Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240319-en -
resource tags
arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system -
submitted
26-03-2024 18:32
Static task
static1
Behavioral task
behavioral1
Sample
28fa3eeb30117a0f4db4a0b85ac98bb6c9587d7c48d0fee091522cae66564ea1.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
28fa3eeb30117a0f4db4a0b85ac98bb6c9587d7c48d0fee091522cae66564ea1.exe
Resource
win10v2004-20240319-en
General
-
Target
28fa3eeb30117a0f4db4a0b85ac98bb6c9587d7c48d0fee091522cae66564ea1.exe
-
Size
4.9MB
-
MD5
229d18f6b7448bbf225cb6233eec2dfb
-
SHA1
b5b11dc1731dde842456c41bd1408bbec40c6e5e
-
SHA256
28fa3eeb30117a0f4db4a0b85ac98bb6c9587d7c48d0fee091522cae66564ea1
-
SHA512
cda3461d49e9b03c71d2149e9c115f65e241f22b5fb1303dc7ef4de68974bcb9b98d830f2517cb1337ebe523f4298b7ffbe9b703b38f3688c72aa82778ebfd3a
-
SSDEEP
98304:NZjpqXknspqcTdcnZyCxbRv8aRlHWCvXNyNwqjmiBj7Pn1q:Nv1spqcpcnZyCxbR9lHH9Ew6mqXn1q
Malware Config
Signatures
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
RegAsm.exedescription pid Process procid_target PID 4504 created 2492 4504 RegAsm.exe 44 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
28fa3eeb30117a0f4db4a0b85ac98bb6c9587d7c48d0fee091522cae66564ea1.exedescription pid Process procid_target PID 2480 set thread context of 4504 2480 28fa3eeb30117a0f4db4a0b85ac98bb6c9587d7c48d0fee091522cae66564ea1.exe 102 -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target Process procid_target 5092 4504 WerFault.exe 102 2808 4504 WerFault.exe 102 -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
RegAsm.exedialer.exepid Process 4504 RegAsm.exe 4504 RegAsm.exe 3244 dialer.exe 3244 dialer.exe 3244 dialer.exe 3244 dialer.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
28fa3eeb30117a0f4db4a0b85ac98bb6c9587d7c48d0fee091522cae66564ea1.exeRegAsm.exedescription pid Process procid_target PID 2480 wrote to memory of 3312 2480 28fa3eeb30117a0f4db4a0b85ac98bb6c9587d7c48d0fee091522cae66564ea1.exe 99 PID 2480 wrote to memory of 3312 2480 28fa3eeb30117a0f4db4a0b85ac98bb6c9587d7c48d0fee091522cae66564ea1.exe 99 PID 2480 wrote to memory of 3312 2480 28fa3eeb30117a0f4db4a0b85ac98bb6c9587d7c48d0fee091522cae66564ea1.exe 99 PID 2480 wrote to memory of 5024 2480 28fa3eeb30117a0f4db4a0b85ac98bb6c9587d7c48d0fee091522cae66564ea1.exe 100 PID 2480 wrote to memory of 5024 2480 28fa3eeb30117a0f4db4a0b85ac98bb6c9587d7c48d0fee091522cae66564ea1.exe 100 PID 2480 wrote to memory of 5024 2480 28fa3eeb30117a0f4db4a0b85ac98bb6c9587d7c48d0fee091522cae66564ea1.exe 100 PID 2480 wrote to memory of 3296 2480 28fa3eeb30117a0f4db4a0b85ac98bb6c9587d7c48d0fee091522cae66564ea1.exe 101 PID 2480 wrote to memory of 3296 2480 28fa3eeb30117a0f4db4a0b85ac98bb6c9587d7c48d0fee091522cae66564ea1.exe 101 PID 2480 wrote to memory of 3296 2480 28fa3eeb30117a0f4db4a0b85ac98bb6c9587d7c48d0fee091522cae66564ea1.exe 101 PID 2480 wrote to memory of 4504 2480 28fa3eeb30117a0f4db4a0b85ac98bb6c9587d7c48d0fee091522cae66564ea1.exe 102 PID 2480 wrote to memory of 4504 2480 28fa3eeb30117a0f4db4a0b85ac98bb6c9587d7c48d0fee091522cae66564ea1.exe 102 PID 2480 wrote to memory of 4504 2480 28fa3eeb30117a0f4db4a0b85ac98bb6c9587d7c48d0fee091522cae66564ea1.exe 102 PID 2480 wrote to memory of 4504 2480 28fa3eeb30117a0f4db4a0b85ac98bb6c9587d7c48d0fee091522cae66564ea1.exe 102 PID 2480 wrote to memory of 4504 2480 28fa3eeb30117a0f4db4a0b85ac98bb6c9587d7c48d0fee091522cae66564ea1.exe 102 PID 2480 wrote to memory of 4504 2480 28fa3eeb30117a0f4db4a0b85ac98bb6c9587d7c48d0fee091522cae66564ea1.exe 102 PID 2480 wrote to memory of 4504 2480 28fa3eeb30117a0f4db4a0b85ac98bb6c9587d7c48d0fee091522cae66564ea1.exe 102 PID 2480 wrote to memory of 4504 2480 28fa3eeb30117a0f4db4a0b85ac98bb6c9587d7c48d0fee091522cae66564ea1.exe 102 PID 2480 wrote to memory of 4504 2480 28fa3eeb30117a0f4db4a0b85ac98bb6c9587d7c48d0fee091522cae66564ea1.exe 102 PID 2480 wrote to memory of 4504 2480 28fa3eeb30117a0f4db4a0b85ac98bb6c9587d7c48d0fee091522cae66564ea1.exe 102 PID 2480 wrote to memory of 4504 2480 28fa3eeb30117a0f4db4a0b85ac98bb6c9587d7c48d0fee091522cae66564ea1.exe 102 PID 4504 wrote to memory of 3244 4504 RegAsm.exe 103 PID 4504 wrote to memory of 3244 4504 RegAsm.exe 103 PID 4504 wrote to memory of 3244 4504 RegAsm.exe 103 PID 4504 wrote to memory of 3244 4504 RegAsm.exe 103 PID 4504 wrote to memory of 3244 4504 RegAsm.exe 103
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2492
-
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3244
-
-
C:\Users\Admin\AppData\Local\Temp\28fa3eeb30117a0f4db4a0b85ac98bb6c9587d7c48d0fee091522cae66564ea1.exe"C:\Users\Admin\AppData\Local\Temp\28fa3eeb30117a0f4db4a0b85ac98bb6c9587d7c48d0fee091522cae66564ea1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:3312
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:5024
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:3296
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 5883⤵
- Program crash
PID:5092
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 6083⤵
- Program crash
PID:2808
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 4504 -ip 45041⤵PID:4396
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4504 -ip 45041⤵PID:920
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5032 --field-trial-handle=2288,i,11069632825633797559,14829202121434726371,262144 --variations-seed-version /prefetch:81⤵PID:1080