Resubmissions
27/11/2024, 09:54
241127-lxb8yavpck 1020/08/2024, 14:48
240820-r6q2casajl 1019/12/2023, 13:13
231219-qf3rsadcg7 10Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
19/12/2023, 13:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bb.exe
Resource
win7-20231215-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
bb.exe
Resource
win10v2004-20231215-en
4 signatures
150 seconds
General
-
Target
bb.exe
-
Size
479KB
-
MD5
b2dc71aeb389c4c5f6b3699163ea1d0f
-
SHA1
578239aefa2c93cae72624754146e8f3e275fa5e
-
SHA256
bb8bbcc948e8dca2e5a0270c41c062a29994a2d9b51e820ed74d9b6e2a01ddcf
-
SHA512
2ac4ebf5ca226384b299167c58aaf4e24ab4a2a4897ef914871803df23794a44a1c9ab638b1714653cd767e566fb5bd0745ebc26f0dc5a3be4e345e6ef5b9461
-
SSDEEP
6144:pTNlPsSiE0grIlHAjNL7SVAtKZnbr8qz6xzS06d17GQxAAXcpGZ5wIzkyOD+lRXs:pFR0gsAjNLJtQbr8w6xely1JcXgDsLm
Score
10/10
Malware Config
Signatures
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Deletes itself 1 IoCs
pid Process 2452 dialer.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1520 bb.exe 1520 bb.exe 2452 dialer.exe 2452 dialer.exe 2452 dialer.exe 2452 dialer.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1520 wrote to memory of 2452 1520 bb.exe 28 PID 1520 wrote to memory of 2452 1520 bb.exe 28 PID 1520 wrote to memory of 2452 1520 bb.exe 28 PID 1520 wrote to memory of 2452 1520 bb.exe 28 PID 1520 wrote to memory of 2452 1520 bb.exe 28 PID 1520 wrote to memory of 2452 1520 bb.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\bb.exe"C:\Users\Admin\AppData\Local\Temp\bb.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
PID:2452
-