Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
04-09-2024 22:11
Static task
static1
Behavioral task
behavioral1
Sample
c6f78c3a4bd9ddc918702468f97cf894fe54dafcb6b082820784265b21a83852.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
c6f78c3a4bd9ddc918702468f97cf894fe54dafcb6b082820784265b21a83852.exe
Resource
win10v2004-20240802-en
General
-
Target
c6f78c3a4bd9ddc918702468f97cf894fe54dafcb6b082820784265b21a83852.exe
-
Size
433KB
-
MD5
fe4513b354aeb41ccf528545a6d202d7
-
SHA1
f481c697b2b82d2d47b54b579c73ff0c6375b0db
-
SHA256
c6f78c3a4bd9ddc918702468f97cf894fe54dafcb6b082820784265b21a83852
-
SHA512
1ef0a0f33a84f04a87a3f4a5a3f97a7bfe436c34be35bcc39ebd9e88a421efb66682ef7338a5e581787735567c720a64863a78490c6c6608e1d4d18317795536
-
SSDEEP
12288:1kcsgNKBMAeaEV/XhCWGPhJGgYxeE8DHYO1pT:1vsgNKBMy8/sWxedD91p
Malware Config
Extracted
rhadamanthys
https://144.76.133.166:8034/5502b8a765a7d7349/ln5f9d9o.td86b
Signatures
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
c6f78c3a4bd9ddc918702468f97cf894fe54dafcb6b082820784265b21a83852.exedescription pid process target process PID 2228 set thread context of 3060 2228 c6f78c3a4bd9ddc918702468f97cf894fe54dafcb6b082820784265b21a83852.exe RegAsm.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2804 3060 WerFault.exe RegAsm.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
c6f78c3a4bd9ddc918702468f97cf894fe54dafcb6b082820784265b21a83852.exeRegAsm.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c6f78c3a4bd9ddc918702468f97cf894fe54dafcb6b082820784265b21a83852.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
c6f78c3a4bd9ddc918702468f97cf894fe54dafcb6b082820784265b21a83852.exeRegAsm.exedescription pid process target process PID 2228 wrote to memory of 3060 2228 c6f78c3a4bd9ddc918702468f97cf894fe54dafcb6b082820784265b21a83852.exe RegAsm.exe PID 2228 wrote to memory of 3060 2228 c6f78c3a4bd9ddc918702468f97cf894fe54dafcb6b082820784265b21a83852.exe RegAsm.exe PID 2228 wrote to memory of 3060 2228 c6f78c3a4bd9ddc918702468f97cf894fe54dafcb6b082820784265b21a83852.exe RegAsm.exe PID 2228 wrote to memory of 3060 2228 c6f78c3a4bd9ddc918702468f97cf894fe54dafcb6b082820784265b21a83852.exe RegAsm.exe PID 2228 wrote to memory of 3060 2228 c6f78c3a4bd9ddc918702468f97cf894fe54dafcb6b082820784265b21a83852.exe RegAsm.exe PID 2228 wrote to memory of 3060 2228 c6f78c3a4bd9ddc918702468f97cf894fe54dafcb6b082820784265b21a83852.exe RegAsm.exe PID 2228 wrote to memory of 3060 2228 c6f78c3a4bd9ddc918702468f97cf894fe54dafcb6b082820784265b21a83852.exe RegAsm.exe PID 2228 wrote to memory of 3060 2228 c6f78c3a4bd9ddc918702468f97cf894fe54dafcb6b082820784265b21a83852.exe RegAsm.exe PID 2228 wrote to memory of 3060 2228 c6f78c3a4bd9ddc918702468f97cf894fe54dafcb6b082820784265b21a83852.exe RegAsm.exe PID 2228 wrote to memory of 3060 2228 c6f78c3a4bd9ddc918702468f97cf894fe54dafcb6b082820784265b21a83852.exe RegAsm.exe PID 2228 wrote to memory of 3060 2228 c6f78c3a4bd9ddc918702468f97cf894fe54dafcb6b082820784265b21a83852.exe RegAsm.exe PID 2228 wrote to memory of 3060 2228 c6f78c3a4bd9ddc918702468f97cf894fe54dafcb6b082820784265b21a83852.exe RegAsm.exe PID 2228 wrote to memory of 3060 2228 c6f78c3a4bd9ddc918702468f97cf894fe54dafcb6b082820784265b21a83852.exe RegAsm.exe PID 2228 wrote to memory of 3060 2228 c6f78c3a4bd9ddc918702468f97cf894fe54dafcb6b082820784265b21a83852.exe RegAsm.exe PID 3060 wrote to memory of 2804 3060 RegAsm.exe WerFault.exe PID 3060 wrote to memory of 2804 3060 RegAsm.exe WerFault.exe PID 3060 wrote to memory of 2804 3060 RegAsm.exe WerFault.exe PID 3060 wrote to memory of 2804 3060 RegAsm.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c6f78c3a4bd9ddc918702468f97cf894fe54dafcb6b082820784265b21a83852.exe"C:\Users\Admin\AppData\Local\Temp\c6f78c3a4bd9ddc918702468f97cf894fe54dafcb6b082820784265b21a83852.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 2523⤵
- Program crash
PID:2804
-
-