Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
11-06-2024 13:58
Behavioral task
behavioral1
Sample
??? ?? - KOMCA/1099Misc.pdf
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
??? ?? - KOMCA/1099Misc.pdf
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
??? ?? - KOMCA/??? ?? - KOMCA.exe
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
??? ?? - KOMCA/??? ?? - KOMCA.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
??? ?? - KOMCA/msimg32.dll
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
??? ?? - KOMCA/msimg32.dll
Resource
win10v2004-20240508-en
General
-
Target
??? ?? - KOMCA/??? ?? - KOMCA.exe
-
Size
6.1MB
-
MD5
4864a55cff27f686023456a22371e790
-
SHA1
6ed30c0371fe167d38411bfa6d720fcdcacc4f4c
-
SHA256
08c7fb6067acc8ac207d28ab616c9ea5bc0d394956455d6a3eecb73f8010f7a2
-
SHA512
4bd3a16435cca6ce7a7aa829eb967619a8b7c02598474e634442cffc55935870d54d844a04496bf9c7e8c29c40fae59ac6eb39c8550c091d06a28211491d0bfb
-
SSDEEP
98304:VZQIM+/nv/CDoAkYwpAa5ge1zZ/jtdZwUkQ:bJCKlA2VKUz
Malware Config
Signatures
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
___ __ - KOMCA.exedescription pid process target process PID 1864 created 1224 1864 ___ __ - KOMCA.exe Explorer.EXE -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\*ChromeUpdate = "rundll32.exe C:\\Users\\Admin\\Documents\\FirefoxData.dll,EntryPoint" reg.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
___ __ - KOMCA.exepid process 1240 ___ __ - KOMCA.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
___ __ - KOMCA.exedialer.exepid process 1864 ___ __ - KOMCA.exe 1864 ___ __ - KOMCA.exe 2732 dialer.exe 2732 dialer.exe 2732 dialer.exe 2732 dialer.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
___ __ - KOMCA.exe___ __ - KOMCA.execmd.exedescription pid process target process PID 1240 wrote to memory of 1864 1240 ___ __ - KOMCA.exe ___ __ - KOMCA.exe PID 1240 wrote to memory of 1864 1240 ___ __ - KOMCA.exe ___ __ - KOMCA.exe PID 1240 wrote to memory of 1864 1240 ___ __ - KOMCA.exe ___ __ - KOMCA.exe PID 1240 wrote to memory of 1864 1240 ___ __ - KOMCA.exe ___ __ - KOMCA.exe PID 1240 wrote to memory of 1864 1240 ___ __ - KOMCA.exe ___ __ - KOMCA.exe PID 1240 wrote to memory of 1864 1240 ___ __ - KOMCA.exe ___ __ - KOMCA.exe PID 1240 wrote to memory of 1864 1240 ___ __ - KOMCA.exe ___ __ - KOMCA.exe PID 1864 wrote to memory of 2732 1864 ___ __ - KOMCA.exe dialer.exe PID 1864 wrote to memory of 2732 1864 ___ __ - KOMCA.exe dialer.exe PID 1864 wrote to memory of 2732 1864 ___ __ - KOMCA.exe dialer.exe PID 1864 wrote to memory of 2732 1864 ___ __ - KOMCA.exe dialer.exe PID 1864 wrote to memory of 2732 1864 ___ __ - KOMCA.exe dialer.exe PID 1864 wrote to memory of 2732 1864 ___ __ - KOMCA.exe dialer.exe PID 1240 wrote to memory of 2276 1240 ___ __ - KOMCA.exe cmd.exe PID 1240 wrote to memory of 2276 1240 ___ __ - KOMCA.exe cmd.exe PID 1240 wrote to memory of 2276 1240 ___ __ - KOMCA.exe cmd.exe PID 1240 wrote to memory of 2276 1240 ___ __ - KOMCA.exe cmd.exe PID 2276 wrote to memory of 2828 2276 cmd.exe reg.exe PID 2276 wrote to memory of 2828 2276 cmd.exe reg.exe PID 2276 wrote to memory of 2828 2276 cmd.exe reg.exe PID 2276 wrote to memory of 2828 2276 cmd.exe reg.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\___ __ - KOMCA\___ __ - KOMCA.exe"C:\Users\Admin\AppData\Local\Temp\___ __ - KOMCA\___ __ - KOMCA.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\___ __ - KOMCA\___ __ - KOMCA.exe"C:\Users\Admin\AppData\Local\Temp\___ __ - KOMCA\___ __ - KOMCA.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\SysWOW64\cmd.execmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*ChromeUpdate" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\FirefoxData.dll",EntryPoint /f & exit3⤵
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\SysWOW64\reg.exereg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*ChromeUpdate" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\FirefoxData.dll",EntryPoint /f4⤵
- Adds Run key to start application
PID:2828 -
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2732
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1240-0-0x0000000010000000-0x000000001037A000-memory.dmpFilesize
3.5MB
-
memory/1240-1-0x0000000010007000-0x0000000010021000-memory.dmpFilesize
104KB
-
memory/1240-10-0x0000000010000000-0x000000001037A000-memory.dmpFilesize
3.5MB
-
memory/1864-14-0x0000000003740000-0x0000000003B40000-memory.dmpFilesize
4.0MB
-
memory/1864-19-0x0000000003740000-0x0000000003B40000-memory.dmpFilesize
4.0MB
-
memory/1864-2-0x00000000001C0000-0x000000000022D000-memory.dmpFilesize
436KB
-
memory/1864-12-0x00000000001C0000-0x000000000022D000-memory.dmpFilesize
436KB
-
memory/1864-11-0x00000000001C0000-0x000000000022D000-memory.dmpFilesize
436KB
-
memory/1864-6-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/1864-13-0x00000000001C0000-0x000000000022D000-memory.dmpFilesize
436KB
-
memory/1864-8-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/1864-16-0x0000000003740000-0x0000000003B40000-memory.dmpFilesize
4.0MB
-
memory/1864-4-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1864-20-0x0000000077501000-0x0000000077602000-memory.dmpFilesize
1.0MB
-
memory/1864-18-0x00000000759B0000-0x00000000759F7000-memory.dmpFilesize
284KB
-
memory/1864-24-0x0000000003740000-0x0000000003B40000-memory.dmpFilesize
4.0MB
-
memory/2732-29-0x00000000759B0000-0x00000000759F7000-memory.dmpFilesize
284KB
-
memory/2732-26-0x0000000077500000-0x00000000776A9000-memory.dmpFilesize
1.7MB
-
memory/2732-25-0x0000000001CD0000-0x00000000020D0000-memory.dmpFilesize
4.0MB
-
memory/2732-21-0x00000000000C0000-0x00000000000C9000-memory.dmpFilesize
36KB
-
memory/2732-30-0x0000000077500000-0x00000000776A9000-memory.dmpFilesize
1.7MB