Overview
overview
10Static
static
3Additional...32.dll
windows10-2004-x64
3Additional...64.dll
windows10-2004-x64
1Additional...rs.dll
windows10-2004-x64
1Additional...64.dll
windows10-2004-x64
4DLL/D3Dcom...47.dll
windows10-2004-x64
3DLL/Qt5Core.dll
windows10-2004-x64
3DLL/Qt5Gui.dll
windows10-2004-x64
1DLL/Qt5Network.dll
windows10-2004-x64
3DLL/Qt5Qml.dll
windows10-2004-x64
3DLL/Qt5Quick.dll
windows10-2004-x64
1DLL/Qt5Widgets.dll
windows10-2004-x64
3DLL/browser.dll
windows10-2004-x64
3DLL/libGLESV2.dll
windows10-2004-x64
1DLL/libcrypto-1_1.dll
windows10-2004-x64
3DLL/opengl32sw.dll
windows10-2004-x64
1DLL/ucrtbase.dll
windows10-2004-x64
1FileInstaller.exe
windows10-2004-x64
10Analysis
-
max time kernel
87s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
09-06-2024 10:21
Static task
static1
Behavioral task
behavioral1
Sample
Additional/CiWinCng32.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral2
Sample
Additional/CiWinCng64.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Additional/bdfilters.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
Additional/bdfilters64.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
DLL/D3Dcompiler_47.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral6
Sample
DLL/Qt5Core.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
DLL/Qt5Gui.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral8
Sample
DLL/Qt5Network.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
DLL/Qt5Qml.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral10
Sample
DLL/Qt5Quick.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
DLL/Qt5Widgets.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral12
Sample
DLL/browser.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
DLL/libGLESV2.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral14
Sample
DLL/libcrypto-1_1.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
DLL/opengl32sw.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral16
Sample
DLL/ucrtbase.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
FileInstaller.exe
Resource
win10v2004-20240426-en
General
-
Target
FileInstaller.exe
-
Size
102.0MB
-
MD5
0dcd6d29ce1ed0448b7cd946e7858611
-
SHA1
e938dbff736ea13453da389ebd944dcb28bb4e22
-
SHA256
e49912beac8783d8d815e2d85019d98819abdabcde1a5bc6f3ce93a5a467ddb9
-
SHA512
7fc04b03bb3ba119e1bc13ffe288cab016a63011fa4c7ca3ee063f11e2323696374009baaca8bbef9ea556fddbc65891a6c60960b82982fc7c7c1bb52c7faa0c
-
SSDEEP
12288:MUZ6c25lke0kjcwIdfx5j+uvTJkDRGGF1qLF8yXPeJDBT79fLsaO:ZZ6/wTgcwIdDHJkfAF8gPerT7uaO
Malware Config
Signatures
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
FileInstaller.exedescription pid process target process PID 556 created 2916 556 FileInstaller.exe sihost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3896 556 WerFault.exe FileInstaller.exe 208 556 WerFault.exe FileInstaller.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
FileInstaller.exedialer.exepid process 556 FileInstaller.exe 556 FileInstaller.exe 4692 dialer.exe 4692 dialer.exe 4692 dialer.exe 4692 dialer.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
FileInstaller.exedescription pid process target process PID 556 wrote to memory of 4692 556 FileInstaller.exe dialer.exe PID 556 wrote to memory of 4692 556 FileInstaller.exe dialer.exe PID 556 wrote to memory of 4692 556 FileInstaller.exe dialer.exe PID 556 wrote to memory of 4692 556 FileInstaller.exe dialer.exe PID 556 wrote to memory of 4692 556 FileInstaller.exe dialer.exe
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\FileInstaller.exe"C:\Users\Admin\AppData\Local\Temp\FileInstaller.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 18322⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 18402⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 556 -ip 5561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 556 -ip 5561⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/556-10-0x00000000052F0000-0x00000000056F0000-memory.dmpFilesize
4.0MB
-
memory/556-13-0x0000000076A70000-0x0000000076C85000-memory.dmpFilesize
2.1MB
-
memory/556-4-0x0000000004170000-0x00000000041DD000-memory.dmpFilesize
436KB
-
memory/556-8-0x0000000000A20000-0x0000000000B1A000-memory.dmpFilesize
1000KB
-
memory/556-7-0x0000000000B0C000-0x0000000000B0D000-memory.dmpFilesize
4KB
-
memory/556-9-0x00000000052F0000-0x00000000056F0000-memory.dmpFilesize
4.0MB
-
memory/556-5-0x0000000004170000-0x00000000041DD000-memory.dmpFilesize
436KB
-
memory/556-11-0x00007FFDB69D0000-0x00007FFDB6BC5000-memory.dmpFilesize
2.0MB
-
memory/556-3-0x0000000077B22000-0x0000000077B23000-memory.dmpFilesize
4KB
-
memory/4692-14-0x0000000000B10000-0x0000000000B19000-memory.dmpFilesize
36KB
-
memory/4692-18-0x00007FFDB69D0000-0x00007FFDB6BC5000-memory.dmpFilesize
2.0MB
-
memory/4692-20-0x0000000076A70000-0x0000000076C85000-memory.dmpFilesize
2.1MB
-
memory/4692-21-0x0000000002830000-0x0000000002C30000-memory.dmpFilesize
4.0MB
-
memory/4692-17-0x0000000002830000-0x0000000002C30000-memory.dmpFilesize
4.0MB
-
memory/4692-22-0x0000000002830000-0x0000000002C30000-memory.dmpFilesize
4.0MB