Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05-04-2024 13:41
Static task
static1
Behavioral task
behavioral1
Sample
05042024_2141_DOC7096 - 70967096.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
05042024_2141_DOC7096 - 70967096.exe
Resource
win10v2004-20240226-en
General
-
Target
05042024_2141_DOC7096 - 70967096.exe
-
Size
353KB
-
MD5
fe36f2fda53c21f8f7e06629cdcc377b
-
SHA1
3988d1e0628299d29ef39bbb7f24ee347933ab9b
-
SHA256
4fb58687a364c3f6d6f7e0ca03654f9dec0f8832a499d61d40b0d424db1b1b14
-
SHA512
fa56f2dcd9fb050718389458f892a8ba2efddb81d3b72e18221333cae245e2a475a52dbc58d6ab51e0e508a31922de60f42dbd2405c7f1e0d634e46fb6261689
-
SSDEEP
6144:IM4ypBt/6bC6p/8jJkJaVnQUKRnazBrRYJs3mb2stMK39V8s98ix2p:IM1t/6+6pWG8aRna9RYSQTXtV8s98E2
Malware Config
Signatures
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
05042024_2141_DOC7096 - 70967096.exedescription pid process target process PID 2032 created 1392 2032 05042024_2141_DOC7096 - 70967096.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
05042024_2141_DOC7096 - 70967096.exedialer.exepid process 2032 05042024_2141_DOC7096 - 70967096.exe 2032 05042024_2141_DOC7096 - 70967096.exe 1740 dialer.exe 1740 dialer.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
05042024_2141_DOC7096 - 70967096.exedescription pid process target process PID 2032 wrote to memory of 1740 2032 05042024_2141_DOC7096 - 70967096.exe dialer.exe PID 2032 wrote to memory of 1740 2032 05042024_2141_DOC7096 - 70967096.exe dialer.exe PID 2032 wrote to memory of 1740 2032 05042024_2141_DOC7096 - 70967096.exe dialer.exe PID 2032 wrote to memory of 1740 2032 05042024_2141_DOC7096 - 70967096.exe dialer.exe PID 2032 wrote to memory of 1740 2032 05042024_2141_DOC7096 - 70967096.exe dialer.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\05042024_2141_DOC7096 - 70967096.exe"C:\Users\Admin\AppData\Local\Temp\05042024_2141_DOC7096 - 70967096.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\system32\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1740