Analysis

  • max time kernel
    148s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240319-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-03-2024 18:32

General

  • Target

    28fa3eeb30117a0f4db4a0b85ac98bb6c9587d7c48d0fee091522cae66564ea1.exe

  • Size

    4.9MB

  • MD5

    229d18f6b7448bbf225cb6233eec2dfb

  • SHA1

    b5b11dc1731dde842456c41bd1408bbec40c6e5e

  • SHA256

    28fa3eeb30117a0f4db4a0b85ac98bb6c9587d7c48d0fee091522cae66564ea1

  • SHA512

    cda3461d49e9b03c71d2149e9c115f65e241f22b5fb1303dc7ef4de68974bcb9b98d830f2517cb1337ebe523f4298b7ffbe9b703b38f3688c72aa82778ebfd3a

  • SSDEEP

    98304:NZjpqXknspqcTdcnZyCxbRv8aRlHWCvXNyNwqjmiBj7Pn1q:Nv1spqcpcnZyCxbR9lHH9Ew6mqXn1q

Score
10/10

Malware Config

Signatures

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2492
      • C:\Windows\SysWOW64\dialer.exe
        "C:\Windows\system32\dialer.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:3244
    • C:\Users\Admin\AppData\Local\Temp\28fa3eeb30117a0f4db4a0b85ac98bb6c9587d7c48d0fee091522cae66564ea1.exe
      "C:\Users\Admin\AppData\Local\Temp\28fa3eeb30117a0f4db4a0b85ac98bb6c9587d7c48d0fee091522cae66564ea1.exe"
      1⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2480
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        2⤵
          PID:3312
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          2⤵
            PID:5024
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            2⤵
              PID:3296
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              2⤵
              • Suspicious use of NtCreateUserProcessOtherParentProcess
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:4504
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 588
                3⤵
                • Program crash
                PID:5092
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 608
                3⤵
                • Program crash
                PID:2808
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 4504 -ip 4504
            1⤵
              PID:4396
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4504 -ip 4504
              1⤵
                PID:920
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5032 --field-trial-handle=2288,i,11069632825633797559,14829202121434726371,262144 --variations-seed-version /prefetch:8
                1⤵
                  PID:1080

                Network

                MITRE ATT&CK Matrix

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • memory/2480-10-0x0000000002DB0000-0x0000000004DB0000-memory.dmp

                  Filesize

                  32.0MB

                • memory/2480-1-0x0000000000960000-0x00000000009D0000-memory.dmp

                  Filesize

                  448KB

                • memory/2480-29-0x0000000002DB0000-0x0000000004DB0000-memory.dmp

                  Filesize

                  32.0MB

                • memory/2480-0-0x00000000749A0000-0x0000000075150000-memory.dmp

                  Filesize

                  7.7MB

                • memory/2480-9-0x00000000749A0000-0x0000000075150000-memory.dmp

                  Filesize

                  7.7MB

                • memory/3244-22-0x00000000027F0000-0x0000000002BF0000-memory.dmp

                  Filesize

                  4.0MB

                • memory/3244-26-0x0000000076220000-0x0000000076435000-memory.dmp

                  Filesize

                  2.1MB

                • memory/3244-27-0x00000000027F0000-0x0000000002BF0000-memory.dmp

                  Filesize

                  4.0MB

                • memory/3244-24-0x00000000027F0000-0x0000000002BF0000-memory.dmp

                  Filesize

                  4.0MB

                • memory/3244-23-0x00007FFC64410000-0x00007FFC64605000-memory.dmp

                  Filesize

                  2.0MB

                • memory/3244-21-0x00000000027F0000-0x0000000002BF0000-memory.dmp

                  Filesize

                  4.0MB

                • memory/3244-19-0x0000000000CD0000-0x0000000000CD9000-memory.dmp

                  Filesize

                  36KB

                • memory/4504-18-0x0000000076220000-0x0000000076435000-memory.dmp

                  Filesize

                  2.1MB

                • memory/4504-17-0x0000000003890000-0x0000000003C90000-memory.dmp

                  Filesize

                  4.0MB

                • memory/4504-15-0x00007FFC64410000-0x00007FFC64605000-memory.dmp

                  Filesize

                  2.0MB

                • memory/4504-8-0x0000000000400000-0x000000000046D000-memory.dmp

                  Filesize

                  436KB

                • memory/4504-14-0x0000000003890000-0x0000000003C90000-memory.dmp

                  Filesize

                  4.0MB

                • memory/4504-13-0x0000000003890000-0x0000000003C90000-memory.dmp

                  Filesize

                  4.0MB

                • memory/4504-11-0x0000000000400000-0x000000000046D000-memory.dmp

                  Filesize

                  436KB

                • memory/4504-12-0x0000000003890000-0x0000000003C90000-memory.dmp

                  Filesize

                  4.0MB

                • memory/4504-28-0x0000000003890000-0x0000000003C90000-memory.dmp

                  Filesize

                  4.0MB

                • memory/4504-4-0x0000000000400000-0x000000000046D000-memory.dmp

                  Filesize

                  436KB