Analysis
-
max time kernel
599s -
max time network
441s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12/08/2024, 13:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
FirefoxData.dll
Resource
win7-20240708-en
windows7-x64
11 signatures
600 seconds
Behavioral task
behavioral2
Sample
FirefoxData.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
13 signatures
600 seconds
General
-
Target
FirefoxData.dll
-
Size
892.3MB
-
MD5
df0323692da9ee346abc5b0058e33131
-
SHA1
f9cfb5752493c79d93aff8736dc29e4f7e437d19
-
SHA256
135f10abd48878e545df9f2e481ac1cf09f01e27086083b0a2820c3668103379
-
SHA512
3b00ed05f62ed811616ee239ebaa22c401a12ed20686337f03b08d5e8d957a4cba7c3366595b80edbd8c6d298137546a9f77001efccc6c8c7b47a1ca20364c2d
-
SSDEEP
49152:Tmp1wTHyQhBCMsvEqDZLOkALP7fivHBbsF:T21wTHF5svPDkkk2H
Score
10/10
Malware Config
Signatures
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
description pid Process procid_target PID 2036 created 2536 2036 rundll32.exe 42 PID 4912 created 2536 4912 rundll32.exe 42 -
Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
pid Process 3132 rundll32.exe 3864 rundll32.exe -
Program crash 5 IoCs
pid pid_target Process procid_target 4388 1876 WerFault.exe 85 2512 2036 WerFault.exe 122 2640 2036 WerFault.exe 122 2528 4912 WerFault.exe 131 5072 4912 WerFault.exe 131 -
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openwith.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openwith.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3980 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3980 taskmgr.exe Token: SeSystemProfilePrivilege 3980 taskmgr.exe Token: SeCreateGlobalPrivilege 3980 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe 3980 taskmgr.exe -
Suspicious use of WriteProcessMemory 37 IoCs
description pid Process procid_target PID 1780 wrote to memory of 1876 1780 rundll32.exe 85 PID 1780 wrote to memory of 1876 1780 rundll32.exe 85 PID 1780 wrote to memory of 1876 1780 rundll32.exe 85 PID 3540 wrote to memory of 1808 3540 cmd.exe 118 PID 3540 wrote to memory of 1808 3540 cmd.exe 118 PID 3540 wrote to memory of 2716 3540 cmd.exe 120 PID 3540 wrote to memory of 2716 3540 cmd.exe 120 PID 1808 wrote to memory of 3132 1808 rundll32.exe 121 PID 1808 wrote to memory of 3132 1808 rundll32.exe 121 PID 1808 wrote to memory of 3132 1808 rundll32.exe 121 PID 3132 wrote to memory of 2036 3132 rundll32.exe 122 PID 3132 wrote to memory of 2036 3132 rundll32.exe 122 PID 3132 wrote to memory of 2036 3132 rundll32.exe 122 PID 3132 wrote to memory of 2036 3132 rundll32.exe 122 PID 3132 wrote to memory of 2036 3132 rundll32.exe 122 PID 3132 wrote to memory of 2036 3132 rundll32.exe 122 PID 2036 wrote to memory of 2616 2036 rundll32.exe 123 PID 2036 wrote to memory of 2616 2036 rundll32.exe 123 PID 2036 wrote to memory of 2616 2036 rundll32.exe 123 PID 2036 wrote to memory of 2616 2036 rundll32.exe 123 PID 2036 wrote to memory of 2616 2036 rundll32.exe 123 PID 3540 wrote to memory of 636 3540 cmd.exe 129 PID 3540 wrote to memory of 636 3540 cmd.exe 129 PID 2716 wrote to memory of 3864 2716 rundll32.exe 130 PID 2716 wrote to memory of 3864 2716 rundll32.exe 130 PID 2716 wrote to memory of 3864 2716 rundll32.exe 130 PID 3864 wrote to memory of 4912 3864 rundll32.exe 131 PID 3864 wrote to memory of 4912 3864 rundll32.exe 131 PID 3864 wrote to memory of 4912 3864 rundll32.exe 131 PID 3864 wrote to memory of 4912 3864 rundll32.exe 131 PID 3864 wrote to memory of 4912 3864 rundll32.exe 131 PID 3864 wrote to memory of 4912 3864 rundll32.exe 131 PID 4912 wrote to memory of 2460 4912 rundll32.exe 132 PID 4912 wrote to memory of 2460 4912 rundll32.exe 132 PID 4912 wrote to memory of 2460 4912 rundll32.exe 132 PID 4912 wrote to memory of 2460 4912 rundll32.exe 132 PID 4912 wrote to memory of 2460 4912 rundll32.exe 132
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2536
-
C:\Windows\SysWOW64\openwith.exe"C:\Windows\system32\openwith.exe"2⤵
- System Location Discovery: System Language Discovery
PID:2616
-
-
C:\Windows\SysWOW64\openwith.exe"C:\Windows\system32\openwith.exe"2⤵
- System Location Discovery: System Language Discovery
PID:2460
-
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\FirefoxData.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\FirefoxData.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:1876 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1876 -s 5403⤵
- Program crash
PID:4388
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1876 -ip 18761⤵PID:2148
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2192
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Windows\system32\rundll32.exerundll32 FirefoxData.dll,EntryPoint2⤵
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\SysWOW64\rundll32.exerundll32 FirefoxData.dll,EntryPoint3⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 5925⤵
- Program crash
PID:2512
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 5885⤵
- Program crash
PID:2640
-
-
-
-
-
C:\Windows\system32\rundll32.exerundll32 FirefoxData.dll,EntryPoint2⤵
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\rundll32.exerundll32 FirefoxData.dll,EntryPoint3⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 5925⤵
- Program crash
PID:2528
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 5885⤵
- Program crash
PID:5072
-
-
-
-
-
C:\Windows\system32\rundll32.exerundll32 FirefoxData.dll,EntryPoint /f2⤵PID:636
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3980
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 2036 -ip 20361⤵PID:4164
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2036 -ip 20361⤵PID:3240
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4912 -ip 49121⤵PID:2464
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4912 -ip 49121⤵PID:2544