Analysis

  • max time kernel
    136s
  • max time network
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-08-2024 21:10

General

  • Target

    Portable.exe

  • Size

    47.5MB

  • MD5

    7914276bc13829ece91fb33f038a2344

  • SHA1

    e849ac762ff282d46966ba651bb1a50b570dac43

  • SHA256

    7c4e153855d42e10e3635b40f6471246624a3492a4c07170443a7fa9131eac33

  • SHA512

    184a6831dd66c7fe4444c5515dd702bab3cf3743fec7d2953f3f5d5387f18a5a3915290013500d74076d61b45817dc5c9b806598e13971c5f71596c5a8496002

  • SSDEEP

    786432:uCDyg3W4TaEhG4fsl6ny34lzK/szLPlwXu4Sk/f9VJxVNeKtmUVQ8E+5M5+bwMzk:uCWcaEhG4fsEnyIE/2LqXOk/f9VdIEm/

Malware Config

Extracted

Family

rhadamanthys

C2

https://185.161.251.6:5545/03a8d04906e4d03e0d308acd/homicide

Signatures

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2808
      • C:\Windows\SysWOW64\openwith.exe
        "C:\Windows\system32\openwith.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1760
    • C:\Users\Admin\AppData\Local\Temp\Portable.exe
      "C:\Users\Admin\AppData\Local\Temp\Portable.exe"
      1⤵
      • Suspicious use of NtCreateUserProcessOtherParentProcess
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4468
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4468 -s 664
        2⤵
        • Program crash
        PID:2884
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4468 -ip 4468
      1⤵
        PID:1808
      • C:\Windows\System32\rundll32.exe
        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
        1⤵
          PID:2776

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1760-8-0x0000000001250000-0x0000000001259000-memory.dmp

          Filesize

          36KB

        • memory/1760-16-0x0000000002D60000-0x0000000003160000-memory.dmp

          Filesize

          4.0MB

        • memory/1760-11-0x0000000002D60000-0x0000000003160000-memory.dmp

          Filesize

          4.0MB

        • memory/1760-15-0x0000000002D60000-0x0000000003160000-memory.dmp

          Filesize

          4.0MB

        • memory/1760-14-0x0000000075AA0000-0x0000000075CB5000-memory.dmp

          Filesize

          2.1MB

        • memory/1760-12-0x00007FF802AF0000-0x00007FF802CE5000-memory.dmp

          Filesize

          2.0MB

        • memory/4468-3-0x00000000035B0000-0x00000000039B0000-memory.dmp

          Filesize

          4.0MB

        • memory/4468-7-0x0000000075AA0000-0x0000000075CB5000-memory.dmp

          Filesize

          2.1MB

        • memory/4468-4-0x00007FF802AF0000-0x00007FF802CE5000-memory.dmp

          Filesize

          2.0MB

        • memory/4468-5-0x00000000035B0000-0x00000000039B0000-memory.dmp

          Filesize

          4.0MB

        • memory/4468-0-0x00000000024C0000-0x000000000253E000-memory.dmp

          Filesize

          504KB

        • memory/4468-2-0x00000000035B0000-0x00000000039B0000-memory.dmp

          Filesize

          4.0MB

        • memory/4468-1-0x00000000035B0000-0x00000000039B0000-memory.dmp

          Filesize

          4.0MB

        • memory/4468-17-0x00000000035B0000-0x00000000039B0000-memory.dmp

          Filesize

          4.0MB