Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2024 07:56
Static task
static1
Behavioral task
behavioral1
Sample
3fbeae5e48d7f3b2ce4beac3347d9aa259fd2c9c6f5485ae166e74dc5268e071.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral2
Sample
3fbeae5e48d7f3b2ce4beac3347d9aa259fd2c9c6f5485ae166e74dc5268e071.exe
Resource
win11-20240508-en
General
-
Target
3fbeae5e48d7f3b2ce4beac3347d9aa259fd2c9c6f5485ae166e74dc5268e071.exe
-
Size
5.8MB
-
MD5
4a922d6992bf344a9c7644152f2197d6
-
SHA1
8c1b209d2e42e94932de731e4f537065582b2fff
-
SHA256
3fbeae5e48d7f3b2ce4beac3347d9aa259fd2c9c6f5485ae166e74dc5268e071
-
SHA512
f9bdf54587dc1ed1a19bd8183011ec6256bacd10f05cd8aff69835d687ad2584cf8e1bce48ab90ee44cb26164f84b45411dc3f925d9a8b701b61a69ba140d0fd
-
SSDEEP
98304:ZaXtcsYpSvHtspnAGNkg7O4MrThvpXO0xWs80ADgPmGzG5zEuACQZ+uCJ1:gjf2pnAGN17O4MZlnxVmgmG65zEfz+uU
Malware Config
Signatures
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
AddInProcess32.exedescription pid process target process PID 3032 created 2668 3032 AddInProcess32.exe sihost.exe -
Executes dropped EXE 1 IoCs
Processes:
aloneinstruction.exepid process 4504 aloneinstruction.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
3fbeae5e48d7f3b2ce4beac3347d9aa259fd2c9c6f5485ae166e74dc5268e071.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 3fbeae5e48d7f3b2ce4beac3347d9aa259fd2c9c6f5485ae166e74dc5268e071.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
aloneinstruction.exedescription pid process target process PID 4504 set thread context of 3032 4504 aloneinstruction.exe AddInProcess32.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4700 3032 WerFault.exe AddInProcess32.exe 4328 3032 WerFault.exe AddInProcess32.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
aloneinstruction.exeAddInProcess32.exedialer.exepid process 4504 aloneinstruction.exe 4504 aloneinstruction.exe 3032 AddInProcess32.exe 3032 AddInProcess32.exe 3500 dialer.exe 3500 dialer.exe 3500 dialer.exe 3500 dialer.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
aloneinstruction.exedescription pid process Token: SeDebugPrivilege 4504 aloneinstruction.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
3fbeae5e48d7f3b2ce4beac3347d9aa259fd2c9c6f5485ae166e74dc5268e071.exealoneinstruction.exeAddInProcess32.exedescription pid process target process PID 4348 wrote to memory of 4504 4348 3fbeae5e48d7f3b2ce4beac3347d9aa259fd2c9c6f5485ae166e74dc5268e071.exe aloneinstruction.exe PID 4348 wrote to memory of 4504 4348 3fbeae5e48d7f3b2ce4beac3347d9aa259fd2c9c6f5485ae166e74dc5268e071.exe aloneinstruction.exe PID 4348 wrote to memory of 4504 4348 3fbeae5e48d7f3b2ce4beac3347d9aa259fd2c9c6f5485ae166e74dc5268e071.exe aloneinstruction.exe PID 4504 wrote to memory of 3032 4504 aloneinstruction.exe AddInProcess32.exe PID 4504 wrote to memory of 3032 4504 aloneinstruction.exe AddInProcess32.exe PID 4504 wrote to memory of 3032 4504 aloneinstruction.exe AddInProcess32.exe PID 4504 wrote to memory of 3032 4504 aloneinstruction.exe AddInProcess32.exe PID 4504 wrote to memory of 3032 4504 aloneinstruction.exe AddInProcess32.exe PID 4504 wrote to memory of 3032 4504 aloneinstruction.exe AddInProcess32.exe PID 4504 wrote to memory of 3032 4504 aloneinstruction.exe AddInProcess32.exe PID 4504 wrote to memory of 3032 4504 aloneinstruction.exe AddInProcess32.exe PID 4504 wrote to memory of 3032 4504 aloneinstruction.exe AddInProcess32.exe PID 4504 wrote to memory of 3032 4504 aloneinstruction.exe AddInProcess32.exe PID 3032 wrote to memory of 3500 3032 AddInProcess32.exe dialer.exe PID 3032 wrote to memory of 3500 3032 AddInProcess32.exe dialer.exe PID 3032 wrote to memory of 3500 3032 AddInProcess32.exe dialer.exe PID 3032 wrote to memory of 3500 3032 AddInProcess32.exe dialer.exe PID 3032 wrote to memory of 3500 3032 AddInProcess32.exe dialer.exe
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\3fbeae5e48d7f3b2ce4beac3347d9aa259fd2c9c6f5485ae166e74dc5268e071.exe"C:\Users\Admin\AppData\Local\Temp\3fbeae5e48d7f3b2ce4beac3347d9aa259fd2c9c6f5485ae166e74dc5268e071.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\aloneinstruction.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\aloneinstruction.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 4444⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 4404⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3032 -ip 30321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3032 -ip 30321⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\aloneinstruction.exeFilesize
5.9MB
MD5811e677418814cfb459322911300f937
SHA1809f186624366e8311a756e36fb2fac936836406
SHA25626325ef507bc3567275a68ce31d7934e0ff264af9829525f81995e15a79f3a9b
SHA512f2fa8f40c3fb482ec8dbc396593ecd8abbf59482055916d5cfd3b7fa93ea38270c5700fc9af5f1b3623c6d7f24ce399e7984aa1cdac9778333103979a1278043
-
memory/3032-26-0x0000000003530000-0x0000000003930000-memory.dmpFilesize
4.0MB
-
memory/3032-22-0x0000000003530000-0x0000000003930000-memory.dmpFilesize
4.0MB
-
memory/3032-24-0x0000000003530000-0x0000000003930000-memory.dmpFilesize
4.0MB
-
memory/3032-28-0x0000000075720000-0x0000000075935000-memory.dmpFilesize
2.1MB
-
memory/3032-25-0x00007FFB895B0000-0x00007FFB897A5000-memory.dmpFilesize
2.0MB
-
memory/3032-38-0x0000000003530000-0x0000000003930000-memory.dmpFilesize
4.0MB
-
memory/3032-23-0x0000000003530000-0x0000000003930000-memory.dmpFilesize
4.0MB
-
memory/3032-20-0x0000000000400000-0x000000000046D000-memory.dmpFilesize
436KB
-
memory/3032-18-0x0000000000400000-0x000000000046D000-memory.dmpFilesize
436KB
-
memory/3500-31-0x0000000002D00000-0x0000000003100000-memory.dmpFilesize
4.0MB
-
memory/3500-32-0x00007FFB895B0000-0x00007FFB897A5000-memory.dmpFilesize
2.0MB
-
memory/3500-29-0x0000000000FE0000-0x0000000000FE9000-memory.dmpFilesize
36KB
-
memory/3500-34-0x0000000075720000-0x0000000075935000-memory.dmpFilesize
2.1MB
-
memory/3500-37-0x0000000002D00000-0x0000000003100000-memory.dmpFilesize
4.0MB
-
memory/3500-36-0x0000000002D00000-0x0000000003100000-memory.dmpFilesize
4.0MB
-
memory/3500-35-0x0000000000FE0000-0x0000000000FE9000-memory.dmpFilesize
36KB
-
memory/3500-39-0x0000000002D00000-0x0000000003100000-memory.dmpFilesize
4.0MB
-
memory/4504-12-0x0000000006280000-0x000000000628A000-memory.dmpFilesize
40KB
-
memory/4504-21-0x00000000749E0000-0x0000000075190000-memory.dmpFilesize
7.7MB
-
memory/4504-17-0x0000000006710000-0x0000000006716000-memory.dmpFilesize
24KB
-
memory/4504-16-0x00000000066D0000-0x00000000066EA000-memory.dmpFilesize
104KB
-
memory/4504-15-0x00000000749E0000-0x0000000075190000-memory.dmpFilesize
7.7MB
-
memory/4504-14-0x00000000749EE000-0x00000000749EF000-memory.dmpFilesize
4KB
-
memory/4504-13-0x00000000749E0000-0x0000000075190000-memory.dmpFilesize
7.7MB
-
memory/4504-11-0x00000000749E0000-0x0000000075190000-memory.dmpFilesize
7.7MB
-
memory/4504-10-0x00000000061F0000-0x0000000006234000-memory.dmpFilesize
272KB
-
memory/4504-9-0x00000000053D0000-0x000000000546C000-memory.dmpFilesize
624KB
-
memory/4504-8-0x0000000005330000-0x00000000053C2000-memory.dmpFilesize
584KB
-
memory/4504-7-0x0000000005840000-0x0000000005DE4000-memory.dmpFilesize
5.6MB
-
memory/4504-6-0x0000000000A70000-0x000000000105E000-memory.dmpFilesize
5.9MB
-
memory/4504-5-0x00000000749EE000-0x00000000749EF000-memory.dmpFilesize
4KB