Analysis
-
max time kernel
135s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
05-11-2024 06:41
General
-
Target
594799c0954909a57334da81f783f46dcdbf8e275f85376f4e924c0db9629536.exe
-
Size
1.9MB
-
MD5
bd061f324fe93a101194c1233d731cc9
-
SHA1
59613b072c8755d17b22e0d4d908021708545088
-
SHA256
594799c0954909a57334da81f783f46dcdbf8e275f85376f4e924c0db9629536
-
SHA512
92f885ea4f332bdb6f25261d32eac13fd632ce1f4ece48a82d15e47d5f0fd248a41c715d0853bf9ce67208d839c006bcf2d19a0e9057d140acf99ec1f593e715
-
SSDEEP
24576:lWYifwafT73ARA3/bSonGxysx/Z2e91kOZg18wcG4TgCcmYsruug:lidT4wXWwr98NTgCpdvg
Malware Config
Extracted
redline
PPILAB_20230110
179.43.175.174:80
-
auth_value
0b4817e037a97cddb9de49b467d5e0e3
Extracted
rhadamanthys
http://109.206.243.168/upload/libcurl.dll
Signatures
-
Detect rhadamanthys stealer shellcode 3 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Redline family
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Rhadamanthys family
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Program crash 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 40 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\SysWOW64\fontview.exe"C:\Windows\SYSWOW64\fontview.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\594799c0954909a57334da81f783f46dcdbf8e275f85376f4e924c0db9629536.exe"C:\Users\Admin\AppData\Local\Temp\594799c0954909a57334da81f783f46dcdbf8e275f85376f4e924c0db9629536.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 12682⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 12762⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3704 -ip 37041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3704 -ip 37041⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
442KB
MD5acf51213c2e0b564c28cf0db859c9e38
SHA10ec6d956dd0299a8d26bd4671af11c9c3fbe2ca0
SHA256643044a62d07c6725a73bce3ee702ad0c15f0fe332165821c5e7f73937f898b7
SHA51215f30f50afdc2838ebdc4f38199f9857c1b9bc43350588abed404dcaef039698a2533dd5c074d2bfc88448a578c2202c033073592a9c551f7a7e4d263e293eed
-
Filesize
16.0MB
-
Filesize
116KB
-
Filesize
212KB
-
Filesize
1024KB
-
Filesize
212KB
-
Filesize
116KB
-
Filesize
8KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
1.5MB
-
Filesize
2.7MB
-
Filesize
24KB
-
Filesize
304KB
-
Filesize
240KB
-
Filesize
72KB
-
Filesize
1.0MB
-
Filesize
6.1MB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
360KB
-
Filesize
360KB