Behavioral task
behavioral1
Sample
bb.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
bb.exe
Resource
win10v2004-20240802-en
General
-
Target
bb.exe
-
Size
479KB
-
MD5
b2dc71aeb389c4c5f6b3699163ea1d0f
-
SHA1
578239aefa2c93cae72624754146e8f3e275fa5e
-
SHA256
bb8bbcc948e8dca2e5a0270c41c062a29994a2d9b51e820ed74d9b6e2a01ddcf
-
SHA512
2ac4ebf5ca226384b299167c58aaf4e24ab4a2a4897ef914871803df23794a44a1c9ab638b1714653cd767e566fb5bd0745ebc26f0dc5a3be4e345e6ef5b9461
-
SSDEEP
6144:pTNlPsSiE0grIlHAjNL7SVAtKZnbr8qz6xzS06d17GQxAAXcpGZ5wIzkyOD+lRXs:pFR0gsAjNLJtQbr8w6xely1JcXgDsLm
Malware Config
Extracted
rhadamanthys
https://104.129.128.188:9537/eab5524bf158f61e657/3wdrct36.6fdj7
Signatures
-
Rhadamanthys family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource bb.exe
Files
-
bb.exe.exe windows:4 windows x86 arch:x86
03f91bdad97904026326fc3ace33b897
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapCreate
GetModuleHandleA
CreateEventA
WaitForSingleObject
CloseHandle
HeapDestroy
GetModuleFileNameW
lstrlenW
HeapFree
HeapAlloc
MulDiv
GetProcessHeap
GetStartupInfoA
user32
GetDlgCtrlID
GetScrollRange
DestroyIcon
KillTimer
DrawIcon
GetClientRect
GetScrollPos
LoadStringW
FillRect
PostMessageW
CreateIcon
ShowWindow
GetCursor
DeleteMenu
EndMenu
DrawFocusRect
BeginPaint
GetDCEx
DefMDIChildProcW
CharUpperBuffW
CreateMenu
GetScrollInfo
GetMenuItemInfoW
MsgWaitForMultipleObjectsEx
ReleaseDC
GetClassInfoExW
GetWindowTextW
DestroyWindow
EndPaint
EnableWindow
CreateWindowExW
LoadBitmapW
CreateAcceleratorTableW
DrawMenuBar
PeekMessageW
GetSystemMenu
RegisterClassW
IsDialogMessageW
IsZoomed
CopyImage
GetMenuStringW
IsIconic
ShowCaret
InsertMenuW
SetTimer
LoadCursorW
DefFrameProcW
LoadIconW
GetClassInfoW
DestroyMenu
FrameRect
DispatchMessageW
SetMenuItemInfoW
SetScrollPos
DestroyCursor
gdi32
Pie
RectVisible
StretchBlt
GetTextMetricsW
Polygon
CreateCompatibleBitmap
GetEnhMetaFileHeader
CreatePalette
GetStockObject
CreateICW
MoveToEx
GetWindowOrgEx
CreateSolidBrush
SetAbortProc
SetTextColor
SetBkMode
RestoreDC
PolyBezierTo
RoundRect
AngleArc
CreateDCW
SetRectRgn
ole32
CoTaskMemAlloc
CoCreateInstance
CoUninitialize
CoTaskMemFree
IsEqualGUID
CoInitialize
OleUninitialize
OleInitialize
oleaut32
SafeArrayGetElement
SafeArrayAccessData
VariantCopyInd
SysAllocStringLen
SysReAllocStringLen
GetErrorInfo
SafeArrayPtrOfIndex
SafeArrayCreate
SysFreeString
VariantCopy
VariantInit
SafeArrayGetUBound
SafeArrayUnaccessData
VariantClear
VariantChangeType
SafeArrayPutElement
SafeArrayGetLBound
msvcrt
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
memcpy
qsort
wcsrchr
memset
wcschr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
__setusermatherr
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
Sections
.text Size: 149KB - Virtual size: 149KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.textbss Size: - Virtual size: 64KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 324KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 68B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ