Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03-10-2024 15:09
Static task
static1
Behavioral task
behavioral1
Sample
Oxfvbxp.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Oxfvbxp.exe
Resource
win10v2004-20240802-en
General
-
Target
Oxfvbxp.exe
-
Size
2.9MB
-
MD5
53218d44298f406baefb2fd052eeb0ef
-
SHA1
afc422b48b829f29ee2cb95eb9d5139b788a1727
-
SHA256
11892dbe32cebd618deb6dc36477829ef9fb8181d7ec887408f44c08bb5f675b
-
SHA512
88b81da7e8d3665b0a41cd272c50318b8090dc3240d88020255f079df1373e2cf5fb9f0249320fb7346a52a29d20de42a4385f75e1cf91a12aa40786eae1a12a
-
SSDEEP
49152:zT8+dJPn7Vud6KGavAZXJgfx1HmwPKtWKbF1mIgZ+wau1CObHeIp3hPI4OH+Mfsk:38ROupbHeI7gf+MfA
Malware Config
Extracted
rhadamanthys
https://185.209.161.207:2421/44194499adc4d2b753ee/bduh0f2e.ee92s
Signatures
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 2680 created 1212 2680 Oxfvbxp.exe 21 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oxfvbxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oxfvbxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dialer.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2680 Oxfvbxp.exe 2680 Oxfvbxp.exe 2120 dialer.exe 2120 dialer.exe 2120 dialer.exe 2120 dialer.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1508 wrote to memory of 2680 1508 Oxfvbxp.exe 31 PID 1508 wrote to memory of 2680 1508 Oxfvbxp.exe 31 PID 1508 wrote to memory of 2680 1508 Oxfvbxp.exe 31 PID 1508 wrote to memory of 2680 1508 Oxfvbxp.exe 31 PID 1508 wrote to memory of 2680 1508 Oxfvbxp.exe 31 PID 1508 wrote to memory of 2680 1508 Oxfvbxp.exe 31 PID 2680 wrote to memory of 2120 2680 Oxfvbxp.exe 32 PID 2680 wrote to memory of 2120 2680 Oxfvbxp.exe 32 PID 2680 wrote to memory of 2120 2680 Oxfvbxp.exe 32 PID 2680 wrote to memory of 2120 2680 Oxfvbxp.exe 32 PID 2680 wrote to memory of 2120 2680 Oxfvbxp.exe 32 PID 2680 wrote to memory of 2120 2680 Oxfvbxp.exe 32
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\Oxfvbxp.exe"C:\Users\Admin\AppData\Local\Temp\Oxfvbxp.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\Oxfvbxp.exe"C:\Users\Admin\AppData\Local\Temp\Oxfvbxp.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2680
-
-
-
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2120
-