Analysis

  • max time kernel
    5s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    05-04-2024 15:49

General

  • Target

    Hurricane Loader 4.9.0.exe

  • Size

    365KB

  • MD5

    bc5220a906b2d5fee8d2d9aabac1cdc1

  • SHA1

    e7efd6fc174eae355c4f39a6e5725f9260cdf987

  • SHA256

    cc2ffeb6c70c867fb87b8392cb1abf595cb73f8ff38d6595f98430400d688ebc

  • SHA512

    b73dbf7e8eef99814db519da1fd702f3cb82d51ba22e7981fa96dd4e925bbc4c6714e8e616436857d147bf47d2268593866eb86124e9bd98c118e342d19f50e8

  • SSDEEP

    6144:TLM2LZtM6Yi7slqUWE21n/uG+tyYTW1bxrimB4kIUZc5bmmw3P4+EZbVT2K:TPZvH71UWE21ncNMrimBI5Dw3vQ2

Score
10/10

Malware Config

Signatures

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2072
      • C:\Windows\SysWOW64\dialer.exe
        "C:\Windows\system32\dialer.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:1980
    • C:\Users\Admin\AppData\Local\Temp\Hurricane Loader 4.9.0.exe
      "C:\Users\Admin\AppData\Local\Temp\Hurricane Loader 4.9.0.exe"
      1⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1848
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4024
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 500
          3⤵
          • Program crash
          PID:4732
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 516
          3⤵
          • Program crash
          PID:2260
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4024 -ip 4024
      1⤵
        PID:3764
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4024 -ip 4024
        1⤵
          PID:4500

        Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1848-9-0x0000000003510000-0x0000000005510000-memory.dmp

          Filesize

          32.0MB

        • memory/1848-1-0x0000000074DE0000-0x0000000075591000-memory.dmp

          Filesize

          7.7MB

        • memory/1848-0-0x0000000000EA0000-0x0000000000F02000-memory.dmp

          Filesize

          392KB

        • memory/1848-11-0x0000000074DE0000-0x0000000075591000-memory.dmp

          Filesize

          7.7MB

        • memory/1980-22-0x0000000002D20000-0x0000000003120000-memory.dmp

          Filesize

          4.0MB

        • memory/1980-26-0x00000000757C0000-0x0000000075A12000-memory.dmp

          Filesize

          2.3MB

        • memory/1980-30-0x00007FFDC6560000-0x00007FFDC6769000-memory.dmp

          Filesize

          2.0MB

        • memory/1980-29-0x0000000002D20000-0x0000000003120000-memory.dmp

          Filesize

          4.0MB

        • memory/1980-25-0x0000000002D20000-0x0000000003120000-memory.dmp

          Filesize

          4.0MB

        • memory/1980-27-0x00007FFDC6560000-0x00007FFDC6769000-memory.dmp

          Filesize

          2.0MB

        • memory/1980-23-0x00007FFDC6560000-0x00007FFDC6769000-memory.dmp

          Filesize

          2.0MB

        • memory/1980-21-0x0000000002D20000-0x0000000003120000-memory.dmp

          Filesize

          4.0MB

        • memory/1980-19-0x0000000001070000-0x0000000001079000-memory.dmp

          Filesize

          36KB

        • memory/4024-18-0x00000000757C0000-0x0000000075A12000-memory.dmp

          Filesize

          2.3MB

        • memory/4024-15-0x00007FFDC6560000-0x00007FFDC6769000-memory.dmp

          Filesize

          2.0MB

        • memory/4024-4-0x0000000000400000-0x000000000046D000-memory.dmp

          Filesize

          436KB

        • memory/4024-16-0x0000000003B50000-0x0000000003F50000-memory.dmp

          Filesize

          4.0MB

        • memory/4024-10-0x0000000000400000-0x000000000046D000-memory.dmp

          Filesize

          436KB

        • memory/4024-14-0x0000000003B50000-0x0000000003F50000-memory.dmp

          Filesize

          4.0MB

        • memory/4024-13-0x0000000003B50000-0x0000000003F50000-memory.dmp

          Filesize

          4.0MB

        • memory/4024-28-0x0000000003B50000-0x0000000003F50000-memory.dmp

          Filesize

          4.0MB

        • memory/4024-12-0x0000000003B50000-0x0000000003F50000-memory.dmp

          Filesize

          4.0MB

        • memory/4024-7-0x0000000000400000-0x000000000046D000-memory.dmp

          Filesize

          436KB