Analysis
- max time kernel
96s - max time network
111s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
20/09/2024, 02:40
General
- Target 9096c9ab92e7832fcc34c80a121661c750af0c72b153a90a54e32452b78d73d0.exe
- Size 1.1MB
- Sample240920-c52zwsvaqa
- SHA256 9096c9ab92e7832fcc34c80a121661c750af0c72b153a90a54e32452b78d73d0
Malware Config
Extracted
-
rhadamanthys
-
https://217.197.107.204:443/e0bd9c1f4515facb49/gj28n35o.2n73x
Signatures
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Program crash 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 48 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\SysWOW64\openwith.exe"C:\Windows\system32\openwith.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\9096c9ab92e7832fcc34c80a121661c750af0c72b153a90a54e32452b78d73d0.exe"C:\Users\Admin\AppData\Local\Temp\9096c9ab92e7832fcc34c80a121661c750af0c72b153a90a54e32452b78d73d0.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe"C:\Users\Admin\AppData\Local\Temp\9096c9ab92e7832fcc34c80a121661c750af0c72b153a90a54e32452b78d73d0.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 4203⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 4363⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2304 -ip 23041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2304 -ip 23041⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2160-26-0x00000000005C0000-0x00000000005C9000-memory.dmp
memory/2160-28-0x0000000002490000-0x0000000002890000-memory.dmp
memory/2160-34-0x0000000002490000-0x0000000002890000-memory.dmp
memory/2160-29-0x00007FFCD91D0000-0x00007FFCD93C5000-memory.dmp
memory/2160-30-0x0000000002490000-0x0000000002890000-memory.dmp
memory/2160-32-0x0000000075160000-0x0000000075375000-memory.dmp
memory/2160-33-0x0000000002490000-0x0000000002890000-memory.dmp
memory/2304-25-0x0000000075160000-0x0000000075375000-memory.dmp
memory/2304-23-0x0000000003E10000-0x0000000004210000-memory.dmp
memory/2304-35-0x0000000003E10000-0x0000000004210000-memory.dmp
memory/2304-18-0x0000000000400000-0x0000000000484000-memory.dmp
memory/2304-17-0x0000000001290000-0x0000000001291000-memory.dmp
memory/2304-13-0x0000000000400000-0x0000000000484000-memory.dmp
memory/2304-19-0x0000000003E10000-0x0000000004210000-memory.dmp
memory/2304-20-0x0000000003E10000-0x0000000004210000-memory.dmp
memory/2304-21-0x0000000003E10000-0x0000000004210000-memory.dmp
memory/2304-14-0x0000000000400000-0x0000000000484000-memory.dmp
memory/2304-22-0x00007FFCD91D0000-0x00007FFCD93C5000-memory.dmp
memory/2304-12-0x00000000770D2000-0x00000000770D3000-memory.dmp
memory/3344-0-0x0000000002FA0000-0x0000000002FA1000-memory.dmp
memory/3344-11-0x00000000033D0000-0x0000000003420000-memory.dmp
memory/3344-5-0x00000000004E0000-0x000000000060C000-memory.dmp
memory/3344-4-0x0000000002FD0000-0x0000000003050000-memory.dmp
memory/3344-3-0x0000000002FA0000-0x0000000002FA1000-memory.dmp
memory/3344-2-0x00000000770D2000-0x00000000770D3000-memory.dmp
memory/3344-1-0x0000000002FD0000-0x0000000003050000-memory.dmp
memory/3344-16-0x0000000002FD0000-0x0000000003050000-memory.dmp