Analysis
-
max time kernel
98s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
16-08-2024 19:35
General
-
Target
4168be01921da70c6f5933f081b3d150N.exe
-
Size
209KB
-
MD5
4168be01921da70c6f5933f081b3d150
-
SHA1
f1df6f865f224812701c74383aeab75c0d2d8476
-
SHA256
5d81a61d7aa8d455c341b2da96f52104c6e3f41b1a0ca8011c2ca18a200fe9b9
-
SHA512
d976568eb21c1fc1a84cfe9db4c86c6ac5cc6324468b9a4dfe2bb9624353cdf06acb16b837100fd1124e735039260d1cf5275f98677d992c0be48d34b8d782d8
-
SSDEEP
6144:cC1N40Fnr0602TzhldWqIk6jKSxPMkPOR0:cC1VFng60OCHNMNK
Score
10/10
Malware Config
Signatures
-
Detect rhadamanthys stealer shellcode 3 IoCs
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4168be01921da70c6f5933f081b3d150N.exe"C:\Users\Admin\AppData\Local\Temp\4168be01921da70c6f5933f081b3d150N.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
-
Filesize
116KB
-
Filesize
8KB
-
Filesize
16.0MB
-
Filesize
116KB