Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
21/03/2024, 19:37
General
- Target b70551e4d13eb8402086eaf874d6914c.exe
- Size 3.0MB
- Sample240321-ybtbjsaa51
- SHA256 e2a1ffc36a8c09c6944e33cdfecb9dced2221c2bf9b05c5a5037058f3a90839a
Malware Config
Signatures
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 12 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\b70551e4d13eb8402086eaf874d6914c.exe"C:\Users\Admin\AppData\Local\Temp\b70551e4d13eb8402086eaf874d6914c.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\TEMP\{5C3887C5-19A2-4518-9826-4F436684DE8F}\.cr\b70551e4d13eb8402086eaf874d6914c.exe"C:\Windows\TEMP\{5C3887C5-19A2-4518-9826-4F436684DE8F}\.cr\b70551e4d13eb8402086eaf874d6914c.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\b70551e4d13eb8402086eaf874d6914c.exe" -burn.filehandle.attached=644 -burn.filehandle.self=6242⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\TEMP\{76A7CE47-D987-4BFC-A7E0-1EB240B57795}\.ba\RttHlp.exe"C:\Windows\TEMP\{76A7CE47-D987-4BFC-A7E0-1EB240B57795}\.ba\RttHlp.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\AgentClient_dbgv1\RttHlp.exe"C:\Users\Admin\AppData\Roaming\AgentClient_dbgv1\RttHlp.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe6⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
439687f4
Register.dll
hypha.rpm
rtl120.bpl
rtl120.bpl
vcl120.bpl
vcl120.bpl
vcl120.bpl
vcl120.bpl
vcl120.bpl
hypha.rpm
squirearch.db
vcl120.bpl
b70551e4d13eb8402086eaf874d6914c.exe
Pluviose.dll
Register.dll
RttHlp.exe
rtl120.bpl
vcl120.bpl
memory/860-58-0x0000000074640000-0x00000000747BB000-memory.dmp
memory/860-60-0x00007FFA62850000-0x00007FFA62A45000-memory.dmp
memory/860-68-0x0000000050120000-0x000000005030D000-memory.dmp
memory/860-67-0x0000000050000000-0x0000000050116000-memory.dmp
memory/860-65-0x0000000000400000-0x0000000000421000-memory.dmp
memory/860-62-0x0000000074640000-0x00000000747BB000-memory.dmp
memory/860-54-0x00000000028A0000-0x00000000029AF000-memory.dmp
memory/860-55-0x00000000021C0000-0x00000000021C1000-memory.dmp
memory/860-61-0x0000000074640000-0x00000000747BB000-memory.dmp
memory/860-69-0x00000000028A0000-0x00000000029AF000-memory.dmp
memory/952-24-0x0000000002290000-0x0000000002291000-memory.dmp
memory/952-29-0x0000000074640000-0x00000000747BB000-memory.dmp
memory/952-30-0x00007FFA62850000-0x00007FFA62A45000-memory.dmp
memory/952-49-0x0000000050120000-0x000000005030D000-memory.dmp
memory/952-50-0x00000000027C0000-0x00000000028CF000-memory.dmp
memory/952-26-0x00000000027C0000-0x00000000028CF000-memory.dmp
memory/952-39-0x0000000000400000-0x0000000000421000-memory.dmp
memory/952-40-0x0000000050000000-0x0000000050116000-memory.dmp
memory/2152-83-0x00000000041D0000-0x00000000045D0000-memory.dmp
memory/2152-87-0x00000000764D0000-0x00000000766E5000-memory.dmp
memory/2152-89-0x0000000000980000-0x00000000009EE000-memory.dmp
memory/2152-86-0x00000000041D0000-0x00000000045D0000-memory.dmp
memory/2152-81-0x00000000041D0000-0x00000000045D0000-memory.dmp
memory/2152-76-0x0000000000980000-0x00000000009EE000-memory.dmp
memory/2152-77-0x00007FFA62850000-0x00007FFA62A45000-memory.dmp
memory/2152-78-0x0000000000980000-0x00000000009EE000-memory.dmp
memory/2152-80-0x0000000000010000-0x0000000000443000-memory.dmp
memory/2464-75-0x0000000074640000-0x00000000747BB000-memory.dmp
memory/2464-64-0x0000000074640000-0x00000000747BB000-memory.dmp
memory/2464-70-0x00007FFA62850000-0x00007FFA62A45000-memory.dmp
memory/2464-73-0x0000000074640000-0x00000000747BB000-memory.dmp
memory/2464-72-0x0000000074640000-0x00000000747BB000-memory.dmp
memory/4948-88-0x0000000000730000-0x0000000000739000-memory.dmp
memory/4948-92-0x0000000002610000-0x0000000002A10000-memory.dmp
memory/4948-91-0x0000000002610000-0x0000000002A10000-memory.dmp
memory/4948-94-0x0000000002610000-0x0000000002A10000-memory.dmp
memory/4948-93-0x00007FFA62850000-0x00007FFA62A45000-memory.dmp
memory/4948-96-0x00000000764D0000-0x00000000766E5000-memory.dmp
memory/4948-97-0x0000000002610000-0x0000000002A10000-memory.dmp