Analysis
-
max time kernel
132s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11-06-2024 13:58
Behavioral task
behavioral1
Sample
??? ?? - KOMCA/1099Misc.pdf
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
??? ?? - KOMCA/1099Misc.pdf
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
??? ?? - KOMCA/??? ?? - KOMCA.exe
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
??? ?? - KOMCA/??? ?? - KOMCA.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
??? ?? - KOMCA/msimg32.dll
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
??? ?? - KOMCA/msimg32.dll
Resource
win10v2004-20240508-en
General
-
Target
??? ?? - KOMCA/??? ?? - KOMCA.exe
-
Size
6.1MB
-
MD5
4864a55cff27f686023456a22371e790
-
SHA1
6ed30c0371fe167d38411bfa6d720fcdcacc4f4c
-
SHA256
08c7fb6067acc8ac207d28ab616c9ea5bc0d394956455d6a3eecb73f8010f7a2
-
SHA512
4bd3a16435cca6ce7a7aa829eb967619a8b7c02598474e634442cffc55935870d54d844a04496bf9c7e8c29c40fae59ac6eb39c8550c091d06a28211491d0bfb
-
SSDEEP
98304:VZQIM+/nv/CDoAkYwpAa5ge1zZ/jtdZwUkQ:bJCKlA2VKUz
Malware Config
Signatures
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
___ __ - KOMCA.exedescription pid process target process PID 4308 created 2376 4308 ___ __ - KOMCA.exe sihost.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\*ChromeUpdate = "rundll32.exe C:\\Users\\Admin\\Documents\\FirefoxData.dll,EntryPoint" reg.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
___ __ - KOMCA.exepid process 1532 ___ __ - KOMCA.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4196 4308 WerFault.exe ___ __ - KOMCA.exe 3888 4308 WerFault.exe ___ __ - KOMCA.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
___ __ - KOMCA.exedialer.exepid process 4308 ___ __ - KOMCA.exe 4308 ___ __ - KOMCA.exe 4904 dialer.exe 4904 dialer.exe 4904 dialer.exe 4904 dialer.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
___ __ - KOMCA.exe___ __ - KOMCA.execmd.exedescription pid process target process PID 1532 wrote to memory of 4308 1532 ___ __ - KOMCA.exe ___ __ - KOMCA.exe PID 1532 wrote to memory of 4308 1532 ___ __ - KOMCA.exe ___ __ - KOMCA.exe PID 1532 wrote to memory of 4308 1532 ___ __ - KOMCA.exe ___ __ - KOMCA.exe PID 1532 wrote to memory of 4308 1532 ___ __ - KOMCA.exe ___ __ - KOMCA.exe PID 1532 wrote to memory of 4308 1532 ___ __ - KOMCA.exe ___ __ - KOMCA.exe PID 1532 wrote to memory of 4308 1532 ___ __ - KOMCA.exe ___ __ - KOMCA.exe PID 4308 wrote to memory of 4904 4308 ___ __ - KOMCA.exe dialer.exe PID 4308 wrote to memory of 4904 4308 ___ __ - KOMCA.exe dialer.exe PID 4308 wrote to memory of 4904 4308 ___ __ - KOMCA.exe dialer.exe PID 4308 wrote to memory of 4904 4308 ___ __ - KOMCA.exe dialer.exe PID 4308 wrote to memory of 4904 4308 ___ __ - KOMCA.exe dialer.exe PID 1532 wrote to memory of 5084 1532 ___ __ - KOMCA.exe cmd.exe PID 1532 wrote to memory of 5084 1532 ___ __ - KOMCA.exe cmd.exe PID 1532 wrote to memory of 5084 1532 ___ __ - KOMCA.exe cmd.exe PID 5084 wrote to memory of 720 5084 cmd.exe reg.exe PID 5084 wrote to memory of 720 5084 cmd.exe reg.exe PID 5084 wrote to memory of 720 5084 cmd.exe reg.exe
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2376
-
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4904
-
C:\Users\Admin\AppData\Local\Temp\___ __ - KOMCA\___ __ - KOMCA.exe"C:\Users\Admin\AppData\Local\Temp\___ __ - KOMCA\___ __ - KOMCA.exe"1⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\___ __ - KOMCA\___ __ - KOMCA.exe"C:\Users\Admin\AppData\Local\Temp\___ __ - KOMCA\___ __ - KOMCA.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 4483⤵
- Program crash
PID:4196 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 4603⤵
- Program crash
PID:3888 -
C:\Windows\SysWOW64\cmd.execmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*ChromeUpdate" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\FirefoxData.dll",EntryPoint /f & exit2⤵
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Windows\SysWOW64\reg.exereg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*ChromeUpdate" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\FirefoxData.dll",EntryPoint /f3⤵
- Adds Run key to start application
PID:720
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3724 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:81⤵PID:2652
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4308 -ip 43081⤵PID:4412
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4308 -ip 43081⤵PID:2956
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1532-6-0x0000000010000000-0x000000001037A000-memory.dmpFilesize
3.5MB
-
memory/1532-0-0x0000000010000000-0x000000001037A000-memory.dmpFilesize
3.5MB
-
memory/1532-2-0x0000000010000000-0x000000001037A000-memory.dmpFilesize
3.5MB
-
memory/1532-1-0x0000000010007000-0x0000000010021000-memory.dmpFilesize
104KB
-
memory/1532-3-0x0000000010000000-0x000000001037A000-memory.dmpFilesize
3.5MB
-
memory/4308-11-0x0000000003990000-0x0000000003D90000-memory.dmpFilesize
4.0MB
-
memory/4308-16-0x0000000075C40000-0x0000000075E55000-memory.dmpFilesize
2.1MB
-
memory/4308-7-0x0000000000A30000-0x0000000000A9D000-memory.dmpFilesize
436KB
-
memory/4308-9-0x0000000000A30000-0x0000000000A9D000-memory.dmpFilesize
436KB
-
memory/4308-10-0x0000000003990000-0x0000000003D90000-memory.dmpFilesize
4.0MB
-
memory/4308-4-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/4308-12-0x0000000003990000-0x0000000003D90000-memory.dmpFilesize
4.0MB
-
memory/4308-13-0x00007FFDD9650000-0x00007FFDD9845000-memory.dmpFilesize
2.0MB
-
memory/4308-14-0x0000000003990000-0x0000000003D90000-memory.dmpFilesize
4.0MB
-
memory/4308-8-0x0000000000A30000-0x0000000000A9D000-memory.dmpFilesize
436KB
-
memory/4308-26-0x0000000003990000-0x0000000003D90000-memory.dmpFilesize
4.0MB
-
memory/4904-19-0x0000000002520000-0x0000000002920000-memory.dmpFilesize
4.0MB
-
memory/4904-20-0x0000000002520000-0x0000000002920000-memory.dmpFilesize
4.0MB
-
memory/4904-23-0x0000000002520000-0x0000000002920000-memory.dmpFilesize
4.0MB
-
memory/4904-21-0x00007FFDD9650000-0x00007FFDD9845000-memory.dmpFilesize
2.0MB
-
memory/4904-24-0x0000000075C40000-0x0000000075E55000-memory.dmpFilesize
2.1MB
-
memory/4904-17-0x00000000008E0000-0x00000000008E9000-memory.dmpFilesize
36KB
-
memory/4904-25-0x0000000002520000-0x0000000002920000-memory.dmpFilesize
4.0MB