Analysis

  • max time kernel
    93s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/10/2024, 14:38 UTC

General

  • Target

    msvcp110.dll

  • Size

    652KB

  • MD5

    536bc1eadab8af8f052544cfcd5150ec

  • SHA1

    ff3c9ee18e0e6f3f3a7b04e6c4c210d0adf29232

  • SHA256

    876feac850e9030e3aff1b7bd69f85a613d21661e9350b7fa10dd263a61724fe

  • SHA512

    33eae31cee1dd47e490111c7cd2fc0871e69b5a42fb24d807aa52b65ca9a6e457028ff8bea1ca2115a05f4ff99dd2c6c8075e3267d19b62b15087b437ca09d6c

  • SSDEEP

    12288:vgQY+jL8MsthpNREymEG26+hbE64VJuzl8vr4JHdi7:vy5thpNRFxXblE67mX7

Malware Config

Extracted

Family

rhadamanthys

C2

https://135.181.4.162:2423/97e9fc994198e76/9dq0b1sl.pbl6a

Signatures

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2552
      • C:\Windows\SysWOW64\openwith.exe
        "C:\Windows\system32\openwith.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1108
    • C:\Windows\system32\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\msvcp110.dll,#1
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:4160
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\msvcp110.dll,#1
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4536
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
          3⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3044
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 436
            4⤵
            • Program crash
            PID:4136
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 340
            4⤵
            • Program crash
            PID:2760
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3044 -ip 3044
      1⤵
        PID:4148
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3044 -ip 3044
        1⤵
          PID:2812

        Network

        • flag-us
          DNS
          228.249.119.40.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          228.249.119.40.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          172.210.232.199.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          172.210.232.199.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          71.31.126.40.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          71.31.126.40.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          95.221.229.192.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          95.221.229.192.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          154.239.44.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          154.239.44.20.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          56.163.245.4.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          56.163.245.4.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          206.23.85.13.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          206.23.85.13.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          98.117.19.2.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          98.117.19.2.in-addr.arpa
          IN PTR
          Response
          98.117.19.2.in-addr.arpa
          IN PTR
          a2-19-117-98deploystaticakamaitechnologiescom
        No results found
        • 8.8.8.8:53
          228.249.119.40.in-addr.arpa
          dns
          73 B
          159 B
          1
          1

          DNS Request

          228.249.119.40.in-addr.arpa

        • 8.8.8.8:53
          172.210.232.199.in-addr.arpa
          dns
          74 B
          128 B
          1
          1

          DNS Request

          172.210.232.199.in-addr.arpa

        • 8.8.8.8:53
          71.31.126.40.in-addr.arpa
          dns
          71 B
          157 B
          1
          1

          DNS Request

          71.31.126.40.in-addr.arpa

        • 8.8.8.8:53
          95.221.229.192.in-addr.arpa
          dns
          73 B
          144 B
          1
          1

          DNS Request

          95.221.229.192.in-addr.arpa

        • 8.8.8.8:53
          154.239.44.20.in-addr.arpa
          dns
          72 B
          158 B
          1
          1

          DNS Request

          154.239.44.20.in-addr.arpa

        • 8.8.8.8:53
          56.163.245.4.in-addr.arpa
          dns
          71 B
          157 B
          1
          1

          DNS Request

          56.163.245.4.in-addr.arpa

        • 8.8.8.8:53
          206.23.85.13.in-addr.arpa
          dns
          71 B
          145 B
          1
          1

          DNS Request

          206.23.85.13.in-addr.arpa

        • 8.8.8.8:53
          98.117.19.2.in-addr.arpa
          dns
          70 B
          133 B
          1
          1

          DNS Request

          98.117.19.2.in-addr.arpa

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1108-13-0x0000000000D50000-0x0000000000D59000-memory.dmp

          Filesize

          36KB

        • memory/1108-21-0x0000000002D10000-0x0000000003110000-memory.dmp

          Filesize

          4.0MB

        • memory/1108-15-0x0000000002D10000-0x0000000003110000-memory.dmp

          Filesize

          4.0MB

        • memory/1108-16-0x0000000002D10000-0x0000000003110000-memory.dmp

          Filesize

          4.0MB

        • memory/1108-17-0x00007FFB0D450000-0x00007FFB0D645000-memory.dmp

          Filesize

          2.0MB

        • memory/1108-19-0x0000000075CB0000-0x0000000075EC5000-memory.dmp

          Filesize

          2.1MB

        • memory/1108-20-0x0000000002D10000-0x0000000003110000-memory.dmp

          Filesize

          4.0MB

        • memory/3044-2-0x0000000000400000-0x000000000047E000-memory.dmp

          Filesize

          504KB

        • memory/3044-10-0x00007FFB0D450000-0x00007FFB0D645000-memory.dmp

          Filesize

          2.0MB

        • memory/3044-12-0x0000000075CB0000-0x0000000075EC5000-memory.dmp

          Filesize

          2.1MB

        • memory/3044-6-0x0000000003620000-0x0000000003A20000-memory.dmp

          Filesize

          4.0MB

        • memory/3044-9-0x0000000003620000-0x0000000003A20000-memory.dmp

          Filesize

          4.0MB

        • memory/3044-7-0x0000000003620000-0x0000000003A20000-memory.dmp

          Filesize

          4.0MB

        • memory/3044-8-0x0000000003620000-0x0000000003A20000-memory.dmp

          Filesize

          4.0MB

        • memory/3044-5-0x0000000000400000-0x000000000047E000-memory.dmp

          Filesize

          504KB

        • memory/3044-4-0x0000000000400000-0x000000000047E000-memory.dmp

          Filesize

          504KB

        • memory/3044-22-0x0000000003620000-0x0000000003A20000-memory.dmp

          Filesize

          4.0MB

        • memory/3044-3-0x0000000000400000-0x000000000047E000-memory.dmp

          Filesize

          504KB

        • memory/4536-1-0x00000000775A1000-0x00000000776C1000-memory.dmp

          Filesize

          1.1MB

        We care about your privacy.

        This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.