Windows
Analysis Report
MqE1p1WFrf.exe
Overview
General Information
Detection
RHADAMANTHYS
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Multi AV Scanner detection for submitted file
Yara detected RHADAMANTHYS Stealer
Yara detected AntiVM3
System process connects to network (likely due to code injection or exploit)
Multi AV Scanner detection for dropped file
Snort IDS alert for network traffic
Hides threads from debuggers
Tries to steal Mail credentials (via file / registry access)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Query firmware table information (likely to detect VMs)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Queries memory information (via WMI often done to detect virtual machines)
Tries to harvest and steal Bitcoin Wallet information
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Checks if the current machine is a virtual machine (disk enumeration)
Tries to harvest and steal browser information (history, passwords, etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
One or more processes crash
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Found evasive API chain (may stop execution after checking a module file name)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a DirectInput object (often for capturing keystrokes)
Is looking for software installed on the system
Queries information about the installed CPU (vendor, model number etc)
Installs a raw input device (often for capturing keystrokes)
Sample file is different than original file name gathered from version info
Allocates memory with a write watch (potentially for evading sandboxes)
Drops PE files
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Yara detected Keylogger Generic
Dropped file seen in connection with other malware
Uses Microsoft's Enhanced Cryptographic Provider
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Classification
- System is w10x64
MqE1p1WFrf.exe (PID: 3648 cmdline:
C:\Users\u ser\Deskto p\MqE1p1WF rf.exe MD5: DD10393642798DB29A624785EAD8ECEC) rundll32.exe (PID: 3352 cmdline:
"C:\Users \user\AppD ata\Roamin g\nsis_uns 60877c.dll ",PrintUIE ntry |5CQk OhmAAAA|1T Kr5GsMwYD| 67sDqg8OAA l|xYmwxC0T NSO|1k8B3t Zkgiyf2sAZ QByAG4XAP9 sADMAMgAuA KVkHwBs8|A tBQPz8DW|A E8ANgBGOwB jrwAxAHYhA ElJAEjvADA AWi0CWUiD| +wo6AQCAAB I|4PEKMPMz MxM|4lEJBh IiVQkvxBIi UwkCF0BSP+ LRCQwSIkEJ PaBAThIbwA ISMdE2yQQL QHrDoEBEEj Xg8ABjwEQg QFASO05lgB zJZ8Diwwk| 0gDyEiLwUi L9UyrAVR7A APRSIt|yoo JiAjrwWYFv 2VIiwQlYPP wM||JSItQG Eg70f90Nki DwiBIi|8CS DvCdCpmg|9 4SBh1GkyLQ P9QZkGDOGt 0B+4REUt1C BEQeBAu|3Q FSIsA69VI6 4tI|QDBagB AU1X|VldBV EFVQVb7QVd dAWaBOU1a| 02L+EyL8ki L79kPhfzz8 ExjSf88QYE 8CVBFAO8AD 4Xq8|BBi4T 7CYjz8IXAS I087wEPhNZ qEYO8Cd2ML QEPhMfz8ES L|2cgRItfH It3|yREi08 YTAPh|0wD2 UgD8TPJv0W FyQ+EpPPwT f+LxEGLEEU z0v9IA9OKA oTAdP8dQcH KDQ++wN76A AFEA9C|EXX s|0GB+qr8D Xx0|w6DwQF Jg8AE|0E7y XNp68aL|8E PtwxORYss| 4tMA+t0WDP tvqoQdFFBi xTBANP|M8m KAkyLwuu3D 8HJyBEDyOU QAfdBigDVE O0zwDOf9kE 7DLbgEKYAg ||GAYP4CHL u6|8KSIvLQ f|VSd+JBPe DxeQQxATfO 28Ycq9mAUF f|0FeQV1BX F9e+11bMxd IgexgAf5kA Ivp6Gb+||+ |SIXAD4SYd SBM9Y2vAYs rEMgz|+j9m 30gjV8ETI1 F|0Yz0ovL| 1Qk|WiAIEy L4A+Ea3p1I EWoEDPAi9O RIF9IiXwkI KYgcIAgP0i L8A+ES3Ugp iD|UEiNVgh EjUffQEiNj CSFEUiL79j ofP1+II1WS GreIBDiIcz z8Ohn7yA|R IsGjVcIQSC mIL1YyiGJh CSAhxLe9vP wiw7aIFiJj CTYcREHMJE g6DHvIIuc| i0yTItdOki D+|tsSIogM EyJZCTvOEy LpBoyTIlcb oQBhCTchxG Gko0Ru41HS zCMJPDz8En fi9To6fwFM Iqc7ngySI2 EeDJBgPN|I Y1PbEQwGKQ Cf4PpAXXzg bx4Mv8hUmV 4dU2LhLsk9 CIxlCT4NQH C|0g72HI4g |psv3YzRI1 JQPoAlKdBu ACYAKYgQMo i+Od0GUS2M MAxSY1U+yR skSBJg+hs6 N1rgjBIi86 mIHhI|4X|d BKLVUJM|I4 wGzFIjUwkQ P8P10iBxHQ hYSQtCC0B MD5: 73C519F050C20580F8A62C849D49215A) WerFault.exe (PID: 6076 cmdline:
C:\Windows \system32\ WerFault.e xe -u -p 3 352 -s 648 MD5: 2AFFE478D86272288BBEF5A00BBEF6A0)
- cleanup
⊘No configs have been found
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_RHADAMANTHYS | Yara detected RHADAMANTHYS Stealer | Joe Security | ||
JoeSecurity_RHADAMANTHYS | Yara detected RHADAMANTHYS Stealer | Joe Security | ||
JoeSecurity_RHADAMANTHYS | Yara detected RHADAMANTHYS Stealer | Joe Security | ||
JoeSecurity_AntiVM_3 | Yara detected AntiVM_3 | Joe Security | ||
JoeSecurity_RHADAMANTHYS | Yara detected RHADAMANTHYS Stealer | Joe Security | ||
Click to see the 9 entries |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_RHADAMANTHYS | Yara detected RHADAMANTHYS Stealer | Joe Security | ||
JoeSecurity_RHADAMANTHYS | Yara detected RHADAMANTHYS Stealer | Joe Security | ||
JoeSecurity_RHADAMANTHYS | Yara detected RHADAMANTHYS Stealer | Joe Security | ||
JoeSecurity_RHADAMANTHYS | Yara detected RHADAMANTHYS Stealer | Joe Security | ||
JoeSecurity_Keylogger_Generic | Yara detected Keylogger Generic | Joe Security | ||
Click to see the 2 entries |
⊘No Sigma rule has matched
Timestamp: | 192.168.2.5179.43.163.12649701802853002 01/23/23-21:39:53.428050 |
SID: | 2853002 |
Source Port: | 49701 |
Destination Port: | 80 |
Protocol: | TCP |
Classtype: | A Network Trojan was detected |
Timestamp: | 179.43.163.126192.168.2.580497002853001 01/23/23-21:39:35.293558 |
SID: | 2853001 |
Source Port: | 80 |
Destination Port: | 49700 |
Protocol: | TCP |
Classtype: | A Network Trojan was detected |
Timestamp: | 192.168.2.5179.43.163.12649700802043202 01/23/23-21:39:35.266442 |
SID: | 2043202 |
Source Port: | 49700 |
Destination Port: | 80 |
Protocol: | TCP |
Classtype: | A Network Trojan was detected |
Click to jump to signature section
Show All Signature Results
AV Detection |
---|
Source: | ReversingLabs: | |||
Source: | Virustotal: | Perma Link |
Source: | ReversingLabs: | |||
Source: | Virustotal: | Perma Link |
Source: | Code function: | 4_2_00007DF471DAC06C |
Source: | Static PE information: |
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: |