Analysis
-
max time kernel
148s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2024 04:32
Behavioral task
behavioral1
Sample
0f5bb32071eaf08c67724f035ccd16c7a7d0eff091813698695528f77441f8c2.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0f5bb32071eaf08c67724f035ccd16c7a7d0eff091813698695528f77441f8c2.exe
Resource
win10v2004-20241007-en
General
-
Target
0f5bb32071eaf08c67724f035ccd16c7a7d0eff091813698695528f77441f8c2.exe
-
Size
155.7MB
-
MD5
1a14c2f212e54dcce5c9cdbe82ea2ac9
-
SHA1
aa4347a2f7c415f4c6dab663a1645c59513912db
-
SHA256
0f5bb32071eaf08c67724f035ccd16c7a7d0eff091813698695528f77441f8c2
-
SHA512
6b4950cecfa7993ce22b87d15cc8d9e8563319c4c3ec9dc8b6488c7d8d78aa4247febd7a468fbe9e4d7716aca705a29c101b7ed4b36e8d6039e5497994991fd6
-
SSDEEP
3145728:Xm/kfnZZRUWXNShZNxlb3oeUFRGp/K3GgUCoQKAQ6h398AWXNOQ14BDndvdXa:VnTLXwXNf4eUSJK39U8KAQ6hN8AW9H1x
Malware Config
Signatures
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Rhadamanthys family
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 2504 created 2648 2504 Soanquan.exe 44 -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation 0f5bb32071eaf08c67724f035ccd16c7a7d0eff091813698695528f77441f8c2.exe -
Executes dropped EXE 4 IoCs
pid Process 5016 sogou.exe 4780 Soanquan.exe 2504 Soanquan.exe 5032 Soanquan.exe -
Loads dropped DLL 25 IoCs
pid Process 2028 0f5bb32071eaf08c67724f035ccd16c7a7d0eff091813698695528f77441f8c2.exe 2028 0f5bb32071eaf08c67724f035ccd16c7a7d0eff091813698695528f77441f8c2.exe 2028 0f5bb32071eaf08c67724f035ccd16c7a7d0eff091813698695528f77441f8c2.exe 2028 0f5bb32071eaf08c67724f035ccd16c7a7d0eff091813698695528f77441f8c2.exe 2028 0f5bb32071eaf08c67724f035ccd16c7a7d0eff091813698695528f77441f8c2.exe 2028 0f5bb32071eaf08c67724f035ccd16c7a7d0eff091813698695528f77441f8c2.exe 4780 Soanquan.exe 4780 Soanquan.exe 4780 Soanquan.exe 2504 Soanquan.exe 2504 Soanquan.exe 2504 Soanquan.exe 5032 Soanquan.exe 5032 Soanquan.exe 5032 Soanquan.exe 5016 sogou.exe 5016 sogou.exe 5016 sogou.exe 5016 sogou.exe 5016 sogou.exe 5016 sogou.exe 5016 sogou.exe 5016 sogou.exe 5016 sogou.exe 5016 sogou.exe -
resource yara_rule behavioral2/memory/5016-37-0x0000000000400000-0x00000000006DD000-memory.dmp upx behavioral2/memory/5016-230-0x0000000000400000-0x00000000006DD000-memory.dmp upx -
Drops file in Program Files directory 6 IoCs
description ioc Process File created C:\Program Files (x86)\sougou\alien\core.dll 0f5bb32071eaf08c67724f035ccd16c7a7d0eff091813698695528f77441f8c2.exe File created C:\Program Files (x86)\sougou\config.ini 0f5bb32071eaf08c67724f035ccd16c7a7d0eff091813698695528f77441f8c2.exe File created C:\Program Files (x86)\sougou\so_coflog.ini 0f5bb32071eaf08c67724f035ccd16c7a7d0eff091813698695528f77441f8c2.exe File created C:\Program Files (x86)\sougou\sogou.exe 0f5bb32071eaf08c67724f035ccd16c7a7d0eff091813698695528f77441f8c2.exe File created C:\Program Files (x86)\sougou\lua5.1.dll 0f5bb32071eaf08c67724f035ccd16c7a7d0eff091813698695528f77441f8c2.exe File created C:\Program Files (x86)\sougou\Soanquan.exe 0f5bb32071eaf08c67724f035ccd16c7a7d0eff091813698695528f77441f8c2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sogou.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Soanquan.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Soanquan.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openwith.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Soanquan.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0f5bb32071eaf08c67724f035ccd16c7a7d0eff091813698695528f77441f8c2.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2504 Soanquan.exe 2504 Soanquan.exe 3744 openwith.exe 3744 openwith.exe 3744 openwith.exe 3744 openwith.exe 5016 sogou.exe 5016 sogou.exe 5016 sogou.exe 5016 sogou.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4780 Soanquan.exe Token: SeDebugPrivilege 5032 Soanquan.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2028 wrote to memory of 5016 2028 0f5bb32071eaf08c67724f035ccd16c7a7d0eff091813698695528f77441f8c2.exe 92 PID 2028 wrote to memory of 5016 2028 0f5bb32071eaf08c67724f035ccd16c7a7d0eff091813698695528f77441f8c2.exe 92 PID 2028 wrote to memory of 5016 2028 0f5bb32071eaf08c67724f035ccd16c7a7d0eff091813698695528f77441f8c2.exe 92 PID 2028 wrote to memory of 4780 2028 0f5bb32071eaf08c67724f035ccd16c7a7d0eff091813698695528f77441f8c2.exe 93 PID 2028 wrote to memory of 4780 2028 0f5bb32071eaf08c67724f035ccd16c7a7d0eff091813698695528f77441f8c2.exe 93 PID 2028 wrote to memory of 4780 2028 0f5bb32071eaf08c67724f035ccd16c7a7d0eff091813698695528f77441f8c2.exe 93 PID 2028 wrote to memory of 2504 2028 0f5bb32071eaf08c67724f035ccd16c7a7d0eff091813698695528f77441f8c2.exe 94 PID 2028 wrote to memory of 2504 2028 0f5bb32071eaf08c67724f035ccd16c7a7d0eff091813698695528f77441f8c2.exe 94 PID 2028 wrote to memory of 2504 2028 0f5bb32071eaf08c67724f035ccd16c7a7d0eff091813698695528f77441f8c2.exe 94 PID 2504 wrote to memory of 3744 2504 Soanquan.exe 96 PID 2504 wrote to memory of 3744 2504 Soanquan.exe 96 PID 2504 wrote to memory of 3744 2504 Soanquan.exe 96 PID 2504 wrote to memory of 3744 2504 Soanquan.exe 96 PID 2504 wrote to memory of 3744 2504 Soanquan.exe 96 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2648
-
C:\Windows\SysWOW64\openwith.exe"C:\Windows\system32\openwith.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3744
-
-
C:\Users\Admin\AppData\Local\Temp\0f5bb32071eaf08c67724f035ccd16c7a7d0eff091813698695528f77441f8c2.exe"C:\Users\Admin\AppData\Local\Temp\0f5bb32071eaf08c67724f035ccd16c7a7d0eff091813698695528f77441f8c2.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Program Files (x86)\sougou\sogou.exe"C:\Program Files (x86)\sougou\sogou.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5016
-
-
C:\Program Files (x86)\sougou\Soanquan.exe"C:\Program Files (x86)\sougou\Soanquan.exe" "C:\Program Files (x86)\sougou\config.ini"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4780
-
-
C:\Program Files (x86)\sougou\Soanquan.exe"C:\Program Files (x86)\sougou\Soanquan.exe" "C:\Program Files (x86)\sougou\so_coflog.ini"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2504
-
-
C:\Program Files (x86)\sougou\Soanquan.exe"C:\Program Files (x86)\sougou\Soanquan.exe" "C:\Program Files (x86)\sougou\config.ini"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5032
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD5426dfd5ece3b41970773031637cd5539
SHA1d0fe14f8dab89aaddac8b1c89b1cee48396ec636
SHA256737f08702f00e78dbe78acbeda63b73d04c1f8e741c5282a9aa1409369b6efa8
SHA5125c66ea3360115d6dcc71f6d624a886f3c992c5d30338880b0ba48db77dd7fa744b60a3d65fed63427ebb3a8bcf9b204e9ba1521d8c9f0e804ce0db76befa8935
-
Filesize
25KB
MD524b6950afd8663a46246044e6b09add8
SHA16444dab57d93ce987c22da66b3706d5d7fc226da
SHA2569aa3ca96a84eb5606694adb58776c9e926020ef184828b6f7e6f9b50498f7071
SHA512e1967e7e8c3d64b61451254da281415edf9946a6c8a46006f39ae091609c65666c376934b1bdcbd2a7f73adea7aa68e557694f804bf3bc3ce7854fa527e91740
-
Filesize
910KB
MD593c7ca328e30b4142f1d7202f864eba7
SHA153dac1968204812a95dedea4b923ed3d1e18b5c1
SHA25601a668544e0bf9ff0ee12f4c090738a8b460c0d183fb4da0169b93d5c02efa7b
SHA5129c68adcb1736d4c4606dbe512df78cca08ba262024d104edb17ceba7014d21eb26747942f4b92c6b87bec537d781c0c00031b581010b67d5f21a4f34b7581441
-
Filesize
164KB
MD524a0d2ef5b931a2a13341a2503b1de80
SHA16201347d1ded92d365126a1225768e11c33ee818
SHA256fbbe7ee073d0290ac13c98b92a8405ea04dcc6837b4144889885dd70679e933f
SHA5125e06f88bb3920cef40a4941efb3b4d3012edf868cc3042f9dbc1989c76b410b4e2da12c20ae2fbcffe5525b43aeca8875e51167d0ce041864d546fdb2e1fecd2
-
Filesize
636KB
MD5eeadda0c0f0a3d77aa19cb86ac98e409
SHA1121ac4e1803cf702a6cd203d6e8716a00f8bfbf0
SHA256ba034a63c036c13bdcac8c147353c377ea48b41361a570bbfd553c3e4e0557aa
SHA51220741145f3997fccb65676ca9e08d4fc47fcf7af72a7c00fd2a967d3f93c1c090f4abf3a2d2a0f074f8a45b1d92823ded9649afa7c415f330514083ef04e8ebb
-
Filesize
521B
MD582fd1c0a56b8af6ad97d973328281509
SHA15b4d01cb01d2e5e62dd3026de96dcf37f5713b89
SHA256a57a4a3a9e484a52872a0c105ac939bf91e97033f4e40c21e5fd03f0bf8bc548
SHA5123ced1456093d84e9617e630d06128da646b41720e873822c37cb40b4698919c4c543250ab9f191d73d6aac1109206655faa179dd781a578e1f778fe92b9a4b08
-
Filesize
25KB
MD540d7eca32b2f4d29db98715dd45bfac5
SHA1124df3f617f562e46095776454e1c0c7bb791cc7
SHA25685e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
SHA5125fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d
-
Filesize
12KB
MD5da4bc09439ed21faf7620a53433aac92
SHA194e3347aebe16cb88b9f29f00134d9e0fb67e508
SHA256216d68d3f0b37bb2203b3a438a84a089e8c388608f46377ad7e7d6a2709cf9b0
SHA512920294456e8fee0c4137e4b4ba1389f09ade297d6ed49d78a9593d129dbb5eb048da2cbff7ac29687999991d5f38657cb31af73e2ccf6b8b9ce29480d4d81ec6
-
Filesize
138KB
MD5154aea6ca8875fe8023f5f0554adbe60
SHA154a6c770e4ab3aef95782f1bc647ab664163d42f
SHA256e035633d5a97dbc492d125a379a198ddadb09547d4b576552016e690a573e339
SHA51293063a15acf077e0de9634eef68d21a3243be36a3a02f44065cac7c279ddc06a9a9e2ea5ef8f5d70662d6b9a710f988a0455b78aa8f8092155acfd359ae976ec
-
Filesize
5.9MB
MD5745007cd039d16bbbe05e308c223c8b0
SHA1f3fc435a325118cbb4af4219bc41755c245afe54
SHA256b550ed8935bbc51571aabfb5c3130d295909df89e7c4c1e204f219d88a652332
SHA51240d1146fd001f138d0ecd0516078364947f180431bec36a689e03e5fadd4851ec5b6cd5862fc1702231c5a442c1be4bf6c0d759ca333f939cd74d55fc64cad74
-
Filesize
15KB
MD534d24e6ecdfb6859096816436c5875da
SHA1a4504b5eccc48ce867623dd1d081a760ab70a12f
SHA256734d6299964cab87eeeb5f8c7e5bdf6aa8c3e29d938fdd1ada6addcd5006de28
SHA512cf163ef71ed297259371d5bb352f8b0ef5e8bab9ad2168a26714e2d9f9037af87ec48b7e983b9fa9dc3f478c02cc0775583d52aca7604f3ac1e4a8882b3ecad9
-
Filesize
6.0MB
MD5b713d9c939fe455aea4be2eb94215730
SHA1c51af6b0be8452f77056d7a4a8554c8cb21c6ddb
SHA2567dd85f1d4725ff05c35b6c0632992523a3f1cadb6294f516ef2528738b3a53af
SHA5121185b1002c85aa832f380e81a45d50b0a6b44d9b87eefc1a0325c0dfbf921d2b9f531c81d564723874f555a10e2516fa1e6bd91a7e473893083998a57b8e2fed
-
Filesize
3.9MB
MD572fb079823f0e6c80caff804cf626ca9
SHA1464ae7293affcadd0aafec8a52635bcc92047e55
SHA25623a25b73fd5d66aef3abc0c90b1eeff2fd3921a7d49aa69891e926139969b31e
SHA512431d0e3469785981760185b38813148154fecb82abe37431c0591873e462ad597ad1449c29f3619b10f4435c08bbe231877f8debf9c48a26f258c5fef16b52c4
-
Filesize
11KB
MD5c51fc979c1c3e17bece7bd194aeb6ea2
SHA19a5d000d6393f2980062b4cc6e8f543493b1be8f
SHA25693a8e95708882e56250ae55aef93417333b2dbe7ea99590abed34cdca2227e61
SHA512716cdeb890307ff42901464dd24aa94e29415ef20d4e975c2733e34330fdf85edfd4ad9e00878edbe98921deebe44153279cb95acb309c5e1812026716dcdc4e
-
Filesize
958B
MD5254f1d640d048da862bfae63fc161314
SHA1fbbf4ba248a09caa8c7758410fb7a5043be0fe83
SHA25666d7b4061f2ca10f11f6ff49efa151b6976557c03b5558b518e167b9e5fceaca
SHA5120a74ca1334d6f0912487ddcfd2543e0923259c7257081d3751f0122f2cadb79922fde30b1ebe83f0dba92acf8c2aa496a80cc608f327d994f012d37865bb262a
-
Filesize
1010B
MD5718624ff0f0d3cf2442dcf8ce14011b4
SHA1a0a46f861bd81c24bb34e0fef990d56bce0f9876
SHA2564f617a8fd8c8247936a0b13dcfc282f41fa6e78df0be5708f352ed238e5b0550
SHA51267c102fd45571972fb4a809e6a71fe22d28fb263e20096a97356b445ca7e74721739b789655e87a8347d8fce84dc77ab01a40947e8e844a0bac2a40d405a9b03
-
Filesize
87B
MD559da6b50ff42da1a3230fbca1bd90e11
SHA16870be998befa4bf02e8824e0a101303fe76ef4f
SHA2565f60c14e1d82e49f4dd48c648c31bd572adf7a6e236aa7b2a8854bbc90d21c4a
SHA512e3e7061e1ca6d8ce0ebca216d88988247cb6b824b19fe2ed1fd4dfb19bdbb9d231655b378d0990cc51b3df82183cbb28818f60d2efb9cb40daf58ef183ba2a19