rhadamanthys | 7964324cdc7d02655961d98af71329c2e057164d48cba18f97be29842e788a67

Analysis

max time kernel
195s
max time network
300s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
29/04/2024, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7964324cdc7d02655961d98af71329c2e057164d48cba18f97be29842e788a67.exe
Size 4.2MB
Sample240429-e2hg7aab75
SHA256 7964324cdc7d02655961d98af71329c2e057164d48cba18f97be29842e788a67
MD5 4f7fe8a5ccc4bce87b41a5be710d0f87
SHA1 a57df72a0592f38068668f1bb8b3d4733b9bad52
SHA512 f401706a6ece3dad06fd036ecd8ca88309114a5bd6a72338f6026934017493c726978baf536befc03f2e538ce315b91025b11ba8bc1d279b52315cda7b257b8a
SSDEEP 98304:s5t0eFALuMwGaLnQ5lLmmasYas4OiZrq1DfPHNADtV6v+Lq:soXmGasYas4O7NADtV6v+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Detects DLL dropped by Raspberry Robin. 2 IoCs

Raspberry Robin.

resource	yara_rule
behavioral2/memory/3604-10-0x00000000744A0000-0x0000000074662000-memory.dmp	Raspberry_Robin_DLL_MAY_2022
behavioral2/memory/4800-16-0x00000000744A0000-0x0000000074662000-memory.dmp	Raspberry_Robin_DLL_MAY_2022

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3604 created 2516	3604	explorer.exe	43

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2388	3604	WerFault.exe	73

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3604	explorer.exe
3604	explorer.exe
4800	dialer.exe
4800	dialer.exe
4800	dialer.exe
4800	dialer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1616	7964324cdc7d02655961d98af71329c2e057164d48cba18f97be29842e788a67.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 3604	1616	7964324cdc7d02655961d98af71329c2e057164d48cba18f97be29842e788a67.exe	73
PID 1616 wrote to memory of 3604	1616	7964324cdc7d02655961d98af71329c2e057164d48cba18f97be29842e788a67.exe	73
PID 1616 wrote to memory of 3604	1616	7964324cdc7d02655961d98af71329c2e057164d48cba18f97be29842e788a67.exe	73
PID 1616 wrote to memory of 3604	1616	7964324cdc7d02655961d98af71329c2e057164d48cba18f97be29842e788a67.exe	73
PID 1616 wrote to memory of 3604	1616	7964324cdc7d02655961d98af71329c2e057164d48cba18f97be29842e788a67.exe	73
PID 3604 wrote to memory of 4800	3604	explorer.exe	74
PID 3604 wrote to memory of 4800	3604	explorer.exe	74
PID 3604 wrote to memory of 4800	3604	explorer.exe	74
PID 3604 wrote to memory of 4800	3604	explorer.exe	74
PID 3604 wrote to memory of 4800	3604	explorer.exe	74

c:\windows\system32\sihost.exe
sihost.exe
1⤵
PID:2516
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4800

C:\Users\Admin\AppData\Local\Temp\7964324cdc7d02655961d98af71329c2e057164d48cba18f97be29842e788a67.exe
"C:\Users\Admin\AppData\Local\Temp\7964324cdc7d02655961d98af71329c2e057164d48cba18f97be29842e788a67.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3604
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3604 -s 720
    3⤵
    - Program crash
    PID:2388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1616-0-0x0000000000380000-0x00000000007BE000-memory.dmp

Download

memory/3604-8-0x00007FFC1EA40000-0x00007FFC1EC1B000-memory.dmp

Download

memory/3604-2-0x00000000034E0000-0x000000000354D000-memory.dmp

Download

memory/3604-3-0x0000000005E30000-0x0000000006230000-memory.dmp

Download

memory/3604-5-0x0000000005E30000-0x0000000006230000-memory.dmp

Download

memory/3604-4-0x0000000005E30000-0x0000000006230000-memory.dmp

Download

memory/3604-1-0x0000000000A90000-0x0000000000B20000-memory.dmp

Download

memory/3604-7-0x0000000005E30000-0x0000000006230000-memory.dmp

Download

memory/3604-10-0x00000000744A0000-0x0000000074662000-memory.dmp

Download

memory/3604-17-0x0000000005E30000-0x0000000006230000-memory.dmp

Download

memory/4800-11-0x0000000002B10000-0x0000000002B19000-memory.dmp

Download

memory/4800-13-0x00000000048E0000-0x0000000004CE0000-memory.dmp

Download

memory/4800-16-0x00000000744A0000-0x0000000074662000-memory.dmp

Download

memory/4800-14-0x00007FFC1EA40000-0x00007FFC1EC1B000-memory.dmp

Download