Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system -
submitted
05/10/2024, 14:06 UTC
Behavioral task
behavioral1
Sample
g753nr4GI9.exe
Resource
win7-20240903-en
10 signatures
150 seconds
General
-
Target
g753nr4GI9.exe
-
Size
4.4MB
-
MD5
2131426d8a3c01e0073772820265b4bd
-
SHA1
bac33ac453609577cccd2c6b1fb4981ff634e795
-
SHA256
1f53511b847a01a45e3d5d48f40dce79500175275dcf9606da1ee4864099ad8a
-
SHA512
9a24b0a26fed3730d301a4c56412f2df7a7505184ba848b9a38f21af48fd82ed549b6d56383bf119c712b663900a006e2016e04e958e40c5f529a22fb7bfb22b
-
SSDEEP
98304:dAZV7FbE2iG0gOuw1AJRoFwL0BOS+HuNY:d6VtDvGjUS+HwY
Malware Config
Signatures
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 372 created 2656 372 g753nr4GI9.exe 45 -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ g753nr4GI9.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion g753nr4GI9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion g753nr4GI9.exe -
resource yara_rule behavioral2/memory/372-0-0x0000000000DD0000-0x0000000001269000-memory.dmp themida behavioral2/memory/372-1-0x0000000000DD0000-0x0000000001269000-memory.dmp themida behavioral2/memory/372-2-0x0000000000DD0000-0x0000000001269000-memory.dmp themida behavioral2/memory/372-3-0x0000000000DD0000-0x0000000001269000-memory.dmp themida behavioral2/memory/372-4-0x0000000000DD0000-0x0000000001269000-memory.dmp themida behavioral2/memory/372-15-0x0000000000DD0000-0x0000000001269000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA g753nr4GI9.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language g753nr4GI9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openwith.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 372 g753nr4GI9.exe 372 g753nr4GI9.exe 2564 openwith.exe 2564 openwith.exe 2564 openwith.exe 2564 openwith.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 372 wrote to memory of 2564 372 g753nr4GI9.exe 93 PID 372 wrote to memory of 2564 372 g753nr4GI9.exe 93 PID 372 wrote to memory of 2564 372 g753nr4GI9.exe 93 PID 372 wrote to memory of 2564 372 g753nr4GI9.exe 93 PID 372 wrote to memory of 2564 372 g753nr4GI9.exe 93
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2656
-
C:\Windows\SysWOW64\openwith.exe"C:\Windows\system32\openwith.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2564
-
-
C:\Users\Admin\AppData\Local\Temp\g753nr4GI9.exe"C:\Users\Admin\AppData\Local\Temp\g753nr4GI9.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:372
Network
-
Remote address:8.8.8.8:53Request154.239.44.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request83.210.23.2.in-addr.arpaIN PTRResponse83.210.23.2.in-addr.arpaIN PTRa2-23-210-83deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request73.31.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request43.58.199.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request13.86.106.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request50.23.12.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request241.42.69.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request98.117.19.2.in-addr.arpaIN PTRResponse98.117.19.2.in-addr.arpaIN PTRa2-19-117-98deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request19.229.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request55.36.223.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request55.36.223.20.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request55.36.223.20.in-addr.arpaIN PTR
-
72 B 158 B 1 1
DNS Request
154.239.44.20.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
83.210.23.2.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
73.31.126.40.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
43.58.199.20.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
13.86.106.20.in-addr.arpa
-
70 B 156 B 1 1
DNS Request
50.23.12.20.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
241.42.69.40.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
98.117.19.2.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.214.232.199.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
19.229.111.52.in-addr.arpa
-
213 B 157 B 3 1
DNS Request
55.36.223.20.in-addr.arpa
DNS Request
55.36.223.20.in-addr.arpa
DNS Request
55.36.223.20.in-addr.arpa