Overview

overview

7

Static

static

1

RDIHAPY.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    300s
  • max time network
    302s
  • platform
    windows11-21h2_x64
  • resource
    win11-20231215-en
  • resource tags

    arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    01/02/2024, 14:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    RDIHAPY.exe

  • Size

    16.1MB

  • MD5

    615b35eeb86d5415edbc25948f413a7d

  • SHA1

    cf9468cbcf4e55c25992b146398afaf9c09178d7

  • SHA256

    6b6cf3bb8927423157e6ee3dc309e2469ca2767218f8c6697554953ca07faf49

  • SHA512

    3a14822561463cced405b2f8f440dd49062f628f25eca8d2292a67468359d68a5ee7d3d8e19fc8e2f75f219acd74cfbb3b6360c6cea3467409c7d798bd734ae4

  • SSDEEP

    393216:lH88UL9D2NYdStXoJW2SfBbOuTZ6VY8rqN3EuK4/r7:C8UL9D2CdStXoJWBbdZKuKO7

Score
7/10
spywarestealer

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 11 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RDIHAPY.exe
    "C:\Users\Admin\AppData\Local\Temp\RDIHAPY.exe"
    1⤵
    • Loads dropped DLL
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1736
    • C:\Windows\SysWOW64\regsvr32.exe
      regsvr32.exe /s "C:\ProgramData\Soda PDF Desktop 12\Installation\Statistics.dll"
      2⤵
      • Loads dropped DLL
      • Modifies registry class
      PID:1032
    • C:\ProgramData\Soda PDF Desktop 12\Installation\Soda_PDF_Desktop_12_Installer.exe
      "C:\ProgramData\Soda PDF Desktop 12\Installation\Soda_PDF_Desktop_12_Installer.exe" /RegServer
      2⤵
      • Executes dropped EXE
      • Modifies registry class
      PID:4456
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{EA99D9A6-92E7-43AD-9616-97BEA0A8CC1B}
    1⤵
    • Loads dropped DLL
    PID:1040

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\Soda PDF Desktop 12\Installation\Soda_PDF_Desktop_12_Installer.exe
          Filesize

          16.1MB

          MD5

          615b35eeb86d5415edbc25948f413a7d

          SHA1

          cf9468cbcf4e55c25992b146398afaf9c09178d7

          SHA256

          6b6cf3bb8927423157e6ee3dc309e2469ca2767218f8c6697554953ca07faf49

          SHA512

          3a14822561463cced405b2f8f440dd49062f628f25eca8d2292a67468359d68a5ee7d3d8e19fc8e2f75f219acd74cfbb3b6360c6cea3467409c7d798bd734ae4

          Download Submit

        • C:\ProgramData\Soda PDF Desktop 12\Installation\Statistics.dll
          Filesize

          2.7MB

          MD5

          8abb4d5d65192c93c8fc7952ca921c7a

          SHA1

          69f690fd6f52f64e9de4cfc420cf454f8925456b

          SHA256

          e5193345e85448ec265af37be594c86576a60fac2c69be5fdc3d1141970be91a

          SHA512

          f078ca4a1f18a4803d0c7cf4525d7841166293068526f879959df587e0887e970dcb96a62efbd198df4650d5ea41c2dbcabeb9b0dc2551de16792355b65e527e

          Download Submit