Analysis
-
max time kernel
138s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29-08-2024 08:32
Static task
static1
Behavioral task
behavioral1
Sample
183d3258056265d85665725d1d995126.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
183d3258056265d85665725d1d995126.exe
Resource
win10v2004-20240802-en
General
-
Target
183d3258056265d85665725d1d995126.exe
-
Size
1.1MB
-
MD5
183d3258056265d85665725d1d995126
-
SHA1
606765ff639a2699f0e9df650ceb91b658a5521d
-
SHA256
9096c9ab92e7832fcc34c80a121661c750af0c72b153a90a54e32452b78d73d0
-
SHA512
8a57e8ba15f59ae1f971888b3492a04a1faf5db104743998f3ea5c41477fb36c7572547c93302e343f3aa86b6a29a615a51b904d406c11694d10915bfe0ae925
-
SSDEEP
24576:OoU4GxhwybZN2yb0ykH3t0P/Z63iY4Er6ySE4ppEakzEqEK/oi:OyWr2ybhkdLmPhAakzsqf
Malware Config
Extracted
rhadamanthys
https://217.197.107.204:443/e0bd9c1f4515facb49/gj28n35o.2n73x
Signatures
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 4704 created 3012 4704 pipanel.exe 51 -
Program crash 2 IoCs
pid pid_target Process procid_target 3988 4704 WerFault.exe 98 1252 4704 WerFault.exe 98 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 183d3258056265d85665725d1d995126.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pipanel.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openwith.exe -
Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 4640 183d3258056265d85665725d1d995126.exe 4640 183d3258056265d85665725d1d995126.exe 4640 183d3258056265d85665725d1d995126.exe 4640 183d3258056265d85665725d1d995126.exe 4640 183d3258056265d85665725d1d995126.exe 4640 183d3258056265d85665725d1d995126.exe 4640 183d3258056265d85665725d1d995126.exe 4640 183d3258056265d85665725d1d995126.exe 4640 183d3258056265d85665725d1d995126.exe 4640 183d3258056265d85665725d1d995126.exe 4640 183d3258056265d85665725d1d995126.exe 4640 183d3258056265d85665725d1d995126.exe 4640 183d3258056265d85665725d1d995126.exe 4640 183d3258056265d85665725d1d995126.exe 4640 183d3258056265d85665725d1d995126.exe 4640 183d3258056265d85665725d1d995126.exe 4640 183d3258056265d85665725d1d995126.exe 4640 183d3258056265d85665725d1d995126.exe 4640 183d3258056265d85665725d1d995126.exe 4640 183d3258056265d85665725d1d995126.exe 4640 183d3258056265d85665725d1d995126.exe 4640 183d3258056265d85665725d1d995126.exe 4640 183d3258056265d85665725d1d995126.exe 4640 183d3258056265d85665725d1d995126.exe 4640 183d3258056265d85665725d1d995126.exe 4640 183d3258056265d85665725d1d995126.exe 4640 183d3258056265d85665725d1d995126.exe 4640 183d3258056265d85665725d1d995126.exe 4640 183d3258056265d85665725d1d995126.exe 4640 183d3258056265d85665725d1d995126.exe 4640 183d3258056265d85665725d1d995126.exe 4640 183d3258056265d85665725d1d995126.exe 4640 183d3258056265d85665725d1d995126.exe 4640 183d3258056265d85665725d1d995126.exe 4640 183d3258056265d85665725d1d995126.exe 4640 183d3258056265d85665725d1d995126.exe 4640 183d3258056265d85665725d1d995126.exe 4640 183d3258056265d85665725d1d995126.exe 4640 183d3258056265d85665725d1d995126.exe 4640 183d3258056265d85665725d1d995126.exe 4640 183d3258056265d85665725d1d995126.exe 4640 183d3258056265d85665725d1d995126.exe 4704 pipanel.exe 4704 pipanel.exe 1540 openwith.exe 1540 openwith.exe 1540 openwith.exe 1540 openwith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4640 183d3258056265d85665725d1d995126.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 4640 wrote to memory of 4704 4640 183d3258056265d85665725d1d995126.exe 98 PID 4640 wrote to memory of 4704 4640 183d3258056265d85665725d1d995126.exe 98 PID 4640 wrote to memory of 4704 4640 183d3258056265d85665725d1d995126.exe 98 PID 4640 wrote to memory of 4704 4640 183d3258056265d85665725d1d995126.exe 98 PID 4640 wrote to memory of 4704 4640 183d3258056265d85665725d1d995126.exe 98 PID 4640 wrote to memory of 4704 4640 183d3258056265d85665725d1d995126.exe 98 PID 4640 wrote to memory of 4704 4640 183d3258056265d85665725d1d995126.exe 98 PID 4640 wrote to memory of 4704 4640 183d3258056265d85665725d1d995126.exe 98 PID 4640 wrote to memory of 4704 4640 183d3258056265d85665725d1d995126.exe 98 PID 4640 wrote to memory of 4704 4640 183d3258056265d85665725d1d995126.exe 98 PID 4640 wrote to memory of 4704 4640 183d3258056265d85665725d1d995126.exe 98 PID 4640 wrote to memory of 4704 4640 183d3258056265d85665725d1d995126.exe 98 PID 4640 wrote to memory of 4704 4640 183d3258056265d85665725d1d995126.exe 98 PID 4640 wrote to memory of 4704 4640 183d3258056265d85665725d1d995126.exe 98 PID 4640 wrote to memory of 4704 4640 183d3258056265d85665725d1d995126.exe 98 PID 4640 wrote to memory of 4704 4640 183d3258056265d85665725d1d995126.exe 98 PID 4704 wrote to memory of 1540 4704 pipanel.exe 99 PID 4704 wrote to memory of 1540 4704 pipanel.exe 99 PID 4704 wrote to memory of 1540 4704 pipanel.exe 99 PID 4704 wrote to memory of 1540 4704 pipanel.exe 99 PID 4704 wrote to memory of 1540 4704 pipanel.exe 99
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:3012
-
C:\Windows\SysWOW64\openwith.exe"C:\Windows\system32\openwith.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1540
-
-
C:\Users\Admin\AppData\Local\Temp\183d3258056265d85665725d1d995126.exe"C:\Users\Admin\AppData\Local\Temp\183d3258056265d85665725d1d995126.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe"C:\Users\Admin\AppData\Local\Temp\183d3258056265d85665725d1d995126.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 4323⤵
- Program crash
PID:3988
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 4283⤵
- Program crash
PID:1252
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4704 -ip 47041⤵PID:4260
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4704 -ip 47041⤵PID:2352