Overview
overview
10Static
static
3Start.exe
windows7-x64
10Start.exe
windows10-2004-x64
10d3d11.dll
windows7-x64
3d3d11.dll
windows10-2004-x64
3modules/x6...47.dll
windows10-2004-x64
1modules/x6...48.dll
windows10-2004-x64
1modules/x6...ng.dll
windows10-2004-x64
1modules/x8...47.dll
windows10-2004-x64
1modules/x8...48.dll
windows10-2004-x64
1modules/x8...ng.dll
windows10-2004-x64
1Analysis
-
max time kernel
34s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03-09-2024 14:08
Static task
static1
Behavioral task
behavioral1
Sample
Start.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
Start.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
d3d11.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
d3d11.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
modules/x64/d3d/d3dcompiler_47.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
modules/x64/d3d/d3dcompiler_48.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
modules/x64/dbgeng.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
modules/x86/d3d/d3dcompiler_47.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
modules/x86/d3d/d3dcompiler_48.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
modules/x86/dbgeng.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
Start.exe
-
Size
678KB
-
MD5
fd57b4457b9c453bf563559c53b9071b
-
SHA1
08eb3a76af5c337b73f50efe5a27c43b68edce88
-
SHA256
995bf2a06730050f99f6e5ff53d641e1e98f022e7d7c376d91d65959aa79a70e
-
SHA512
ba9518440625fef53101440c976951b5c8e2b07f946a975da77b8a7ab2cbfc795cd20a264f61ff1fc4a7c0b77ea9b75ed8a9c9e69b9d22ae65d10163a510c5a7
-
SSDEEP
12288:PoZ5cyP2UluWW7hvraWyE/7bQGLnkQzeD6lHCMfm7HUb3s9a40:PoHhP2YW7hzak7bQ8HCM+4QI40
Malware Config
Extracted
rhadamanthys
https://154.216.18.122:2013/fb9e53a2cacd52/o1vqrk0b.8e15q
Signatures
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
Start.exedescription pid Process procid_target PID 2088 created 1216 2088 Start.exe 21 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Start.exedialer.exeStart.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Start.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dialer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Start.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
taskmgr.exeStart.exedialer.exepid Process 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2088 Start.exe 2088 Start.exe 2840 dialer.exe 2840 dialer.exe 2548 taskmgr.exe 2840 dialer.exe 2840 dialer.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid Process 2548 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskmgr.exedescription pid Process Token: SeDebugPrivilege 2548 taskmgr.exe -
Suspicious use of FindShellTrayWindow 37 IoCs
Processes:
taskmgr.exepid Process 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe -
Suspicious use of SendNotifyMessage 37 IoCs
Processes:
taskmgr.exepid Process 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Start.exeStart.exedescription pid Process procid_target PID 2108 wrote to memory of 2088 2108 Start.exe 32 PID 2108 wrote to memory of 2088 2108 Start.exe 32 PID 2108 wrote to memory of 2088 2108 Start.exe 32 PID 2108 wrote to memory of 2088 2108 Start.exe 32 PID 2108 wrote to memory of 2088 2108 Start.exe 32 PID 2108 wrote to memory of 2088 2108 Start.exe 32 PID 2088 wrote to memory of 2840 2088 Start.exe 33 PID 2088 wrote to memory of 2840 2088 Start.exe 33 PID 2088 wrote to memory of 2840 2088 Start.exe 33 PID 2088 wrote to memory of 2840 2088 Start.exe 33 PID 2088 wrote to memory of 2840 2088 Start.exe 33 PID 2088 wrote to memory of 2840 2088 Start.exe 33
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\Start.exe"C:\Users\Admin\AppData\Local\Temp\Start.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\Start.exe"C:\Users\Admin\AppData\Local\Temp\Start.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2088
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /42⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2548
-
-
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2840
-