rhadamanthys | cc702f6be6f65fd3e56e73c274a7e3e8ff63d4e18cf47b4525cc1cd9040cdc75

Analysis

max time kernel
193s
max time network
255s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
29-04-2024 04:04

Target

cc702f6be6f65fd3e56e73c274a7e3e8ff63d4e18cf47b4525cc1cd9040cdc75.exe
Size

4.7MB
MD5

7adc2b31432caafba0ed9d52462be282
SHA1

58f3e9434b91bcc5d1592c15699e15eff51c06f4
SHA256

cc702f6be6f65fd3e56e73c274a7e3e8ff63d4e18cf47b4525cc1cd9040cdc75
SHA512

004b9965aeea14dd6b613f5a0b7a0c80c021179814dbc41287a9a0c070ad743d360803e0654614334885193a26a8aee8c001931d4ecd8ab219a806005fd1d244
SSDEEP

98304:CyW64h3r9HmzVv/LxaXSufJX70CtvLnupsdgoj9ghi1RebMIg9Cbk/V+:+7hBcVv16zupsdgojDIg9Cbk/V+

Score

10^/10

Detects DLL dropped by Raspberry Robin. 2 IoCs

Raspberry Robin.

Processes:

resource	yara_rule
behavioral2/memory/2140-8-0x0000000074430000-0x00000000745F2000-memory.dmp	Raspberry_Robin_DLL_MAY_2022
behavioral2/memory/1532-15-0x0000000074430000-0x00000000745F2000-memory.dmp	Raspberry_Robin_DLL_MAY_2022

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

explorer.exe

description pid process target process

PID 2140 created 3188 2140 explorer.exe sihost.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3112 2140 WerFault.exe explorer.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

explorer.exedialer.exe

pid process

2140 explorer.exe
2140 explorer.exe
1532 dialer.exe
1532 dialer.exe
1532 dialer.exe
1532 dialer.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

cc702f6be6f65fd3e56e73c274a7e3e8ff63d4e18cf47b4525cc1cd9040cdc75.exe

pid process

600 cc702f6be6f65fd3e56e73c274a7e3e8ff63d4e18cf47b4525cc1cd9040cdc75.exe

description	pid	process	target process
PID 2140 created 3188	2140	explorer.exe	sihost.exe

pid	pid_target	process	target process
3112	2140	WerFault.exe	explorer.exe

pid	process
600	cc702f6be6f65fd3e56e73c274a7e3e8ff63d4e18cf47b4525cc1cd9040cdc75.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

cc702f6be6f65fd3e56e73c274a7e3e8ff63d4e18cf47b4525cc1cd9040cdc75.exeexplorer.exe

description	pid	process	target process
PID 600 wrote to memory of 2140	600	cc702f6be6f65fd3e56e73c274a7e3e8ff63d4e18cf47b4525cc1cd9040cdc75.exe	explorer.exe
PID 600 wrote to memory of 2140	600	cc702f6be6f65fd3e56e73c274a7e3e8ff63d4e18cf47b4525cc1cd9040cdc75.exe	explorer.exe
PID 600 wrote to memory of 2140	600	cc702f6be6f65fd3e56e73c274a7e3e8ff63d4e18cf47b4525cc1cd9040cdc75.exe	explorer.exe
PID 600 wrote to memory of 2140	600	cc702f6be6f65fd3e56e73c274a7e3e8ff63d4e18cf47b4525cc1cd9040cdc75.exe	explorer.exe
PID 600 wrote to memory of 2140	600	cc702f6be6f65fd3e56e73c274a7e3e8ff63d4e18cf47b4525cc1cd9040cdc75.exe	explorer.exe
PID 2140 wrote to memory of 1532	2140	explorer.exe	dialer.exe
PID 2140 wrote to memory of 1532	2140	explorer.exe	dialer.exe
PID 2140 wrote to memory of 1532	2140	explorer.exe	dialer.exe
PID 2140 wrote to memory of 1532	2140	explorer.exe	dialer.exe
PID 2140 wrote to memory of 1532	2140	explorer.exe	dialer.exe

C:\Windows\SysWOW64\dialer.exe
"C:\Windows\system32\dialer.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 728
3⤵
- Program crash
PID:3112

memory/600-0-0x0000000001050000-0x0000000001503000-memory.dmp

Filesize
4.7MB

Download
memory/1532-9-0x0000000000B70000-0x0000000000B79000-memory.dmp

Filesize
36KB

Download
memory/1532-17-0x00007FFA478C0000-0x00007FFA47A9B000-memory.dmp

Filesize
1.9MB

Download
memory/1532-12-0x0000000000650000-0x0000000000A50000-memory.dmp

Filesize
4.0MB

Download
memory/1532-15-0x0000000074430000-0x00000000745F2000-memory.dmp

Filesize
1.8MB

Download
memory/1532-16-0x00007FFA478C0000-0x00007FFA47A9B000-memory.dmp

Filesize
1.9MB

Download
memory/2140-3-0x0000000006020000-0x0000000006420000-memory.dmp

Filesize
4.0MB

Download
memory/2140-8-0x0000000074430000-0x00000000745F2000-memory.dmp

Filesize
1.8MB

Download
memory/2140-11-0x0000000006020000-0x0000000006420000-memory.dmp

Filesize
4.0MB

Download
memory/2140-6-0x00007FFA478C0000-0x00007FFA47A9B000-memory.dmp

Filesize
1.9MB

Download
memory/2140-4-0x0000000006020000-0x0000000006420000-memory.dmp

Filesize
4.0MB

Download
memory/2140-2-0x0000000004E40000-0x0000000004EAD000-memory.dmp

Filesize
436KB

Download
memory/2140-5-0x0000000006020000-0x0000000006420000-memory.dmp

Filesize
4.0MB

Download
memory/2140-1-0x0000000002EE0000-0x0000000002FE1000-memory.dmp

Filesize
1.0MB

Download
memory/2140-18-0x0000000006020000-0x0000000006420000-memory.dmp

Filesize
4.0MB

Download