Analysis
-
max time kernel
115s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12-10-2023 00:42
Static task
static1
Behavioral task
behavioral1
Sample
fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe
-
Size
508KB
-
MD5
4a94bfa09b99674b406eefa0fc0f8c5e
-
SHA1
583055372661a2a359586a3fc2cdbaecc951659c
-
SHA256
fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b
-
SHA512
6463035915777cb01b89863eaee6ffe14ea211ac3640f1a6c8bc78f2d2b3692fdee3ff427cd4e5dad6591900f62b6eeba80abe434ff23d2402f2f401fe5e0dec
-
SSDEEP
12288:EndeNz+MiYZmsSOgetN5ONjUrhGkOjkLtxOqaF5:EnYNzECS4N5ONjUdGR6POHf
Malware Config
Signatures
-
Detect rhadamanthys stealer shellcode 7 IoCs
Processes:
resource yara_rule behavioral2/memory/1196-15-0x00000000028C0000-0x0000000002CC0000-memory.dmp family_rhadamanthys behavioral2/memory/1196-16-0x00000000028C0000-0x0000000002CC0000-memory.dmp family_rhadamanthys behavioral2/memory/1196-17-0x00000000028C0000-0x0000000002CC0000-memory.dmp family_rhadamanthys behavioral2/memory/1196-18-0x00000000028C0000-0x0000000002CC0000-memory.dmp family_rhadamanthys behavioral2/memory/1196-27-0x00000000028C0000-0x0000000002CC0000-memory.dmp family_rhadamanthys behavioral2/memory/1196-28-0x00000000028C0000-0x0000000002CC0000-memory.dmp family_rhadamanthys behavioral2/memory/1196-30-0x00000000028C0000-0x0000000002CC0000-memory.dmp family_rhadamanthys -
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exedescription pid process target process PID 1196 created 3200 1196 fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe Explorer.EXE -
Executes dropped EXE 1 IoCs
Processes:
ZvM0)I3O.exepid process 2176 ZvM0)I3O.exe -
Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
Processes:
certreq.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook certreq.exe Key opened \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook certreq.exe Key opened \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook certreq.exe Key opened \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook certreq.exe Key opened \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook certreq.exe Key opened \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook certreq.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exedescription pid process target process PID 728 set thread context of 1196 728 fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
certreq.exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 certreq.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString certreq.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exefab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.execertreq.exepid process 728 fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe 1196 fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe 1196 fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe 1196 fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe 1196 fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe 2920 certreq.exe 2920 certreq.exe 2920 certreq.exe 2920 certreq.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exedescription pid process Token: SeDebugPrivilege 728 fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exefab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exedescription pid process target process PID 728 wrote to memory of 1196 728 fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe PID 728 wrote to memory of 1196 728 fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe PID 728 wrote to memory of 1196 728 fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe PID 728 wrote to memory of 1196 728 fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe PID 728 wrote to memory of 1196 728 fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe PID 728 wrote to memory of 1196 728 fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe PID 728 wrote to memory of 1196 728 fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe PID 728 wrote to memory of 1196 728 fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe PID 1196 wrote to memory of 2920 1196 fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe certreq.exe PID 1196 wrote to memory of 2920 1196 fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe certreq.exe PID 1196 wrote to memory of 2920 1196 fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe certreq.exe PID 1196 wrote to memory of 2920 1196 fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe certreq.exe -
outlook_office_path 1 IoCs
Processes:
certreq.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook certreq.exe -
outlook_win_path 1 IoCs
Processes:
certreq.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook certreq.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe"C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:728 -
C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exeC:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Windows\system32\certreq.exe"C:\Windows\system32\certreq.exe"2⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- outlook_office_path
- outlook_win_path
PID:2920
-
C:\Users\Admin\AppData\Local\Microsoft\ZvM0)I3O.exe"C:\Users\Admin\AppData\Local\Microsoft\ZvM0)I3O.exe"1⤵
- Executes dropped EXE
PID:2176
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
227KB
MD52544c951135bba7846e943cf22a7eb59
SHA1099bf354174088d2c0cf68638bb441be60d7775f
SHA25614eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff
-
Filesize
227KB
MD52544c951135bba7846e943cf22a7eb59
SHA1099bf354174088d2c0cf68638bb441be60d7775f
SHA25614eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff