Analysis
-
max time kernel
93s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2024, 14:38 UTC
Static task
static1
Behavioral task
behavioral1
Sample
msvcp110.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
msvcp110.dll
Resource
win10v2004-20240802-en
General
-
Target
msvcp110.dll
-
Size
652KB
-
MD5
536bc1eadab8af8f052544cfcd5150ec
-
SHA1
ff3c9ee18e0e6f3f3a7b04e6c4c210d0adf29232
-
SHA256
876feac850e9030e3aff1b7bd69f85a613d21661e9350b7fa10dd263a61724fe
-
SHA512
33eae31cee1dd47e490111c7cd2fc0871e69b5a42fb24d807aa52b65ca9a6e457028ff8bea1ca2115a05f4ff99dd2c6c8075e3267d19b62b15087b437ca09d6c
-
SSDEEP
12288:vgQY+jL8MsthpNREymEG26+hbE64VJuzl8vr4JHdi7:vy5thpNRFxXblE67mX7
Malware Config
Extracted
rhadamanthys
https://135.181.4.162:2423/97e9fc994198e76/9dq0b1sl.pbl6a
Signatures
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 3044 created 2552 3044 aspnet_regiis.exe 42 -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4536 set thread context of 3044 4536 rundll32.exe 83 -
Program crash 2 IoCs
pid pid_target Process procid_target 4136 3044 WerFault.exe 83 2760 3044 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aspnet_regiis.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openwith.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3044 aspnet_regiis.exe 3044 aspnet_regiis.exe 1108 openwith.exe 1108 openwith.exe 1108 openwith.exe 1108 openwith.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 4160 wrote to memory of 4536 4160 rundll32.exe 82 PID 4160 wrote to memory of 4536 4160 rundll32.exe 82 PID 4160 wrote to memory of 4536 4160 rundll32.exe 82 PID 4536 wrote to memory of 3044 4536 rundll32.exe 83 PID 4536 wrote to memory of 3044 4536 rundll32.exe 83 PID 4536 wrote to memory of 3044 4536 rundll32.exe 83 PID 4536 wrote to memory of 3044 4536 rundll32.exe 83 PID 4536 wrote to memory of 3044 4536 rundll32.exe 83 PID 4536 wrote to memory of 3044 4536 rundll32.exe 83 PID 4536 wrote to memory of 3044 4536 rundll32.exe 83 PID 4536 wrote to memory of 3044 4536 rundll32.exe 83 PID 4536 wrote to memory of 3044 4536 rundll32.exe 83 PID 4536 wrote to memory of 3044 4536 rundll32.exe 83 PID 4536 wrote to memory of 3044 4536 rundll32.exe 83 PID 3044 wrote to memory of 1108 3044 aspnet_regiis.exe 84 PID 3044 wrote to memory of 1108 3044 aspnet_regiis.exe 84 PID 3044 wrote to memory of 1108 3044 aspnet_regiis.exe 84 PID 3044 wrote to memory of 1108 3044 aspnet_regiis.exe 84 PID 3044 wrote to memory of 1108 3044 aspnet_regiis.exe 84
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2552
-
C:\Windows\SysWOW64\openwith.exe"C:\Windows\system32\openwith.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1108
-
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\msvcp110.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\msvcp110.dll,#12⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 4364⤵
- Program crash
PID:4136
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 3404⤵
- Program crash
PID:2760
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3044 -ip 30441⤵PID:4148
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3044 -ip 30441⤵PID:2812
Network
-
Remote address:8.8.8.8:53Request228.249.119.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request71.31.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request154.239.44.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request56.163.245.4.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request206.23.85.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request98.117.19.2.in-addr.arpaIN PTRResponse98.117.19.2.in-addr.arpaIN PTRa2-19-117-98deploystaticakamaitechnologiescom
-
73 B 159 B 1 1
DNS Request
228.249.119.40.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.210.232.199.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
71.31.126.40.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
154.239.44.20.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
56.163.245.4.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
206.23.85.13.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
98.117.19.2.in-addr.arpa