Analysis
-
max time kernel
79s -
max time network
83s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
02-09-2024 15:31
Static task
static1
Behavioral task
behavioral1
Sample
rhjryjyj.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
rhjryjyj.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
rhjryjyj.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
rhjryjyj.exe
Resource
win11-20240802-en
General
-
Target
rhjryjyj.exe
-
Size
467KB
-
MD5
ab2d2914e268ac8754e408bdd6c109cd
-
SHA1
936a1529158b699ebfaf97e937f17936d321920c
-
SHA256
0f5978c1e5026feea6e28485ceb99b48105d73a77517faf40c1e57d638a5cdd4
-
SHA512
c421cb6c41640e1866b891c941151903ad51e04a437b6d90faa6c732f2e98ef4172631453f9a60dcd8c0e4ffd39ec8c13277961c06a4119b10aff91037318fcf
-
SSDEEP
12288:B67J/HG/VFbEB46/qW7MzwwQsWWejzl1OplmA39:B69tlCWM8wQsWW2FA39
Malware Config
Extracted
rhadamanthys
https://45.159.188.37:443/44194499adc4d2b753ee/gcj8ajmp.qnu3f
Signatures
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 4920 created 2840 4920 rhjryjyj.exe 49 -
Program crash 1 IoCs
pid pid_target Process procid_target 4648 4920 WerFault.exe 74 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhjryjyj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openwith.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4920 rhjryjyj.exe 4920 rhjryjyj.exe 3920 openwith.exe 3920 openwith.exe 3920 openwith.exe 3920 openwith.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4920 wrote to memory of 3920 4920 rhjryjyj.exe 75 PID 4920 wrote to memory of 3920 4920 rhjryjyj.exe 75 PID 4920 wrote to memory of 3920 4920 rhjryjyj.exe 75 PID 4920 wrote to memory of 3920 4920 rhjryjyj.exe 75 PID 4920 wrote to memory of 3920 4920 rhjryjyj.exe 75
Processes
-
c:\windows\system32\sihost.exesihost.exe1⤵PID:2840
-
C:\Windows\SysWOW64\openwith.exe"C:\Windows\system32\openwith.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3920
-
-
C:\Users\Admin\AppData\Local\Temp\rhjryjyj.exe"C:\Users\Admin\AppData\Local\Temp\rhjryjyj.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 5202⤵
- Program crash
PID:4648
-