Analysis

  • max time kernel
    147s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240319-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-04-2024 01:49

General

  • Target

    5d93c67ddde2e5fdc00a4e5777aa37d9ea4639227c633d044fb467b210640d28.exe

  • Size

    386KB

  • MD5

    cfd2733ba128f49a373042a1a6c3fe19

  • SHA1

    5782fffc3d9e4d815fa0ec6315c5f237edfb9ae9

  • SHA256

    5d93c67ddde2e5fdc00a4e5777aa37d9ea4639227c633d044fb467b210640d28

  • SHA512

    be1a9fae4148cd6b567903f8fe707c1812d2782c8a718f81f6d30240c498f1aa5419f5fc22a318727a07e0e232c1538209743a97b9c01e5f4a679462ac2819d8

  • SSDEEP

    12288:DHKzTnUs8oF7lWrf4p0fM5kzzLsK8Qll6V:DqzTUvEjCfMiHYMoV

Score
10/10

Malware Config

Signatures

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2400
      • C:\Windows\SysWOW64\dialer.exe
        "C:\Windows\system32\dialer.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2688
    • C:\Users\Admin\AppData\Local\Temp\5d93c67ddde2e5fdc00a4e5777aa37d9ea4639227c633d044fb467b210640d28.exe
      "C:\Users\Admin\AppData\Local\Temp\5d93c67ddde2e5fdc00a4e5777aa37d9ea4639227c633d044fb467b210640d28.exe"
      1⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2484
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2068
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 568
          3⤵
          • Program crash
          PID:1984
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 584
          3⤵
          • Program crash
          PID:720
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 824
        2⤵
        • Program crash
        PID:2020
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2484 -ip 2484
      1⤵
        PID:4616
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2068 -ip 2068
        1⤵
          PID:4292
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2068 -ip 2068
          1⤵
            PID:3540
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4968 --field-trial-handle=2276,i,5672504106535478802,17394903851940863593,262144 --variations-seed-version /prefetch:8
            1⤵
              PID:5020

            Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/2068-13-0x00007FFC60530000-0x00007FFC60725000-memory.dmp

              Filesize

              2.0MB

            • memory/2068-7-0x0000000000400000-0x000000000046D000-memory.dmp

              Filesize

              436KB

            • memory/2068-25-0x0000000003470000-0x0000000003870000-memory.dmp

              Filesize

              4.0MB

            • memory/2068-4-0x0000000000400000-0x000000000046D000-memory.dmp

              Filesize

              436KB

            • memory/2068-16-0x0000000076C90000-0x0000000076EA5000-memory.dmp

              Filesize

              2.1MB

            • memory/2068-9-0x0000000000400000-0x000000000046D000-memory.dmp

              Filesize

              436KB

            • memory/2068-10-0x0000000003470000-0x0000000003870000-memory.dmp

              Filesize

              4.0MB

            • memory/2068-11-0x0000000003470000-0x0000000003870000-memory.dmp

              Filesize

              4.0MB

            • memory/2068-12-0x0000000003470000-0x0000000003870000-memory.dmp

              Filesize

              4.0MB

            • memory/2068-14-0x0000000003470000-0x0000000003870000-memory.dmp

              Filesize

              4.0MB

            • memory/2484-1-0x00000000002C0000-0x0000000000322000-memory.dmp

              Filesize

              392KB

            • memory/2484-8-0x0000000002750000-0x0000000004750000-memory.dmp

              Filesize

              32.0MB

            • memory/2484-0-0x0000000075180000-0x0000000075930000-memory.dmp

              Filesize

              7.7MB

            • memory/2484-26-0x0000000075180000-0x0000000075930000-memory.dmp

              Filesize

              7.7MB

            • memory/2688-17-0x00000000007D0000-0x00000000007D9000-memory.dmp

              Filesize

              36KB

            • memory/2688-20-0x0000000002610000-0x0000000002A10000-memory.dmp

              Filesize

              4.0MB

            • memory/2688-19-0x0000000002610000-0x0000000002A10000-memory.dmp

              Filesize

              4.0MB

            • memory/2688-21-0x00007FFC60530000-0x00007FFC60725000-memory.dmp

              Filesize

              2.0MB

            • memory/2688-24-0x0000000076C90000-0x0000000076EA5000-memory.dmp

              Filesize

              2.1MB

            • memory/2688-23-0x0000000002610000-0x0000000002A10000-memory.dmp

              Filesize

              4.0MB

            • memory/2688-27-0x0000000002610000-0x0000000002A10000-memory.dmp

              Filesize

              4.0MB