Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
03/02/2025, 12:52
Static task
static1
Behavioral task
behavioral1
Sample
e0af73a0efbedf9112f02d898a393f6cc27817d1d7fa3b4e7b4041e9b9761bbf.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e0af73a0efbedf9112f02d898a393f6cc27817d1d7fa3b4e7b4041e9b9761bbf.dll
Resource
win10v2004-20250129-en
General
-
Target
e0af73a0efbedf9112f02d898a393f6cc27817d1d7fa3b4e7b4041e9b9761bbf.dll
-
Size
35.2MB
-
MD5
70ddc0b1d2e04545d4f8ea67e12919d7
-
SHA1
cb1445d1ae1599cbaa94c38ec6c84bc56ed1f797
-
SHA256
e0af73a0efbedf9112f02d898a393f6cc27817d1d7fa3b4e7b4041e9b9761bbf
-
SHA512
e99f836991d6665392dce55cbfb8bca590fca8981bdad493e589c93d623e6e62b66d9521aa6d45e4aa849f93960524137fb18ecef48c70fbdc676286239fc8cd
-
SSDEEP
786432:axaUJjkneASghu3B4RRJLk/kNzGvZNFbYFtYPrRINGO4uKUEBkH:aYsjkeZwu3B4RHLquzWZvbYF8WNLKUb
Malware Config
Signatures
-
Detects Rhadamanthys payload 4 IoCs
resource yara_rule behavioral2/memory/4804-2-0x0000000000600000-0x0000000000681000-memory.dmp Rhadamanthys_v8 behavioral2/memory/4804-3-0x0000000000600000-0x0000000000681000-memory.dmp Rhadamanthys_v8 behavioral2/memory/4804-4-0x0000000000600000-0x0000000000681000-memory.dmp Rhadamanthys_v8 behavioral2/memory/4804-5-0x0000000000600000-0x0000000000681000-memory.dmp Rhadamanthys_v8 -
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Rhadamanthys family
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 4804 created 2976 4804 rundll32.exe 50 -
Program crash 1 IoCs
pid pid_target Process procid_target 2236 4804 WerFault.exe 89 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4804 rundll32.exe 4804 rundll32.exe 4804 rundll32.exe 4804 rundll32.exe 1556 svchost.exe 1556 svchost.exe 1556 svchost.exe 1556 svchost.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 684 wrote to memory of 1116 684 rundll32.exe 83 PID 684 wrote to memory of 1116 684 rundll32.exe 83 PID 684 wrote to memory of 1116 684 rundll32.exe 83 PID 1116 wrote to memory of 4804 1116 rundll32.exe 89 PID 1116 wrote to memory of 4804 1116 rundll32.exe 89 PID 1116 wrote to memory of 4804 1116 rundll32.exe 89 PID 1116 wrote to memory of 4804 1116 rundll32.exe 89 PID 1116 wrote to memory of 4804 1116 rundll32.exe 89 PID 4804 wrote to memory of 1556 4804 rundll32.exe 90 PID 4804 wrote to memory of 1556 4804 rundll32.exe 90 PID 4804 wrote to memory of 1556 4804 rundll32.exe 90 PID 4804 wrote to memory of 1556 4804 rundll32.exe 90 PID 4804 wrote to memory of 1556 4804 rundll32.exe 90
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2976
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\System32\svchost.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1556
-
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e0af73a0efbedf9112f02d898a393f6cc27817d1d7fa3b4e7b4041e9b9761bbf.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e0af73a0efbedf9112f02d898a393f6cc27817d1d7fa3b4e7b4041e9b9761bbf.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4804 -s 5884⤵
- Program crash
PID:2236
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4804 -ip 48041⤵PID:4208