Analysis
-
max time kernel
96s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05-10-2024 13:55
Behavioral task
behavioral1
Sample
g753nr4GI9.exe
Resource
win7-20240903-en
10 signatures
150 seconds
General
-
Target
g753nr4GI9.exe
-
Size
4.4MB
-
MD5
2131426d8a3c01e0073772820265b4bd
-
SHA1
bac33ac453609577cccd2c6b1fb4981ff634e795
-
SHA256
1f53511b847a01a45e3d5d48f40dce79500175275dcf9606da1ee4864099ad8a
-
SHA512
9a24b0a26fed3730d301a4c56412f2df7a7505184ba848b9a38f21af48fd82ed549b6d56383bf119c712b663900a006e2016e04e958e40c5f529a22fb7bfb22b
-
SSDEEP
98304:dAZV7FbE2iG0gOuw1AJRoFwL0BOS+HuNY:d6VtDvGjUS+HwY
Malware Config
Signatures
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 2148 created 2588 2148 g753nr4GI9.exe 44 -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ g753nr4GI9.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion g753nr4GI9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion g753nr4GI9.exe -
resource yara_rule behavioral2/memory/2148-0-0x00000000000A0000-0x0000000000539000-memory.dmp themida behavioral2/memory/2148-1-0x00000000000A0000-0x0000000000539000-memory.dmp themida behavioral2/memory/2148-2-0x00000000000A0000-0x0000000000539000-memory.dmp themida behavioral2/memory/2148-4-0x00000000000A0000-0x0000000000539000-memory.dmp themida behavioral2/memory/2148-3-0x00000000000A0000-0x0000000000539000-memory.dmp themida behavioral2/memory/2148-21-0x00000000000A0000-0x0000000000539000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA g753nr4GI9.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language g753nr4GI9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openwith.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2148 g753nr4GI9.exe 2148 g753nr4GI9.exe 3936 openwith.exe 3936 openwith.exe 3936 openwith.exe 3936 openwith.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2148 wrote to memory of 3936 2148 g753nr4GI9.exe 82 PID 2148 wrote to memory of 3936 2148 g753nr4GI9.exe 82 PID 2148 wrote to memory of 3936 2148 g753nr4GI9.exe 82 PID 2148 wrote to memory of 3936 2148 g753nr4GI9.exe 82 PID 2148 wrote to memory of 3936 2148 g753nr4GI9.exe 82
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2588
-
C:\Windows\SysWOW64\openwith.exe"C:\Windows\system32\openwith.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3936
-
-
C:\Users\Admin\AppData\Local\Temp\g753nr4GI9.exe"C:\Users\Admin\AppData\Local\Temp\g753nr4GI9.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2148