Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11-06-2024 06:27
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240426-en
General
-
Target
file.exe
-
Size
1.7MB
-
MD5
4363d52fe7027df2212ad2b3333ebaf9
-
SHA1
beac1fc8c012a28cb9f38f6e4296278543048fcf
-
SHA256
ff7284f443ac1839a20dff816f93f2f7e09a3c3e50cf9b8d479c620fc282ddcc
-
SHA512
bb5bcb9f7b42d370b86ad7d4c16605d9bf755fd2291a70716facc2aa62baf45aabf068882c413334332af5819a97c9c4d7703edb9ec84edd8e87c57bab36acee
-
SSDEEP
24576:ZMm5SH6MIl3LkGDhsmD/U0wA77v+M0yYvh3J9oeVaEJyqH2ai519He:ZMm5Lnl7kSUEXvAyUh3J9oeVaEk5rHe
Malware Config
Signatures
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
AddInProcess32.exedescription pid process target process PID 432 created 2928 432 AddInProcess32.exe sihost.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
file.exeAddInProcess32.exedescription pid process target process PID 2848 set thread context of 1964 2848 file.exe AddInProcess32.exe PID 2848 set thread context of 432 2848 file.exe AddInProcess32.exe PID 1964 set thread context of 1852 1964 AddInProcess32.exe InstallUtil.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4524 432 WerFault.exe AddInProcess32.exe 4996 432 WerFault.exe AddInProcess32.exe -
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
file.exeAddInProcess32.exeAddInProcess32.exedialer.exeInstallUtil.exepid process 2848 file.exe 2848 file.exe 1964 AddInProcess32.exe 2848 file.exe 2848 file.exe 1964 AddInProcess32.exe 1964 AddInProcess32.exe 1964 AddInProcess32.exe 1964 AddInProcess32.exe 1964 AddInProcess32.exe 432 AddInProcess32.exe 432 AddInProcess32.exe 2584 dialer.exe 2584 dialer.exe 2584 dialer.exe 2584 dialer.exe 1852 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
file.exeAddInProcess32.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 2848 file.exe Token: SeDebugPrivilege 1964 AddInProcess32.exe Token: SeDebugPrivilege 1852 InstallUtil.exe Token: SeBackupPrivilege 1852 InstallUtil.exe Token: SeSecurityPrivilege 1852 InstallUtil.exe Token: SeSecurityPrivilege 1852 InstallUtil.exe Token: SeSecurityPrivilege 1852 InstallUtil.exe Token: SeSecurityPrivilege 1852 InstallUtil.exe -
Suspicious use of WriteProcessMemory 57 IoCs
Processes:
file.exeAddInProcess32.exeAddInProcess32.exedescription pid process target process PID 2848 wrote to memory of 1964 2848 file.exe AddInProcess32.exe PID 2848 wrote to memory of 1964 2848 file.exe AddInProcess32.exe PID 2848 wrote to memory of 1964 2848 file.exe AddInProcess32.exe PID 2848 wrote to memory of 1964 2848 file.exe AddInProcess32.exe PID 2848 wrote to memory of 1964 2848 file.exe AddInProcess32.exe PID 2848 wrote to memory of 1964 2848 file.exe AddInProcess32.exe PID 2848 wrote to memory of 1964 2848 file.exe AddInProcess32.exe PID 2848 wrote to memory of 1964 2848 file.exe AddInProcess32.exe PID 2848 wrote to memory of 4864 2848 file.exe AddInProcess32.exe PID 2848 wrote to memory of 4864 2848 file.exe AddInProcess32.exe PID 2848 wrote to memory of 4864 2848 file.exe AddInProcess32.exe PID 2848 wrote to memory of 4864 2848 file.exe AddInProcess32.exe PID 2848 wrote to memory of 4864 2848 file.exe AddInProcess32.exe PID 2848 wrote to memory of 4864 2848 file.exe AddInProcess32.exe PID 2848 wrote to memory of 4864 2848 file.exe AddInProcess32.exe PID 2848 wrote to memory of 4864 2848 file.exe AddInProcess32.exe PID 2848 wrote to memory of 4864 2848 file.exe AddInProcess32.exe PID 2848 wrote to memory of 4864 2848 file.exe AddInProcess32.exe PID 2848 wrote to memory of 432 2848 file.exe AddInProcess32.exe PID 2848 wrote to memory of 432 2848 file.exe AddInProcess32.exe PID 2848 wrote to memory of 432 2848 file.exe AddInProcess32.exe PID 2848 wrote to memory of 432 2848 file.exe AddInProcess32.exe PID 2848 wrote to memory of 432 2848 file.exe AddInProcess32.exe PID 2848 wrote to memory of 432 2848 file.exe AddInProcess32.exe PID 2848 wrote to memory of 432 2848 file.exe AddInProcess32.exe PID 2848 wrote to memory of 432 2848 file.exe AddInProcess32.exe PID 2848 wrote to memory of 432 2848 file.exe AddInProcess32.exe PID 2848 wrote to memory of 432 2848 file.exe AddInProcess32.exe PID 1964 wrote to memory of 4412 1964 AddInProcess32.exe InstallUtil.exe PID 1964 wrote to memory of 4412 1964 AddInProcess32.exe InstallUtil.exe PID 1964 wrote to memory of 4412 1964 AddInProcess32.exe InstallUtil.exe PID 1964 wrote to memory of 4412 1964 AddInProcess32.exe InstallUtil.exe PID 1964 wrote to memory of 4412 1964 AddInProcess32.exe InstallUtil.exe PID 1964 wrote to memory of 4412 1964 AddInProcess32.exe InstallUtil.exe PID 1964 wrote to memory of 4412 1964 AddInProcess32.exe InstallUtil.exe PID 1964 wrote to memory of 4412 1964 AddInProcess32.exe InstallUtil.exe PID 1964 wrote to memory of 2424 1964 AddInProcess32.exe InstallUtil.exe PID 1964 wrote to memory of 2424 1964 AddInProcess32.exe InstallUtil.exe PID 1964 wrote to memory of 2424 1964 AddInProcess32.exe InstallUtil.exe PID 1964 wrote to memory of 2424 1964 AddInProcess32.exe InstallUtil.exe PID 1964 wrote to memory of 2424 1964 AddInProcess32.exe InstallUtil.exe PID 1964 wrote to memory of 2424 1964 AddInProcess32.exe InstallUtil.exe PID 1964 wrote to memory of 2424 1964 AddInProcess32.exe InstallUtil.exe PID 1964 wrote to memory of 2424 1964 AddInProcess32.exe InstallUtil.exe PID 1964 wrote to memory of 1852 1964 AddInProcess32.exe InstallUtil.exe PID 1964 wrote to memory of 1852 1964 AddInProcess32.exe InstallUtil.exe PID 1964 wrote to memory of 1852 1964 AddInProcess32.exe InstallUtil.exe PID 1964 wrote to memory of 1852 1964 AddInProcess32.exe InstallUtil.exe PID 1964 wrote to memory of 1852 1964 AddInProcess32.exe InstallUtil.exe PID 1964 wrote to memory of 1852 1964 AddInProcess32.exe InstallUtil.exe PID 1964 wrote to memory of 1852 1964 AddInProcess32.exe InstallUtil.exe PID 1964 wrote to memory of 1852 1964 AddInProcess32.exe InstallUtil.exe PID 432 wrote to memory of 2584 432 AddInProcess32.exe dialer.exe PID 432 wrote to memory of 2584 432 AddInProcess32.exe dialer.exe PID 432 wrote to memory of 2584 432 AddInProcess32.exe dialer.exe PID 432 wrote to memory of 2584 432 AddInProcess32.exe dialer.exe PID 432 wrote to memory of 2584 432 AddInProcess32.exe dialer.exe
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 432 -s 4523⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 432 -s 4483⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 432 -ip 4321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 432 -ip 4321⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/432-38-0x0000000003690000-0x0000000003A90000-memory.dmpFilesize
4.0MB
-
memory/432-28-0x00007FF80A710000-0x00007FF80A905000-memory.dmpFilesize
2.0MB
-
memory/432-27-0x0000000003690000-0x0000000003A90000-memory.dmpFilesize
4.0MB
-
memory/432-26-0x0000000003690000-0x0000000003A90000-memory.dmpFilesize
4.0MB
-
memory/432-25-0x0000000003690000-0x0000000003A90000-memory.dmpFilesize
4.0MB
-
memory/432-30-0x0000000076A70000-0x0000000076C85000-memory.dmpFilesize
2.1MB
-
memory/432-23-0x0000000000400000-0x000000000046D000-memory.dmpFilesize
436KB
-
memory/432-31-0x0000000003690000-0x0000000003A90000-memory.dmpFilesize
4.0MB
-
memory/432-21-0x0000000000400000-0x000000000046D000-memory.dmpFilesize
436KB
-
memory/1852-45-0x00000000088B0000-0x00000000088EC000-memory.dmpFilesize
240KB
-
memory/1852-43-0x0000000008910000-0x0000000008A1A000-memory.dmpFilesize
1.0MB
-
memory/1852-51-0x000000000AAA0000-0x000000000AFCC000-memory.dmpFilesize
5.2MB
-
memory/1852-50-0x000000000A3A0000-0x000000000A562000-memory.dmpFilesize
1.8MB
-
memory/1852-49-0x0000000009420000-0x000000000943E000-memory.dmpFilesize
120KB
-
memory/1852-39-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1852-48-0x0000000009470000-0x00000000094E6000-memory.dmpFilesize
472KB
-
memory/1852-47-0x0000000008B30000-0x0000000008B96000-memory.dmpFilesize
408KB
-
memory/1852-46-0x0000000008A20000-0x0000000008A6C000-memory.dmpFilesize
304KB
-
memory/1852-42-0x0000000008DA0000-0x00000000093B8000-memory.dmpFilesize
6.1MB
-
memory/1852-44-0x0000000008850000-0x0000000008862000-memory.dmpFilesize
72KB
-
memory/1964-20-0x0000000074C40000-0x00000000753F0000-memory.dmpFilesize
7.7MB
-
memory/1964-19-0x0000000074C40000-0x00000000753F0000-memory.dmpFilesize
7.7MB
-
memory/1964-17-0x0000000074C40000-0x00000000753F0000-memory.dmpFilesize
7.7MB
-
memory/1964-16-0x0000000074C40000-0x00000000753F0000-memory.dmpFilesize
7.7MB
-
memory/1964-15-0x0000000074C40000-0x00000000753F0000-memory.dmpFilesize
7.7MB
-
memory/1964-13-0x0000000000400000-0x00000000004C0000-memory.dmpFilesize
768KB
-
memory/1964-12-0x0000000000400000-0x00000000004C0000-memory.dmpFilesize
768KB
-
memory/1964-41-0x0000000074C40000-0x00000000753F0000-memory.dmpFilesize
7.7MB
-
memory/2584-37-0x0000000076A70000-0x0000000076C85000-memory.dmpFilesize
2.1MB
-
memory/2584-35-0x00007FF80A710000-0x00007FF80A905000-memory.dmpFilesize
2.0MB
-
memory/2584-32-0x0000000000F80000-0x0000000000F89000-memory.dmpFilesize
36KB
-
memory/2584-34-0x0000000002CB0000-0x00000000030B0000-memory.dmpFilesize
4.0MB
-
memory/2848-10-0x0000000074C4E000-0x0000000074C4F000-memory.dmpFilesize
4KB
-
memory/2848-8-0x00000000073D0000-0x00000000073EA000-memory.dmpFilesize
104KB
-
memory/2848-18-0x0000000074C40000-0x00000000753F0000-memory.dmpFilesize
7.7MB
-
memory/2848-14-0x0000000074C40000-0x00000000753F0000-memory.dmpFilesize
7.7MB
-
memory/2848-11-0x0000000074C40000-0x00000000753F0000-memory.dmpFilesize
7.7MB
-
memory/2848-24-0x0000000074C40000-0x00000000753F0000-memory.dmpFilesize
7.7MB
-
memory/2848-9-0x0000000007400000-0x0000000007406000-memory.dmpFilesize
24KB
-
memory/2848-0-0x0000000074C4E000-0x0000000074C4F000-memory.dmpFilesize
4KB
-
memory/2848-7-0x00000000060C0000-0x00000000060CA000-memory.dmpFilesize
40KB
-
memory/2848-6-0x0000000005EE0000-0x0000000005F24000-memory.dmpFilesize
272KB
-
memory/2848-5-0x0000000074C40000-0x00000000753F0000-memory.dmpFilesize
7.7MB
-
memory/2848-4-0x0000000004DC0000-0x0000000004E5C000-memory.dmpFilesize
624KB
-
memory/2848-3-0x0000000004D20000-0x0000000004DB2000-memory.dmpFilesize
584KB
-
memory/2848-2-0x0000000005230000-0x00000000057D4000-memory.dmpFilesize
5.6MB
-
memory/2848-1-0x00000000005B0000-0x0000000000760000-memory.dmpFilesize
1.7MB