Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-11-2024 04:16
Static task
static1
Behavioral task
behavioral1
Sample
SensApi.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
SensApi.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
视频和图片资料被盗版 - Music Plus.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
视频和图片资料被盗版 - Music Plus.exe
Resource
win10v2004-20241007-en
General
-
Target
视频和图片资料被盗版 - Music Plus.exe
-
Size
1.0MB
-
MD5
b89a82fb10e98f2fdf51fa82c7366dd3
-
SHA1
dd814833bbb4600a835dd5dee1eaab826d2923b6
-
SHA256
154a791e737a878965eb50ea879bc96857ef88602d94e169a75b1a6607e6018e
-
SHA512
5c6389dd767c6cc983ab7e4b67a5196c1892f781b47839c49d9863e37a531b458bd7092597a5c8b98271906e7df067e8ac5b1faaec036b1c06ba04508951a6e4
-
SSDEEP
12288:eCAo1EtxbJ5Ai5BMZPxSLEFHC+85GgPSTf8YRf6xQNU3Op:eCAo1EtxbDlKP859PSTFRfHNU3K
Malware Config
Extracted
rhadamanthys
https://95.169.204.214:9855/8255b5411e443eeb9780e/gnkkm53f.k5sne
Signatures
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Rhadamanthys family
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 1916 created 1204 1916 视频和图片资料被盗版 - Music Plus.exe 21 -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\*ChromeUpdate = "rundll32.exe C:\\Users\\Admin\\Documents\\FirefoxData.dll,EntryPoint" reg.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 1908 视频和图片资料被盗版 - Music Plus.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 视频和图片资料被盗版 - Music Plus.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 视频和图片资料被盗版 - Music Plus.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dialer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1916 视频和图片资料被盗版 - Music Plus.exe 1916 视频和图片资料被盗版 - Music Plus.exe 2320 dialer.exe 2320 dialer.exe 2320 dialer.exe 2320 dialer.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1908 wrote to memory of 1916 1908 视频和图片资料被盗版 - Music Plus.exe 31 PID 1908 wrote to memory of 1916 1908 视频和图片资料被盗版 - Music Plus.exe 31 PID 1908 wrote to memory of 1916 1908 视频和图片资料被盗版 - Music Plus.exe 31 PID 1908 wrote to memory of 1916 1908 视频和图片资料被盗版 - Music Plus.exe 31 PID 1908 wrote to memory of 1916 1908 视频和图片资料被盗版 - Music Plus.exe 31 PID 1908 wrote to memory of 1916 1908 视频和图片资料被盗版 - Music Plus.exe 31 PID 1908 wrote to memory of 1916 1908 视频和图片资料被盗版 - Music Plus.exe 31 PID 1916 wrote to memory of 2320 1916 视频和图片资料被盗版 - Music Plus.exe 32 PID 1916 wrote to memory of 2320 1916 视频和图片资料被盗版 - Music Plus.exe 32 PID 1916 wrote to memory of 2320 1916 视频和图片资料被盗版 - Music Plus.exe 32 PID 1916 wrote to memory of 2320 1916 视频和图片资料被盗版 - Music Plus.exe 32 PID 1916 wrote to memory of 2320 1916 视频和图片资料被盗版 - Music Plus.exe 32 PID 1916 wrote to memory of 2320 1916 视频和图片资料被盗版 - Music Plus.exe 32 PID 1908 wrote to memory of 2732 1908 视频和图片资料被盗版 - Music Plus.exe 33 PID 1908 wrote to memory of 2732 1908 视频和图片资料被盗版 - Music Plus.exe 33 PID 1908 wrote to memory of 2732 1908 视频和图片资料被盗版 - Music Plus.exe 33 PID 1908 wrote to memory of 2732 1908 视频和图片资料被盗版 - Music Plus.exe 33 PID 2732 wrote to memory of 2900 2732 cmd.exe 35 PID 2732 wrote to memory of 2900 2732 cmd.exe 35 PID 2732 wrote to memory of 2900 2732 cmd.exe 35 PID 2732 wrote to memory of 2900 2732 cmd.exe 35
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\视频和图片资料被盗版 - Music Plus.exe"C:\Users\Admin\AppData\Local\Temp\视频和图片资料被盗版 - Music Plus.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\视频和图片资料被盗版 - Music Plus.exe"C:\Users\Admin\AppData\Local\Temp\视频和图片资料被盗版 - Music Plus.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1916
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*ChromeUpdate" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\FirefoxData.dll",EntryPoint /f & exit3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\reg.exereg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*ChromeUpdate" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\FirefoxData.dll",EntryPoint /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2900
-
-
-
-
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2320
-