Analysis
- max time kernel
125s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
04/10/2024, 02:19
General
- Target ee5e15f0a5d97e1c50e1b74e2856852979d7018e559635d2dd2bf93504cd0817.exe
- Size 24.4MB
- Sample241004-csbbeayhrn
- SHA256 ee5e15f0a5d97e1c50e1b74e2856852979d7018e559635d2dd2bf93504cd0817
Malware Config
Extracted
-
rhadamanthys
-
https://185.196.11.237:9697/f002171ab05c7/s7fxej1k.pmbis
Signatures
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Executes dropped EXE 1 IoCs
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\SysWOW64\openwith.exe"C:\Windows\system32\openwith.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\ee5e15f0a5d97e1c50e1b74e2856852979d7018e559635d2dd2bf93504cd0817.exe"C:\Users\Admin\AppData\Local\Temp\ee5e15f0a5d97e1c50e1b74e2856852979d7018e559635d2dd2bf93504cd0817.exe"1⤵
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWoW64\calc.exeC:\Windows\SysWoW64\calc.exe2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1992-22-0x0000000000ED0000-0x0000000000F4E000-memory.dmp
memory/1992-17-0x00000000769A0000-0x0000000076BB5000-memory.dmp
memory/1992-14-0x0000000003380000-0x0000000003780000-memory.dmp
memory/1992-20-0x000000000338F000-0x0000000003780000-memory.dmp
memory/1992-15-0x00007FFFB3DD0000-0x00007FFFB3FC5000-memory.dmp
memory/1992-11-0x0000000000ED0000-0x0000000000F4E000-memory.dmp
memory/1992-12-0x0000000003380000-0x0000000003780000-memory.dmp
memory/1992-13-0x0000000003380000-0x0000000003780000-memory.dmp
memory/2032-10-0x0000000140000000-0x000000014285D000-memory.dmp
memory/2032-3-0x0000000140000000-0x000000014285D000-memory.dmp
memory/2032-1-0x00000001401BE000-0x0000000140FDC000-memory.dmp
memory/2032-18-0x00000001401BE000-0x0000000140FDC000-memory.dmp
memory/2032-7-0x0000000140000000-0x000000014285D000-memory.dmp
memory/2032-0-0x00007FFFB3FD0000-0x00007FFFB3FD2000-memory.dmp
memory/4236-19-0x0000000000B70000-0x0000000000B79000-memory.dmp
memory/4236-24-0x00000000029A0000-0x0000000002DA0000-memory.dmp
memory/4236-27-0x00000000769A0000-0x0000000076BB5000-memory.dmp
memory/4236-25-0x00007FFFB3DD0000-0x00007FFFB3FC5000-memory.dmp
memory/4236-28-0x00000000029A0000-0x0000000002DA0000-memory.dmp
memory/4236-29-0x00000000029A0000-0x0000000002DA0000-memory.dmp