rhadamanthys | a857af8b33c62e7897af86264a2c8959545cacf74329b76730e2a84b35ef20a4

Analysis

max time kernel
195s
max time network
299s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
29/04/2024, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a857af8b33c62e7897af86264a2c8959545cacf74329b76730e2a84b35ef20a4.exe
Size 8.0MB
Sample240429-e7n7xsad64
SHA256 a857af8b33c62e7897af86264a2c8959545cacf74329b76730e2a84b35ef20a4
MD5 8fe5acf6de7c1aa68a9017f1730b1349
SHA1 0eb712b99346a67a5dbf8ed7bae1e63e0adfb9cb
SHA512 3de24762402b0f18fb1a0ccfac6f182524e6426e98627a31a327f387e70425bf0d91b2ae761a48526828b85099eda68f99abd9a0970a5c7c7653d502641394b8
SSDEEP 24576:xvXFCQrey7M87yVFOQ60yTczf+kcgMFZQUYn5067InlWK/iXv8:xvXFC58eV8Q6qivHYntMh/i0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Detects DLL dropped by Raspberry Robin. 2 IoCs

Raspberry Robin.

resource	yara_rule
behavioral2/memory/1108-42-0x0000000075360000-0x0000000075522000-memory.dmp	Raspberry_Robin_DLL_MAY_2022
behavioral2/memory/2548-48-0x0000000075360000-0x0000000075522000-memory.dmp	Raspberry_Robin_DLL_MAY_2022

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1108 created 2580	1108	Although.pif	44

Executes dropped EXE 1 IoCs

pid	Process
1108	Although.pif

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4704	1108	WerFault.exe	84

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
4744	tasklist.exe
4492	tasklist.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2188	PING.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1108	Although.pif
1108	Although.pif
1108	Although.pif
1108	Although.pif
1108	Although.pif
1108	Although.pif
1108	Although.pif
1108	Although.pif
2548	dialer.exe
2548	dialer.exe
2548	dialer.exe
2548	dialer.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4744	tasklist.exe
Token: SeDebugPrivilege	4492	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1108	Although.pif
1108	Although.pif
1108	Although.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1108	Although.pif
1108	Although.pif
1108	Although.pif

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 164 wrote to memory of 4140	164	a857af8b33c62e7897af86264a2c8959545cacf74329b76730e2a84b35ef20a4.exe	74
PID 164 wrote to memory of 4140	164	a857af8b33c62e7897af86264a2c8959545cacf74329b76730e2a84b35ef20a4.exe	74
PID 164 wrote to memory of 4140	164	a857af8b33c62e7897af86264a2c8959545cacf74329b76730e2a84b35ef20a4.exe	74
PID 4140 wrote to memory of 4744	4140	cmd.exe	76
PID 4140 wrote to memory of 4744	4140	cmd.exe	76
PID 4140 wrote to memory of 4744	4140	cmd.exe	76
PID 4140 wrote to memory of 3848	4140	cmd.exe	77
PID 4140 wrote to memory of 3848	4140	cmd.exe	77
PID 4140 wrote to memory of 3848	4140	cmd.exe	77
PID 4140 wrote to memory of 4492	4140	cmd.exe	79
PID 4140 wrote to memory of 4492	4140	cmd.exe	79
PID 4140 wrote to memory of 4492	4140	cmd.exe	79
PID 4140 wrote to memory of 1628	4140	cmd.exe	80
PID 4140 wrote to memory of 1628	4140	cmd.exe	80
PID 4140 wrote to memory of 1628	4140	cmd.exe	80
PID 4140 wrote to memory of 3208	4140	cmd.exe	81
PID 4140 wrote to memory of 3208	4140	cmd.exe	81
PID 4140 wrote to memory of 3208	4140	cmd.exe	81
PID 4140 wrote to memory of 5116	4140	cmd.exe	82
PID 4140 wrote to memory of 5116	4140	cmd.exe	82
PID 4140 wrote to memory of 5116	4140	cmd.exe	82
PID 4140 wrote to memory of 4436	4140	cmd.exe	83
PID 4140 wrote to memory of 4436	4140	cmd.exe	83
PID 4140 wrote to memory of 4436	4140	cmd.exe	83
PID 4140 wrote to memory of 1108	4140	cmd.exe	84
PID 4140 wrote to memory of 1108	4140	cmd.exe	84
PID 4140 wrote to memory of 1108	4140	cmd.exe	84
PID 4140 wrote to memory of 2188	4140	cmd.exe	85
PID 4140 wrote to memory of 2188	4140	cmd.exe	85
PID 4140 wrote to memory of 2188	4140	cmd.exe	85
PID 1108 wrote to memory of 2548	1108	Although.pif	86
PID 1108 wrote to memory of 2548	1108	Although.pif	86
PID 1108 wrote to memory of 2548	1108	Although.pif	86
PID 1108 wrote to memory of 2548	1108	Although.pif	86
PID 1108 wrote to memory of 2548	1108	Although.pif	86

c:\windows\system32\sihost.exe
sihost.exe
1⤵
PID:2580
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2548

C:\Users\Admin\AppData\Local\Temp\a857af8b33c62e7897af86264a2c8959545cacf74329b76730e2a84b35ef20a4.exe
"C:\Users\Admin\AppData\Local\Temp\a857af8b33c62e7897af86264a2c8959545cacf74329b76730e2a84b35ef20a4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:164
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k move Naturals Naturals.bat & Naturals.bat & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4140
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4744
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
    3⤵
    PID:3848
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4492
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "wrsa.exe opssvc.exe"
    3⤵
    PID:1628
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 15747
    3⤵
    PID:3208
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b Static + Accommodate + Chi + Locally + Sentence + Occurring 15747\Although.pif
    3⤵
    PID:5116
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b Jd 15747\z
    3⤵
    PID:4436
- - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\15747\Although.pif
    15747\Although.pif 15747\z
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1108
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 828
      4⤵
      Program crash
      PID:4704
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 5 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Although.pif

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\15747\Although.pif
Size 924KB
SHA256 f58d3a4b2f3f7f10815c24586fae91964eeed830369e7e0701b43895b0cefbd3
MD5 848164d084384c49937f99d5b894253e
SHA1 3055ef803eeec4f175ebf120f94125717ee12444
SHA512 aabe1cf076f48f32542f49a92e4ca9f054b31d5a9949119991b897b9489fe775d8009896408ba49ac43ec431c87c0d385daead9dbbde7ef6309b0c97bbaf852a
SSDEEP 24576:LOo8pEnK4mrqlEZuVZ2HOI+X0l1lMZyYFaeBmyF:LF8p4KpqlEZeXI+X0TVcae3F
MD5 SHA1 SHA512 SSDEEP

Submit Download

Accommodate

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Accommodate
Size 141KB
SHA256 8a7ce341841d58b3c0becb37c48b269281b9b375db05f710a9a6f12af882630a
MD5 3be8b1f93b550e507fc3223b9719e0c0
SHA1 3de0f461d26be98e6a9045de813a4f2e6dc39813
SHA512 cd4d8acdc143a52631bc1bbe23aa8989949814fcd4d13decfa3252c52fd223094047afe58701cbc0567b52a7e11c07dd2b4e4068fefeca7c9fe9009635600383
SSDEEP 3072:wF7etHufKE5Kmqd1UhlqRWO/9EAehuqCkrwzW3Nzl8F5hPLaLW4:wFygyE4mqd12lqlEAehuqN8zwNzlmhPu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Chi

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Chi
Size 176KB
SHA256 4d4d8a8b24cdaaa3e9bd617f894c6734719980b32c17efd92244fa5a10f66d27
MD5 2c415cb488dc4166944a7e19a31b428d
SHA1 7352fc017ba7302b54b47453cac73363b1285087
SHA512 3c0075a8f641e4dd09231234adca5893977368bad2590b7d000151f1eebf7a078692f1b5d01d321a65e8e8bdda1fe57f23a212efecbebdaed8e3b93448d0e049
SSDEEP 3072:dsRIO7vHZnBfzHl8Dz5YaZYvlfA6Gfza6iyY5tVGvH7fsUQwHJJX4xF5jtHh:Wb5nZ2tZ6lfA6Gfm608DsvqJX4xNh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Jd
Size 953KB
SHA256 0ae7d75f8dc0ff9573dfc3158f0b26d299d40a3fa8b5503d617822741de5859a
MD5 c5babea4fdc32603de613dcee0cf4468
SHA1 02de25754f41e043075d85fdfbfbf9cb08c9dec9
SHA512 8d19fb32cb1a6f9bd4367dee2fa7021348e38112d5c432d3b610009b1eee9f06fda7e5cd06be757c237b2e3325d907eae1318cd2a87935b5c8d22200b7b51bc4
SSDEEP 12288:l+1NcMHDmeuvrlv7lO860w3cIelicPfthJ3liAxXVHIg+B7JSj2pGh:l+1NcMHqeuvrW/0PIelNPvJB92gh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locally

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Locally
Size 179KB
SHA256 d1ec970a9dd3cf7e92e14bae1fc950ece51bffdcdcf06ece6c83ea1118045d65
MD5 9b0d81dbe4a6835e4e8dad7d2b460c8b
SHA1 478eecd3e50fa7f62f8dddd0607c215435a2ff5f
SHA512 58a6615456b6003e0d7403c47507e15e4bfcf6fd8aae992c012df3633ace024cbb0714c1c12e21dd23351da0ea9cf9685e860b39d0df52bbc803e93f89a21de0
SSDEEP 3072:q5B+LNBPcAvPTjFq9iOIXyTw0ltj0EowPOGU6WS2uLhxjRYH/fA9vtqmcCVs5A3X:6B+xHFq9O0lHPOGUWLhxjRYmFqZvEAOt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Naturals

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Naturals
Size 12KB
SHA256 5396ffc0e310525636079b2e0d08f5915681be4e6dc42c5311bcdc1abbc60113
MD5 e86832f29bc603abfd01a84e2480b7f7
SHA1 6556d462a7030cd8bb56ab3ad25fcf33154a26df
SHA512 fd969576327649f66b247d4ca9439070bf394b76967faebd39b6aa5a8fc703e3c5840daf41e0280fdf3334f34395b5f579e66a7417785df5e96c02b3cf8f19fb
SSDEEP 384:98NwZF8nTyr+KCthS5xwixV+hJS5K2Wyh/Z3HKn:268yY63o
MD5 SHA1 SHA512 SSDEEP

Submit Download

Occurring

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Occurring
Size 68KB
SHA256 0ac9b8c94a1d8d0af333937fe6541ec4839a1f2f4063952628fab8c290d69be5
MD5 e5a136ec2c9723315c8a7bd89b2d53dc
SHA1 7ca76b48a22e57c161c6befe8b03a031fee34ef9
SHA512 3160e56e37205991774f212eaf69cf01572c66e553cf6a4677f8c302c205631dee3b45b9cc426df0061449b7b9b9e7bc9747b55187750b079a5fd0ee4ca5436e
SSDEEP 1536:cyu0uZo2+9BkxXiblenlJJyIE2UWb/hoQZ2OE3:cy4ZNogXJ3i2Umb2Oq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sentence

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Sentence
Size 176KB
SHA256 57d4f146242f8b5a2f32cf818182d2bad524decaf163292b86bad81d19280088
MD5 e5c5f3633b33936418e7de9d48e4dda9
SHA1 dfe0100e4c471afa4aba8653193f396ab3423bcb
SHA512 c4d6c1ed9157f6707d06882ed4edc37d0f44db757d815faf5317db23732248813557fbffe7d31e0681de0d9d16c74b58a9a5cea9536d03ffa8eca3581e757bfb
SSDEEP 1536:/klMBNIi9u5aAwubPdMaj6iTcohiPfKj+wsxjgarB3RZg3EYrDF:/vBNbIaAtbPf6jKj+wsxjgarB3RZgDF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Static

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Static
Size 184KB
SHA256 bb74ba920a49685ff1b366c38f59a41c8b5a9749062febd08a4927cf08c68b7a
MD5 1538ce51b0a02ec4e04c8e3cb53020cb
SHA1 4e7f8e619f3ff05b330b386cbe44a64c319a347a
SHA512 9461542339f269e5da6d138cb5a044fd98505a3579e6898830d5eae6aff3c894112c2731b766fdd3b2fb484ab4def2dfc4f051b659671d3e10a33c24998fc3fa
SSDEEP 3072:pPpU08BjlWTPJth26X7Sn4UfpLUNN9t68cCWlrss4M5iRq3U0Pe3vHU4S4/33S4:LQBk7JjX74cN0lrztgwU0Wyw35
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1108-32-0x0000000000110000-0x000000000017D000-memory.dmp

Download

memory/1108-39-0x0000000000190000-0x0000000000590000-memory.dmp

Download

memory/1108-33-0x0000000000110000-0x000000000017D000-memory.dmp

Download

memory/1108-37-0x0000000000110000-0x000000000017D000-memory.dmp

Download

memory/1108-35-0x0000000000110000-0x000000000017D000-memory.dmp

Download

memory/1108-36-0x0000000000110000-0x000000000017D000-memory.dmp

Download

memory/1108-38-0x0000000000190000-0x0000000000590000-memory.dmp

Download

memory/1108-31-0x0000000000110000-0x000000000017D000-memory.dmp

Download

memory/1108-40-0x00007FF8D66D0000-0x00007FF8D68AB000-memory.dmp

Download

memory/1108-42-0x0000000075360000-0x0000000075522000-memory.dmp

Download

memory/2548-43-0x00000000030A0000-0x00000000030A9000-memory.dmp

Download

memory/2548-48-0x0000000075360000-0x0000000075522000-memory.dmp

Download

memory/2548-46-0x00007FF8D66D0000-0x00007FF8D68AB000-memory.dmp

Download

memory/2548-45-0x0000000004CA0000-0x00000000050A0000-memory.dmp

Download