320 buildcreate.exe parenttperformance.exe PID 4320 wrote to memory of 324 4320 buildcreate.exe parenttperformance.exe PID 3736 wrote to memory of 848 3736 AddInProcess32.exe certreq.exe PID 3736 wrote to memory of 848 3736 AddInProcess32.exe certreq.exe PID 3736 wrote to memory of 848 3736 AddInProcess32.exe certreq.exe PID 3736 wrote to memory of 848 3736 AddInProcess32.exe certreq.exe -
outlook_office_path 1 IoCs
Processes:
certreq.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook certreq.exe -
outlook_win_path 1 IoCs
Processes:
certreq.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook certreq.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\buildcreate.exe"C:\Users\Admin\AppData\Local\Temp\buildcreate.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\parentperformance.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\parentperformance.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\parenttperformance.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\parenttperformance.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\certreq.exe"C:\Windows\system32\certreq.exe"2⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\parentperformance.exeFilesize
1.1MB
MD56fd4cb22557a5c357736ef38187d83d5
SHA14d84f6b8f36667a699ce0cb2b182b9b511139208
SHA256465f0d56c2b9e1d615baaba0e31b0d640652d59e4dbcf669b27dbe1b8927da86
SHA512fb54aed47cba7fd28b49ba66e6295af24566a4647abe1bd4c4a2666deb18aa20886c4ccc7b4a8ea86d55b6b45645cedc2fc540f75097fca76d63963db37be2d4
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\parentperformance.exeFilesize
1.1MB
MD56fd4cb22557a5c357736ef38187d83d5
SHA14d84f6b8f36667a699ce0cb2b182b9b511139208
SHA256465f0d56c2b9e1d615baaba0e31b0d640652d59e4dbcf669b27dbe1b8927da86
SHA512fb54aed47cba7fd28b49ba66e6295af24566a4647abe1bd4c4a2666deb18aa20886c4ccc7b4a8ea86d55b6b45645cedc2fc540f75097fca76d63963db37be2d4
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\parenttperformance.exeFilesize
1.1MB
MD595175fc43f1512a931adca0c84e13e29
SHA107ec892d9aeba678db91f28f17c433f0ceca0461
SHA256ad3231047c5c02a86fe56261fb087b58adfe25dc77bd57f3698e676500191295
SHA5125d7e79e90127ae88ae9c09d910c0cfe5779753d3def9f8a1dc4ed234e1513796cb6e28d9599250f968993a5131de49827aa9e704ef9b2639a72b03a40acf489c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\parenttperformance.exeFilesize
1.1MB
MD595175fc43f1512a931adca0c84e13e29
SHA107ec892d9aeba678db91f28f17c433f0ceca0461
SHA256ad3231047c5c02a86fe56261fb087b58adfe25dc77bd57f3698e676500191295
SHA5125d7e79e90127ae88ae9c09d910c0cfe5779753d3def9f8a1dc4ed234e1513796cb6e28d9599250f968993a5131de49827aa9e704ef9b2639a72b03a40acf489c
-
memory/324-43-0x0000000074400000-0x0000000074BB0000-memory.dmpFilesize
7.7MB
-
memory/324-46-0x0000000005440000-0x0000000005450000-memory.dmpFilesize
64KB
-
memory/324-47-0x0000000005440000-0x0000000005450000-memory.dmpFilesize
64KB
-
memory/324-29-0x0000000000FF0000-0x0000000001110000-memory.dmpFilesize
1.1MB
-
memory/324-28-0x0000000074400000-0x0000000074BB0000-memory.dmpFilesize
7.7MB
-
memory/324-45-0x0000000005440000-0x0000000005450000-memory.dmpFilesize
64KB
-
memory/848-63-0x00007FF4C18C0000-0x00007FF4C19EF000-memory.dmpFilesize
1.2MB
-
memory/848-61-0x00007FF8F33D0000-0x00007FF8F35C5000-memory.dmpFilesize
2.0MB
-
memory/848-58-0x00007FF4C18C0000-0x00007FF4C19EF000-memory.dmpFilesize
1.2MB
-
memory/848-60-0x00007FF4C18C0000-0x00007FF4C19EF000-memory.dmpFilesize
1.2MB
-
memory/848-56-0x00007FF4C18C0000-0x00007FF4C19EF000-memory.dmpFilesize
1.2MB
-
memory/848-54-0x00007FF4C18C0000-0x00007FF4C19EF000-memory.dmpFilesize
1.2MB
-
memory/848-53-0x00007FF4C18C0000-0x00007FF4C19EF000-memory.dmpFilesize
1.2MB
-
memory/848-52-0x00007FF4C18C0000-0x00007FF4C19EF000-memory.dmpFilesize
1.2MB
-
memory/848-50-0x00007FF4C18C0000-0x00007FF4C19EF000-memory.dmpFilesize
1.2MB
-
memory/848-59-0x00007FF4C18C0000-0x00007FF4C19EF000-memory.dmpFilesize
1.2MB
-
memory/848-62-0x00007FF4C18C0000-0x00007FF4C19EF000-memory.dmpFilesize
1.2MB
-
memory/848-64-0x00007FF4C18C0000-0x00007FF4C19EF000-memory.dmpFilesize
1.2MB
-
memory/848-65-0x00007FF4C18C0000-0x00007FF4C19EF000-memory.dmpFilesize
1.2MB
-
memory/848-51-0x00007FF4C18C0000-0x00007FF4C19EF000-memory.dmpFilesize
1.2MB
-
memory/848-49-0x00000278E5180000-0x00000278E5187000-memory.dmpFilesize
28KB
-
memory/848-48-0x00000278E30D0000-0x00000278E30D3000-memory.dmpFilesize
12KB
-
memory/848-66-0x00007FF4C18C0000-0x00007FF4C19EF000-memory.dmpFilesize
1.2MB
-
memory/848-35-0x00000278E30D0000-0x00000278E30D3000-memory.dmpFilesize
12KB
-
memory/848-67-0x00000278E5180000-0x00000278E5185000-memory.dmpFilesize
20KB
-
memory/848-68-0x00007FF8F33D0000-0x00007FF8F35C5000-memory.dmpFilesize
2.0MB
-
memory/3200-18-0x00000000053C0000-0x00000000053D0000-memory.dmpFilesize
64KB
-
memory/3200-14-0x0000000008800000-0x0000000008842000-memory.dmpFilesize
264KB
-
memory/3200-7-0x0000000000190000-0x00000000002BA000-memory.dmpFilesize
1.2MB
-
memory/3200-8-0x0000000074400000-0x0000000074BB0000-memory.dmpFilesize
7.7MB
-
memory/3200-9-0x00000000055E0000-0x0000000005B84000-memory.dmpFilesize
5.6MB
-
memory/3200-10-0x00000000050D0000-0x0000000005162000-memory.dmpFilesize
584KB
-
memory/3200-11-0x0000000005170000-0x000000000520C000-memory.dmpFilesize
624KB
-
memory/3200-12-0x00000000053C0000-0x00000000053D0000-memory.dmpFilesize
64KB
-
memory/3200-24-0x0000000074400000-0x0000000074BB0000-memory.dmpFilesize
7.7MB
-
memory/3200-13-0x0000000005240000-0x000000000524A000-memory.dmpFilesize
40KB
-
memory/3200-15-0x0000000074400000-0x0000000074BB0000-memory.dmpFilesize
7.7MB
-
memory/3200-20-0x000000000B7F0000-0x000000000B7F6000-memory.dmpFilesize
24KB
-
memory/3200-19-0x00000000089D0000-0x00000000089EA000-memory.dmpFilesize
104KB
-
memory/3200-17-0x00000000053C0000-0x00000000053D0000-memory.dmpFilesize
64KB
-
memory/3200-16-0x00000000053C0000-0x00000000053D0000-memory.dmpFilesize
64KB
-
memory/3736-21-0x0000000000400000-0x0000000000473000-memory.dmpFilesize
460KB
-
memory/3736-44-0x0000000002A10000-0x0000000002E10000-memory.dmpFilesize
4.0MB
-
memory/3736-23-0x0000000000400000-0x0000000000473000-memory.dmpFilesize
460KB
-
memory/3736-30-0x0000000000D40000-0x0000000000D47000-memory.dmpFilesize
28KB
-
memory/3736-31-0x0000000002A10000-0x0000000002E10000-memory.dmpFilesize
4.0MB
-
memory/3736-33-0x0000000002A10000-0x0000000002E10000-memory.dmpFilesize
4.0MB
-
memory/3736-34-0x0000000002A10000-0x0000000002E10000-memory.dmpFilesize
4.0MB
-
memory/3736-36-0x00000000036D0000-0x0000000003706000-memory.dmpFilesize
216KB
-
memory/3736-42-0x00000000036D0000-0x0000000003706000-memory.dmpFilesize
216KB