Analysis
- max time kernel
90s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
22/03/2024, 07:37
General
- Target b1ad5aa40c89bce3ed9d22762085fb2b.exe
- Size 4.0MB
- Sample240322-jft2baaa65
- SHA256 276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf
Malware Config
Signatures
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 12 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\b1ad5aa40c89bce3ed9d22762085fb2b.exe"C:\Users\Admin\AppData\Local\Temp\b1ad5aa40c89bce3ed9d22762085fb2b.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{1C6AE630-E2F0-4DF0-9F54-252209242578}\.cr\b1ad5aa40c89bce3ed9d22762085fb2b.exe"C:\Windows\Temp\{1C6AE630-E2F0-4DF0-9F54-252209242578}\.cr\b1ad5aa40c89bce3ed9d22762085fb2b.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\b1ad5aa40c89bce3ed9d22762085fb2b.exe" -burn.filehandle.attached=512 -burn.filehandle.self=5362⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{4E763421-0B56-405E-9727-65AB97817248}\.ba\RttHlp.exe"C:\Windows\Temp\{4E763421-0B56-405E-9727-65AB97817248}\.ba\RttHlp.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\TyfConfig_alpha\RttHlp.exe"C:\Users\Admin\AppData\Roaming\TyfConfig_alpha\RttHlp.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe6⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
2bf24e3f
rtl120.bpl
vcl120.bpl
b1ad5aa40c89bce3ed9d22762085fb2b.exe
Patrial.dll
Register.dll
RttHlp.exe
hypha.rpm
rtl120.bpl
squirearch.db
vcl120.bpl
memory/664-79-0x0000000000A40000-0x0000000000E73000-memory.dmp
memory/664-77-0x0000000000F80000-0x0000000000FEF000-memory.dmp
memory/664-75-0x0000000000F80000-0x0000000000FEF000-memory.dmp
memory/664-76-0x00007FFBCA770000-0x00007FFBCA965000-memory.dmp
memory/664-80-0x00000000046E0000-0x0000000004AE0000-memory.dmp
memory/664-81-0x0000000000F80000-0x0000000000FEF000-memory.dmp
memory/664-83-0x00000000046E0000-0x0000000004AE0000-memory.dmp
memory/664-87-0x0000000076B10000-0x0000000076D25000-memory.dmp
memory/664-86-0x00000000046E0000-0x0000000004AE0000-memory.dmp
memory/664-82-0x00000000046E0000-0x0000000004AE0000-memory.dmp
memory/3488-88-0x0000000000A10000-0x0000000000A19000-memory.dmp
memory/3488-91-0x0000000002600000-0x0000000002A00000-memory.dmp
memory/3488-96-0x0000000076B10000-0x0000000076D25000-memory.dmp
memory/3488-97-0x0000000002600000-0x0000000002A00000-memory.dmp
memory/3488-93-0x00007FFBCA770000-0x00007FFBCA965000-memory.dmp
memory/3488-95-0x0000000002600000-0x0000000002A00000-memory.dmp
memory/3488-92-0x0000000002600000-0x0000000002A00000-memory.dmp
memory/4348-74-0x0000000073180000-0x00000000732FB000-memory.dmp
memory/4348-64-0x0000000073180000-0x00000000732FB000-memory.dmp
memory/4348-69-0x00007FFBCA770000-0x00007FFBCA965000-memory.dmp
memory/4348-71-0x0000000073180000-0x00000000732FB000-memory.dmp
memory/4348-72-0x0000000073180000-0x00000000732FB000-memory.dmp
memory/4552-39-0x0000000000400000-0x0000000000421000-memory.dmp
memory/4552-56-0x0000000002940000-0x0000000002A4F000-memory.dmp
memory/4552-25-0x0000000002940000-0x0000000002A4F000-memory.dmp
memory/4552-26-0x0000000000560000-0x0000000000561000-memory.dmp
memory/4552-29-0x0000000073180000-0x00000000732FB000-memory.dmp
memory/4552-30-0x00007FFBCA770000-0x00007FFBCA965000-memory.dmp
memory/4552-40-0x0000000050000000-0x0000000050116000-memory.dmp
memory/4552-53-0x0000000050120000-0x000000005030D000-memory.dmp
memory/4744-61-0x0000000073180000-0x00000000732FB000-memory.dmp
memory/4744-58-0x0000000073180000-0x00000000732FB000-memory.dmp
memory/4744-59-0x00007FFBCA770000-0x00007FFBCA965000-memory.dmp
memory/4744-54-0x00000000021D0000-0x00000000021D1000-memory.dmp
memory/4744-52-0x00000000027B0000-0x00000000028BF000-memory.dmp
memory/4744-60-0x0000000073180000-0x00000000732FB000-memory.dmp
memory/4744-68-0x00000000027B0000-0x00000000028BF000-memory.dmp
memory/4744-63-0x0000000000400000-0x0000000000421000-memory.dmp
memory/4744-66-0x0000000050000000-0x0000000050116000-memory.dmp
memory/4744-67-0x0000000050120000-0x000000005030D000-memory.dmp