Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
07-08-2024 00:32
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-07_6eb0509c8c7caa0e85c02afcb954e370_avoslocker_revil.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-08-07_6eb0509c8c7caa0e85c02afcb954e370_avoslocker_revil.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-07_6eb0509c8c7caa0e85c02afcb954e370_avoslocker_revil.exe
-
Size
4.2MB
-
MD5
6eb0509c8c7caa0e85c02afcb954e370
-
SHA1
e13e787aac6abc8e9f5d126239ed5e012090827b
-
SHA256
61b0a39405d071a95d7a8302b308cbf65ce4db0df029efea1af8a24ae9a94ca4
-
SHA512
e55e50483f947b68b30e6d317c038a0dec4197fb96b5547aef5dd6f8679bf1486a6408479643b0e36d42effc8f58e4901135bc9070f523d421db0701e40bc53e
-
SSDEEP
98304:MU65he7IdCb40s58A9QmAJPZoW3D12oRRYIa2KS+bnoGgH25leG9v/krAr1KwH:B65hQmed3REeGh/kUr1K8
Malware Config
Signatures
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 2264 created 1184 2264 csc.exe 21 -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\UTorrent = "C:\\Users\\Admin\\Pictures\\UTorrent\\UTorrent.exe" 2024-08-07_6eb0509c8c7caa0e85c02afcb954e370_avoslocker_revil.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2280 set thread context of 2264 2280 2024-08-07_6eb0509c8c7caa0e85c02afcb954e370_avoslocker_revil.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-08-07_6eb0509c8c7caa0e85c02afcb954e370_avoslocker_revil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dialer.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2264 csc.exe 2264 csc.exe 2852 dialer.exe 2852 dialer.exe 2852 dialer.exe 2852 dialer.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2280 wrote to memory of 2264 2280 2024-08-07_6eb0509c8c7caa0e85c02afcb954e370_avoslocker_revil.exe 31 PID 2280 wrote to memory of 2264 2280 2024-08-07_6eb0509c8c7caa0e85c02afcb954e370_avoslocker_revil.exe 31 PID 2280 wrote to memory of 2264 2280 2024-08-07_6eb0509c8c7caa0e85c02afcb954e370_avoslocker_revil.exe 31 PID 2280 wrote to memory of 2264 2280 2024-08-07_6eb0509c8c7caa0e85c02afcb954e370_avoslocker_revil.exe 31 PID 2280 wrote to memory of 2264 2280 2024-08-07_6eb0509c8c7caa0e85c02afcb954e370_avoslocker_revil.exe 31 PID 2280 wrote to memory of 2264 2280 2024-08-07_6eb0509c8c7caa0e85c02afcb954e370_avoslocker_revil.exe 31 PID 2264 wrote to memory of 2852 2264 csc.exe 32 PID 2264 wrote to memory of 2852 2264 csc.exe 32 PID 2264 wrote to memory of 2852 2264 csc.exe 32 PID 2264 wrote to memory of 2852 2264 csc.exe 32 PID 2264 wrote to memory of 2852 2264 csc.exe 32 PID 2264 wrote to memory of 2852 2264 csc.exe 32
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\2024-08-07_6eb0509c8c7caa0e85c02afcb954e370_avoslocker_revil.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-07_6eb0509c8c7caa0e85c02afcb954e370_avoslocker_revil.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2264
-
-
-
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2852
-