Analysis
-
max time kernel
133s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
24-07-2024 11:18
Behavioral task
behavioral1
Sample
bytes.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
bytes.exe
Resource
win10v2004-20240709-en
General
-
Target
bytes.exe
-
Size
7.8MB
-
MD5
3db70f7c982700300ba7ddd81f1210b4
-
SHA1
c4b1c824a917d998663aec47de548d75fac62761
-
SHA256
7fbc872542b61d592eff2aa402d9310dafdb01f550226588e2d95050bac434fc
-
SHA512
a85d79075294e3692ebb2f6fdacc0cf7684d0a594c1e68802b9a3cb495dacb07e0e7727ee1dcb6539a3711348679eca5a04a0b6a67daf1222b77638738d4bd4d
-
SSDEEP
196608:2oyqaFBPNBLt3/qbRAsul1LJ3ZMvbsGLqg6vI:wqiNBLBbLJ+12g6A
Malware Config
Signatures
-
Detects HijackLoader (aka IDAT Loader) 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1868-0-0x0000000000270000-0x0000000000A6F000-memory.dmp family_hijackloader -
HijackLoader
HijackLoader is a multistage loader first seen in 2023.
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
explorer.exedescription pid process target process PID 4104 created 2948 4104 explorer.exe sihost.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1100 cmd.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
bytes.exedescription pid process target process PID 1868 set thread context of 1100 1868 bytes.exe cmd.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
bytes.execmd.exeexplorer.exeopenwith.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bytes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openwith.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
bytes.execmd.exeexplorer.exeopenwith.exepid process 1868 bytes.exe 1868 bytes.exe 1100 cmd.exe 1100 cmd.exe 4104 explorer.exe 4104 explorer.exe 3424 openwith.exe 3424 openwith.exe 3424 openwith.exe 3424 openwith.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
bytes.execmd.exepid process 1868 bytes.exe 1100 cmd.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
bytes.exepid process 1868 bytes.exe 1868 bytes.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
bytes.execmd.exeexplorer.exedescription pid process target process PID 1868 wrote to memory of 1100 1868 bytes.exe cmd.exe PID 1868 wrote to memory of 1100 1868 bytes.exe cmd.exe PID 1868 wrote to memory of 1100 1868 bytes.exe cmd.exe PID 1868 wrote to memory of 1100 1868 bytes.exe cmd.exe PID 1100 wrote to memory of 4104 1100 cmd.exe explorer.exe PID 1100 wrote to memory of 4104 1100 cmd.exe explorer.exe PID 1100 wrote to memory of 4104 1100 cmd.exe explorer.exe PID 1100 wrote to memory of 4104 1100 cmd.exe explorer.exe PID 4104 wrote to memory of 3424 4104 explorer.exe openwith.exe PID 4104 wrote to memory of 3424 4104 explorer.exe openwith.exe PID 4104 wrote to memory of 3424 4104 explorer.exe openwith.exe PID 4104 wrote to memory of 3424 4104 explorer.exe openwith.exe PID 4104 wrote to memory of 3424 4104 explorer.exe openwith.exe
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\SysWOW64\openwith.exe"C:\Windows\system32\openwith.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\bytes.exe"C:\Users\Admin\AppData\Local\Temp\bytes.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\290235bfFilesize
1.1MB
MD5d055f78c5c092e9521f1548a20ab8066
SHA15966d8d6302afa35559660e32620e441c5f7b82a
SHA256576ecff451a34c865cfab02fd4069d15ce1b4fc18098fe45168740611868d82f
SHA5129546f265884a592852672efe8b9a639a76437afd2338d1e2688238cb6c6e68d45852ce4e076ced6560ce913cabca54822c351492bd39651b21f7c62505f24e19
-
memory/1100-7-0x0000000073F50000-0x00000000740CB000-memory.dmpFilesize
1.5MB
-
memory/1100-13-0x0000000073F50000-0x00000000740CB000-memory.dmpFilesize
1.5MB
-
memory/1100-11-0x0000000073F50000-0x00000000740CB000-memory.dmpFilesize
1.5MB
-
memory/1100-10-0x0000000073F50000-0x00000000740CB000-memory.dmpFilesize
1.5MB
-
memory/1100-9-0x00007FFC91F50000-0x00007FFC92145000-memory.dmpFilesize
2.0MB
-
memory/1868-4-0x0000000073F50000-0x00000000740CB000-memory.dmpFilesize
1.5MB
-
memory/1868-5-0x0000000073F50000-0x00000000740CB000-memory.dmpFilesize
1.5MB
-
memory/1868-3-0x0000000073F62000-0x0000000073F64000-memory.dmpFilesize
8KB
-
memory/1868-2-0x00007FFC91F50000-0x00007FFC92145000-memory.dmpFilesize
2.0MB
-
memory/1868-1-0x0000000073F50000-0x00000000740CB000-memory.dmpFilesize
1.5MB
-
memory/1868-0-0x0000000000270000-0x0000000000A6F000-memory.dmpFilesize
8.0MB
-
memory/3424-25-0x0000000000DB0000-0x0000000000DB9000-memory.dmpFilesize
36KB
-
memory/3424-33-0x0000000075450000-0x0000000075665000-memory.dmpFilesize
2.1MB
-
memory/3424-30-0x0000000002B40000-0x0000000002F40000-memory.dmpFilesize
4.0MB
-
memory/3424-31-0x00007FFC91F50000-0x00007FFC92145000-memory.dmpFilesize
2.0MB
-
memory/4104-14-0x0000000001000000-0x0000000001080000-memory.dmpFilesize
512KB
-
memory/4104-20-0x0000000004540000-0x0000000004940000-memory.dmpFilesize
4.0MB
-
memory/4104-21-0x0000000004540000-0x0000000004940000-memory.dmpFilesize
4.0MB
-
memory/4104-24-0x0000000075450000-0x0000000075665000-memory.dmpFilesize
2.1MB
-
memory/4104-18-0x0000000001000000-0x0000000001080000-memory.dmpFilesize
512KB
-
memory/4104-28-0x0000000000860000-0x0000000000C93000-memory.dmpFilesize
4.2MB
-
memory/4104-27-0x0000000001000000-0x0000000001080000-memory.dmpFilesize
512KB
-
memory/4104-19-0x0000000000943000-0x000000000094B000-memory.dmpFilesize
32KB
-
memory/4104-16-0x0000000001000000-0x0000000001080000-memory.dmpFilesize
512KB
-
memory/4104-15-0x00007FFC91F50000-0x00007FFC92145000-memory.dmpFilesize
2.0MB