Overview

overview

10

Static

static

1

7b4a0714d5...8e.exe

windows7-x64

10

7b4a0714d5...8e.exe

windows10-2004-x64

10

Resubmissions

22-08-2024 15:41

240822-s4zq5svdqd 10

22-08-2024 15:36

240822-s1zlzaxcqn 10

Analysis

  • max time kernel
    30s
  • max time network
    31s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-08-2024 15:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7b4a0714d5b8c42fd15f030ba1562a1e17b65330514e523ad7be50f8df1a508e.exe

  • Size

    443KB

  • MD5

    2b1106b098715cdfb812022093fd72d9

  • SHA1

    a296d6de40d7b1b4ff881ad95c45d769516b49f5

  • SHA256

    7b4a0714d5b8c42fd15f030ba1562a1e17b65330514e523ad7be50f8df1a508e

  • SHA512

    0d9b0b690ca887115c54953fdfb546a0c395afa79dd15b7638b1d08381a439dfa9c24e914f946f8ee92cd90d8e19d30ea06715ed1c6406d8c0e2535ec5196935

  • SSDEEP

    12288:kueVM4mtaswkUJBK1ZEU+QI2Dk+sK2bEm724Z5:kuCqaYgQrIOkW2Im72a

Score
10/10
rhadamanthysdiscoverystealer

Malware Config

Extracted

Family

rhadamanthys

C2

https://144.76.133.166:8034/5502b8a765a7d7349/ir9791e2.fw01k

Signatures

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 57 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 20 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7b4a0714d5b8c42fd15f030ba1562a1e17b65330514e523ad7be50f8df1a508e.exe
    "C:\Users\Admin\AppData\Local\Temp\7b4a0714d5b8c42fd15f030ba1562a1e17b65330514e523ad7be50f8df1a508e.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2024
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1968
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 552
        3⤵
        • Program crash
        PID:116
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1968 -ip 1968
    1⤵
      PID:4168
    • C:\Windows\system32\control.exe
      "C:\Windows\system32\control.exe" /name Microsoft.DeviceManager
      1⤵
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4272
      • C:\Windows\system32\mmc.exe
        "C:\Windows\system32\mmc.exe" C:\Windows\system32\devmgmt.msc
        2⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:1992
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
      1⤵
      • System Location Discovery: System Language Discovery
      PID:1692

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1968-3-0x0000000000400000-0x000000000047E000-memory.dmp

      Filesize

      504KB

      Download

    • memory/1968-4-0x0000000000400000-0x000000000047E000-memory.dmp

      Filesize

      504KB

      Download

    • memory/1968-7-0x0000000000400000-0x000000000047E000-memory.dmp

      Filesize

      504KB

      Download

    • memory/1968-6-0x0000000000400000-0x000000000047E000-memory.dmp

      Filesize

      504KB

      Download

    • memory/2024-0-0x000000007516E000-0x000000007516F000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2024-1-0x0000000000510000-0x0000000000582000-memory.dmp

      Filesize

      456KB

      Download

    • memory/2024-9-0x0000000075160000-0x0000000075910000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/2024-10-0x0000000075160000-0x0000000075910000-memory.dmp

      Filesize

      7.7MB

      Download