Analysis
- max time kernel
91s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
07/08/2024, 13:06
General
- Target s.exe
- Size 82.5MB
- Sample240807-qb91assdpc
- SHA256 68395be6acccbc33328eeb307f5fe190da71f801fcd6d9aa5b3536b9723bceb6
Malware Config
Signatures
- Detects HijackLoader (aka IDAT Loader) 1 IoCs
- HijackLoader
HijackLoader is a multistage loader first seen in 2023.
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Deletes itself 1 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 19 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 13 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 19 IoCs
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\s.exe"C:\Users\Admin\AppData\Local\Temp\s.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\protectsecure_v3\DPMHelper.exeC:\Users\Admin\AppData\Local\Temp\protectsecure_v3\DPMHelper.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\protectsecure_v3\DPMHelper.exeC:\Users\Admin\AppData\Roaming\protectsecure_v3\DPMHelper.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe4⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe5⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
4f6dce57
DPMHelper.exe
decorator.xml
gangrel.mdb
madbasic_.bpl
maddisAsm_.bpl
madexcept_.bpl
rtl120.bpl
vcl120.bpl
vclx120.bpl
memory/684-60-0x0000000057800000-0x0000000057812000-memory.dmp
memory/684-61-0x0000000057000000-0x000000005703F000-memory.dmp
memory/684-44-0x00000000748A0000-0x0000000074A1B000-memory.dmp
memory/684-45-0x00007FF923270000-0x00007FF923465000-memory.dmp
memory/684-58-0x0000000050000000-0x0000000050116000-memory.dmp
memory/684-63-0x0000000050310000-0x0000000050349000-memory.dmp
memory/684-62-0x0000000050120000-0x000000005030D000-memory.dmp
memory/684-57-0x0000000000400000-0x0000000000698000-memory.dmp
memory/684-59-0x0000000059800000-0x000000005986E000-memory.dmp
memory/1164-115-0x00007FF923270000-0x00007FF923465000-memory.dmp
memory/1164-117-0x0000000075530000-0x0000000075745000-memory.dmp
memory/1164-114-0x0000000002C70000-0x0000000003070000-memory.dmp
memory/1164-110-0x00000000010B0000-0x00000000010B9000-memory.dmp
memory/1700-91-0x0000000059800000-0x000000005986E000-memory.dmp
memory/1700-94-0x0000000050120000-0x000000005030D000-memory.dmp
memory/1700-84-0x00007FF923270000-0x00007FF923465000-memory.dmp
memory/1700-83-0x00000000748A0000-0x0000000074A1B000-memory.dmp
memory/1700-89-0x0000000000400000-0x0000000000698000-memory.dmp
memory/1700-87-0x00000000748A0000-0x0000000074A1B000-memory.dmp
memory/1700-90-0x0000000050000000-0x0000000050116000-memory.dmp
memory/1700-92-0x0000000057000000-0x000000005703F000-memory.dmp
memory/1700-95-0x0000000050310000-0x0000000050349000-memory.dmp
memory/2420-1-0x0000000001540000-0x0000000001541000-memory.dmp
memory/2420-0-0x0000000000400000-0x00000000013EB000-memory.dmp
memory/2420-23-0x00007FF9058A0000-0x00007FF905A12000-memory.dmp
memory/2420-85-0x00007FF9058A0000-0x00007FF905A12000-memory.dmp
memory/2420-14-0x00007FF9058A0000-0x00007FF905A12000-memory.dmp
memory/2420-4-0x00007FF9058A0000-0x00007FF905A12000-memory.dmp
memory/2420-7-0x00007FF9058B8000-0x00007FF9058B9000-memory.dmp
memory/2420-2-0x00007FF9058A0000-0x00007FF905A12000-memory.dmp
memory/3672-105-0x0000000003FD0000-0x00000000043D0000-memory.dmp
memory/3672-104-0x00000000008A0000-0x000000000090F000-memory.dmp
memory/3672-102-0x00000000008A0000-0x000000000090F000-memory.dmp
memory/3672-106-0x0000000003FD0000-0x00000000043D0000-memory.dmp
memory/3672-109-0x0000000075530000-0x0000000075745000-memory.dmp
memory/3672-101-0x00007FF923270000-0x00007FF923465000-memory.dmp
memory/3672-112-0x00000000008A0000-0x000000000090F000-memory.dmp
memory/3672-100-0x00000000008A0000-0x000000000090F000-memory.dmp
memory/5052-98-0x00000000748A0000-0x0000000074A1B000-memory.dmp
memory/5052-97-0x00007FF923270000-0x00007FF923465000-memory.dmp