Analysis

  • max time kernel
    140s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240910-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/10/2024, 14:06 UTC

General

  • Target

    g753nr4GI9.exe

  • Size

    4.4MB

  • MD5

    2131426d8a3c01e0073772820265b4bd

  • SHA1

    bac33ac453609577cccd2c6b1fb4981ff634e795

  • SHA256

    1f53511b847a01a45e3d5d48f40dce79500175275dcf9606da1ee4864099ad8a

  • SHA512

    9a24b0a26fed3730d301a4c56412f2df7a7505184ba848b9a38f21af48fd82ed549b6d56383bf119c712b663900a006e2016e04e958e40c5f529a22fb7bfb22b

  • SSDEEP

    98304:dAZV7FbE2iG0gOuw1AJRoFwL0BOS+HuNY:d6VtDvGjUS+HwY

Malware Config

Signatures

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer 6 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2656
      • C:\Windows\SysWOW64\openwith.exe
        "C:\Windows\system32\openwith.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2564
    • C:\Users\Admin\AppData\Local\Temp\g753nr4GI9.exe
      "C:\Users\Admin\AppData\Local\Temp\g753nr4GI9.exe"
      1⤵
      • Suspicious use of NtCreateUserProcessOtherParentProcess
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:372

    Network

    • flag-us
      DNS
      154.239.44.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      154.239.44.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      83.210.23.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      83.210.23.2.in-addr.arpa
      IN PTR
      Response
      83.210.23.2.in-addr.arpa
      IN PTR
      a2-23-210-83deploystaticakamaitechnologiescom
    • flag-us
      DNS
      73.31.126.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      73.31.126.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      43.58.199.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      43.58.199.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      13.86.106.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      13.86.106.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      50.23.12.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      50.23.12.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      241.42.69.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      241.42.69.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      98.117.19.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      98.117.19.2.in-addr.arpa
      IN PTR
      Response
      98.117.19.2.in-addr.arpa
      IN PTR
      a2-19-117-98deploystaticakamaitechnologiescom
    • flag-us
      DNS
      172.214.232.199.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      172.214.232.199.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      19.229.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      19.229.111.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      55.36.223.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      55.36.223.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      55.36.223.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      55.36.223.20.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      55.36.223.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      55.36.223.20.in-addr.arpa
      IN PTR
    • 20.189.173.13:443
      322 B
      7
    • 8.8.8.8:53
      154.239.44.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      154.239.44.20.in-addr.arpa

    • 8.8.8.8:53
      83.210.23.2.in-addr.arpa
      dns
      70 B
      133 B
      1
      1

      DNS Request

      83.210.23.2.in-addr.arpa

    • 8.8.8.8:53
      73.31.126.40.in-addr.arpa
      dns
      71 B
      157 B
      1
      1

      DNS Request

      73.31.126.40.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      73 B
      144 B
      1
      1

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      43.58.199.20.in-addr.arpa
      dns
      71 B
      157 B
      1
      1

      DNS Request

      43.58.199.20.in-addr.arpa

    • 8.8.8.8:53
      13.86.106.20.in-addr.arpa
      dns
      71 B
      157 B
      1
      1

      DNS Request

      13.86.106.20.in-addr.arpa

    • 8.8.8.8:53
      50.23.12.20.in-addr.arpa
      dns
      70 B
      156 B
      1
      1

      DNS Request

      50.23.12.20.in-addr.arpa

    • 8.8.8.8:53
      241.42.69.40.in-addr.arpa
      dns
      71 B
      145 B
      1
      1

      DNS Request

      241.42.69.40.in-addr.arpa

    • 8.8.8.8:53
      98.117.19.2.in-addr.arpa
      dns
      70 B
      133 B
      1
      1

      DNS Request

      98.117.19.2.in-addr.arpa

    • 8.8.8.8:53
      172.214.232.199.in-addr.arpa
      dns
      74 B
      128 B
      1
      1

      DNS Request

      172.214.232.199.in-addr.arpa

    • 8.8.8.8:53
      19.229.111.52.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      19.229.111.52.in-addr.arpa

    • 8.8.8.8:53
      55.36.223.20.in-addr.arpa
      dns
      213 B
      157 B
      3
      1

      DNS Request

      55.36.223.20.in-addr.arpa

      DNS Request

      55.36.223.20.in-addr.arpa

      DNS Request

      55.36.223.20.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/372-8-0x00007FF91AD50000-0x00007FF91AF45000-memory.dmp

      Filesize

      2.0MB

    • memory/372-11-0x0000000075080000-0x0000000075295000-memory.dmp

      Filesize

      2.1MB

    • memory/372-2-0x0000000000DD0000-0x0000000001269000-memory.dmp

      Filesize

      4.6MB

    • memory/372-10-0x0000000003D40000-0x0000000004140000-memory.dmp

      Filesize

      4.0MB

    • memory/372-4-0x0000000000DD0000-0x0000000001269000-memory.dmp

      Filesize

      4.6MB

    • memory/372-5-0x0000000003D40000-0x0000000004140000-memory.dmp

      Filesize

      4.0MB

    • memory/372-7-0x0000000003D40000-0x0000000004140000-memory.dmp

      Filesize

      4.0MB

    • memory/372-6-0x0000000003D40000-0x0000000004140000-memory.dmp

      Filesize

      4.0MB

    • memory/372-1-0x0000000000DD0000-0x0000000001269000-memory.dmp

      Filesize

      4.6MB

    • memory/372-0-0x0000000000DD0000-0x0000000001269000-memory.dmp

      Filesize

      4.6MB

    • memory/372-3-0x0000000000DD0000-0x0000000001269000-memory.dmp

      Filesize

      4.6MB

    • memory/372-15-0x0000000000DD0000-0x0000000001269000-memory.dmp

      Filesize

      4.6MB

    • memory/2564-12-0x00000000003E0000-0x00000000003E9000-memory.dmp

      Filesize

      36KB

    • memory/2564-17-0x0000000002310000-0x0000000002710000-memory.dmp

      Filesize

      4.0MB

    • memory/2564-20-0x0000000075080000-0x0000000075295000-memory.dmp

      Filesize

      2.1MB

    • memory/2564-18-0x00007FF91AD50000-0x00007FF91AF45000-memory.dmp

      Filesize

      2.0MB

    • memory/2564-21-0x0000000002310000-0x0000000002710000-memory.dmp

      Filesize

      4.0MB

    • memory/2564-16-0x0000000002310000-0x0000000002710000-memory.dmp

      Filesize

      4.0MB

    • memory/2564-22-0x0000000002310000-0x0000000002710000-memory.dmp

      Filesize

      4.0MB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.