Analysis
-
max time kernel
115s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12-10-2023 00:42
Static task
static1
Behavioral task
behavioral1
Sample
fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe
-
Size
508KB
-
MD5
4a94bfa09b99674b406eefa0fc0f8c5e
-
SHA1
583055372661a2a359586a3fc2cdbaecc951659c
-
SHA256
fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b
-
SHA512
6463035915777cb01b89863eaee6ffe14ea211ac3640f1a6c8bc78f2d2b3692fdee3ff427cd4e5dad6591900f62b6eeba80abe434ff23d2402f2f401fe5e0dec
-
SSDEEP
12288:EndeNz+MiYZmsSOgetN5ONjUrhGkOjkLtxOqaF5:EnYNzECS4N5ONjUdGR6POHf
Malware Config
Signatures
-
Detect rhadamanthys stealer shellcode 7 IoCs
Processes:
resource yara_rule behavioral2/memory/1196-15-0x00000000028C0000-0x0000000002CC0000-memory.dmp family_rhadamanthys behavioral2/memory/1196-16-0x00000000028C0000-0x0000000002CC0000-memory.dmp family_rhadamanthys behavioral2/memory/1196-17-0x00000000028C0000-0x0000000002CC0000-memory.dmp family_rhadamanthys behavioral2/memory/1196-18-0x00000000028C0000-0x0000000002CC0000-memory.dmp family_rhadamanthys behavioral2/memory/1196-27-0x00000000028C0000-0x0000000002CC0000-memory.dmp family_rhadamanthys behavioral2/memory/1196-28-0x00000000028C0000-0x0000000002CC0000-memory.dmp family_rhadamanthys behavioral2/memory/1196-30-0x00000000028C0000-0x0000000002CC0000-memory.dmp family_rhadamanthys -
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exedescription pid process target process PID 1196 created 3200 1196 fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe Explorer.EXE -
Executes dropped EXE 1 IoCs
Processes:
ZvM0)I3O.exepid process 2176 ZvM0)I3O.exe -
Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
Processes:
certreq.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook certreq.exe Key opened \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook certreq.exe Key opened \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook certreq.exe Key opened \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook certreq.exe Key opened \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook certreq.exe Key opened \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook certreq.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exedescription pid process target process PID 728 set thread context of 1196 728 fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
certreq.exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 certreq.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString certreq.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exefab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.execertreq.exepid process 728 fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe 1196 fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe 1196 fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe 1196 fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe 1196 fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe 2920 certreq.exe 2920 certreq.exe 2920 certreq.exe 2920 certreq.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exedescription pid process Token: SeDebugPrivilege 728 fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exefab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exedescription pid process target process PID 728 wrote to memory of 1196 728 fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe PID 728 wrote to memory of 1196 728 fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe PID 728 wrote to memory of 1196 728 fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe PID 728 wrote to memory of 1196 728 fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe PID 728 wrote to memory of 1196 728 fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe PID 728 wrote to memory of 1196 728 fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe PID 728 wrote to memory of 1196 728 fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe PID 728 wrote to memory of 1196 728 fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe PID 1196 wrote to memory of 2920 1196 fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe certreq.exe PID 1196 wrote to memory of 2920 1196 fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe certreq.exe PID 1196 wrote to memory of 2920 1196 fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe certreq.exe PID 1196 wrote to memory of 2920 1196 fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe certreq.exe -
outlook_office_path 1 IoCs
Processes:
certreq.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook certreq.exe -
outlook_win_path 1 IoCs
Processes:
certreq.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook certreq.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe"C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exeC:\Users\Admin\AppData\Local\Temp\fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b_JC.exe3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\certreq.exe"C:\Windows\system32\certreq.exe"2⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- outlook_office_path
- outlook_win_path
-
C:\Users\Admin\AppData\Local\Microsoft\ZvM0)I3O.exe"C:\Users\Admin\AppData\Local\Microsoft\ZvM0)I3O.exe"1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\ZvM0)I3O.exeFilesize
227KB
MD52544c951135bba7846e943cf22a7eb59
SHA1099bf354174088d2c0cf68638bb441be60d7775f
SHA25614eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff
-
C:\Users\Admin\AppData\Local\Microsoft\ZvM0)I3O.exeFilesize
227KB
MD52544c951135bba7846e943cf22a7eb59
SHA1099bf354174088d2c0cf68638bb441be60d7775f
SHA25614eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff
-
memory/728-12-0x0000000074840000-0x0000000074FF0000-memory.dmpFilesize
7.7MB
-
memory/728-1-0x00000000001E0000-0x0000000000266000-memory.dmpFilesize
536KB
-
memory/728-2-0x0000000004D00000-0x0000000004D78000-memory.dmpFilesize
480KB
-
memory/728-3-0x0000000004D80000-0x0000000004D90000-memory.dmpFilesize
64KB
-
memory/728-4-0x0000000004E90000-0x0000000004EF8000-memory.dmpFilesize
416KB
-
memory/728-5-0x0000000004F00000-0x0000000004F4C000-memory.dmpFilesize
304KB
-
memory/728-6-0x0000000005550000-0x0000000005AF4000-memory.dmpFilesize
5.6MB
-
memory/728-0-0x0000000074840000-0x0000000074FF0000-memory.dmpFilesize
7.7MB
-
memory/1196-29-0x0000000000400000-0x0000000000473000-memory.dmpFilesize
460KB
-
memory/1196-26-0x0000000003600000-0x0000000003636000-memory.dmpFilesize
216KB
-
memory/1196-14-0x0000000000B20000-0x0000000000B27000-memory.dmpFilesize
28KB
-
memory/1196-15-0x00000000028C0000-0x0000000002CC0000-memory.dmpFilesize
4.0MB
-
memory/1196-16-0x00000000028C0000-0x0000000002CC0000-memory.dmpFilesize
4.0MB
-
memory/1196-17-0x00000000028C0000-0x0000000002CC0000-memory.dmpFilesize
4.0MB
-
memory/1196-18-0x00000000028C0000-0x0000000002CC0000-memory.dmpFilesize
4.0MB
-
memory/1196-10-0x0000000000400000-0x0000000000473000-memory.dmpFilesize
460KB
-
memory/1196-20-0x0000000003600000-0x0000000003636000-memory.dmpFilesize
216KB
-
memory/1196-13-0x0000000000400000-0x0000000000473000-memory.dmpFilesize
460KB
-
memory/1196-27-0x00000000028C0000-0x0000000002CC0000-memory.dmpFilesize
4.0MB
-
memory/1196-28-0x00000000028C0000-0x0000000002CC0000-memory.dmpFilesize
4.0MB
-
memory/1196-11-0x0000000000400000-0x0000000000473000-memory.dmpFilesize
460KB
-
memory/1196-30-0x00000000028C0000-0x0000000002CC0000-memory.dmpFilesize
4.0MB
-
memory/1196-7-0x0000000000400000-0x0000000000473000-memory.dmpFilesize
460KB
-
memory/2176-54-0x0000000000BE0000-0x0000000000C20000-memory.dmpFilesize
256KB
-
memory/2176-55-0x0000000074840000-0x0000000074FF0000-memory.dmpFilesize
7.7MB
-
memory/2920-33-0x00007FF44A350000-0x00007FF44A47F000-memory.dmpFilesize
1.2MB
-
memory/2920-45-0x00007FF44A350000-0x00007FF44A47F000-memory.dmpFilesize
1.2MB
-
memory/2920-36-0x00007FF44A350000-0x00007FF44A47F000-memory.dmpFilesize
1.2MB
-
memory/2920-37-0x00007FF44A350000-0x00007FF44A47F000-memory.dmpFilesize
1.2MB
-
memory/2920-41-0x00007FF44A350000-0x00007FF44A47F000-memory.dmpFilesize
1.2MB
-
memory/2920-39-0x00007FF44A350000-0x00007FF44A47F000-memory.dmpFilesize
1.2MB
-
memory/2920-42-0x00007FF44A350000-0x00007FF44A47F000-memory.dmpFilesize
1.2MB
-
memory/2920-43-0x00007FF44A350000-0x00007FF44A47F000-memory.dmpFilesize
1.2MB
-
memory/2920-44-0x00007FFFC9B30000-0x00007FFFC9D25000-memory.dmpFilesize
2.0MB
-
memory/2920-35-0x00007FF44A350000-0x00007FF44A47F000-memory.dmpFilesize
1.2MB
-
memory/2920-46-0x00007FF44A350000-0x00007FF44A47F000-memory.dmpFilesize
1.2MB
-
memory/2920-47-0x00007FFFC9B30000-0x00007FFFC9D25000-memory.dmpFilesize
2.0MB
-
memory/2920-48-0x00007FF44A350000-0x00007FF44A47F000-memory.dmpFilesize
1.2MB
-
memory/2920-49-0x00007FF44A350000-0x00007FF44A47F000-memory.dmpFilesize
1.2MB
-
memory/2920-50-0x00007FF44A350000-0x00007FF44A47F000-memory.dmpFilesize
1.2MB
-
memory/2920-34-0x00007FF44A350000-0x00007FF44A47F000-memory.dmpFilesize
1.2MB
-
memory/2920-32-0x000001F7C1B10000-0x000001F7C1B17000-memory.dmpFilesize
28KB
-
memory/2920-31-0x000001F7C18B0000-0x000001F7C18B3000-memory.dmpFilesize
12KB
-
memory/2920-19-0x000001F7C18B0000-0x000001F7C18B3000-memory.dmpFilesize
12KB