rhadamanthys | 332ccefda61a62e3512e8ddf7379a1e2401f8ae1aca679e441849325288f5adb

Analysis

max time kernel
195s
max time network
259s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
08/05/2024, 22:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
332ccefda61a62e3512e8ddf7379a1e2401f8ae1aca679e441849325288f5adb.exe
Size 3.9MB
Sample240508-2q8assbf9z
SHA256 332ccefda61a62e3512e8ddf7379a1e2401f8ae1aca679e441849325288f5adb
MD5 570cf08e3406eaf5f4344c94d1a758b6
SHA1 ad43fce24a8dd9b9197ee18b549f390490ffae1e
SHA512 f1762bacaabbea713713c8ed3fd05654ad979726a1fbdd1a7b0d6c6c9f14eee636df2b8ee22938d2abb10674bcb2b99cc6ac3800effdfa28a8e3299cd722bb3a
SSDEEP 98304:+psDSR6/eL7NoH4+98UCObfyXAMlc9W/oxSYdcGRHbG9dkv:+pso6/EW4NUNjucE/oxSYr7Gkv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Detects DLL dropped by Raspberry Robin. 2 IoCs

Raspberry Robin.

resource	yara_rule
behavioral2/memory/4468-47-0x0000000075530000-0x00000000756F2000-memory.dmp	Raspberry_Robin_DLL_MAY_2022
behavioral2/memory/2632-55-0x0000000075530000-0x00000000756F2000-memory.dmp	Raspberry_Robin_DLL_MAY_2022

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4468 created 2700	4468	explorer.exe	50

Executes dropped EXE 2 IoCs

pid	Process
4968	iScrPaint.exe
1468	iScrPaint.exe

Loads dropped DLL 2 IoCs

pid	Process
4968	iScrPaint.exe
1468	iScrPaint.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1468 set thread context of 5104	1468	iScrPaint.exe	75

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4968	iScrPaint.exe
1468	iScrPaint.exe
1468	iScrPaint.exe
5104	cmd.exe
5104	cmd.exe
4468	explorer.exe
4468	explorer.exe
2632	dialer.exe
2632	dialer.exe
2632	dialer.exe
2632	dialer.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1468	iScrPaint.exe
5104	cmd.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 4968	5088	332ccefda61a62e3512e8ddf7379a1e2401f8ae1aca679e441849325288f5adb.exe	73
PID 5088 wrote to memory of 4968	5088	332ccefda61a62e3512e8ddf7379a1e2401f8ae1aca679e441849325288f5adb.exe	73
PID 5088 wrote to memory of 4968	5088	332ccefda61a62e3512e8ddf7379a1e2401f8ae1aca679e441849325288f5adb.exe	73
PID 4968 wrote to memory of 1468	4968	iScrPaint.exe	74
PID 4968 wrote to memory of 1468	4968	iScrPaint.exe	74
PID 4968 wrote to memory of 1468	4968	iScrPaint.exe	74
PID 1468 wrote to memory of 5104	1468	iScrPaint.exe	75
PID 1468 wrote to memory of 5104	1468	iScrPaint.exe	75
PID 1468 wrote to memory of 5104	1468	iScrPaint.exe	75
PID 1468 wrote to memory of 5104	1468	iScrPaint.exe	75
PID 5104 wrote to memory of 4468	5104	cmd.exe	77
PID 5104 wrote to memory of 4468	5104	cmd.exe	77
PID 5104 wrote to memory of 4468	5104	cmd.exe	77
PID 5104 wrote to memory of 4468	5104	cmd.exe	77
PID 4468 wrote to memory of 2632	4468	explorer.exe	78
PID 4468 wrote to memory of 2632	4468	explorer.exe	78
PID 4468 wrote to memory of 2632	4468	explorer.exe	78
PID 4468 wrote to memory of 2632	4468	explorer.exe	78
PID 4468 wrote to memory of 2632	4468	explorer.exe	78

c:\windows\system32\sihost.exe
sihost.exe
1⤵
PID:2700
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2632

C:\Users\Admin\AppData\Local\Temp\332ccefda61a62e3512e8ddf7379a1e2401f8ae1aca679e441849325288f5adb.exe
"C:\Users\Admin\AppData\Local\Temp\332ccefda61a62e3512e8ddf7379a1e2401f8ae1aca679e441849325288f5adb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Users\Admin\AppData\Local\Temp\iScrPaint.exe
  "C:\Users\Admin\AppData\Local\Temp\iScrPaint.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4968
- - C:\Users\Admin\AppData\Roaming\Pluginoracle\iScrPaint.exe
    C:\Users\Admin\AppData\Roaming\Pluginoracle\iScrPaint.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1468
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\SysWOW64\cmd.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:5104
    - - C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WebUI.dll

Path C:\Users\Admin\AppData\Local\Temp\WebUI.dll
Size 7.6MB
SHA256 1edec66249e86c1eefefc687421440d93319956e06183e71fa3f579d202c1a6b
MD5 aceb861579606df951bc81e63e157fea
SHA1 6c77c6066471ff73c73d24dc8cc3d67d818316a9
SHA512 16d5b25acf3f2cd679ce9530527cafaec9e9022dd91fe2359340905d5034c921a5999a4d236371d0589978b3803788c09b07fd76a1c41d4ea200ec5518a8dd13
SSDEEP 196608:f39zxBBmYeZ1YU8Blc/OwDlcXus9n0rJsv6tWKFdu9CZq:lzx6YeZ1YTBlc/OwDliEJsv6tWKFdu9n
MD5 SHA1 SHA512 SSDEEP

Submit Download

c9386ad1

Path C:\Users\Admin\AppData\Local\Temp\c9386ad1
Size 1.0MB
SHA256 46248260a95eb47c375bab62d99c52ecd9ba7e293cd440db03cc889a7e16a93f
MD5 8924dae1d6f42d5e725119b1266492fb
SHA1 4bda7a969a96c8847d5021bd6148441e5d54aecd
SHA512 845e879e98329184f3a48bd8d97fd0140b26ba7e9deeabe900e71e22407b53f8ec3ea43261471a9b165493d1aa7fbbd40d7b470ee6c97097af24ab7771163414
SSDEEP 24576:5AE9jP1fEAzLgrstLNqzGKuxZ4Yu1OimyYYZQ+L:t91EeLZtL4zGKuwY7i3YYma
MD5 SHA1 SHA512 SSDEEP

Submit Download

glut.zip

Path C:\Users\Admin\AppData\Local\Temp\glut.zip
Size 51KB
SHA256 841349ef166055e0bb5629511b65c3e612738a1c193cc0c04070f6d77573dc61
MD5 ddbd5a320b3c84da99a81dad851bdbef
SHA1 e3504f49fe4c019594aa3c9c0013a0d343659a0c
SHA512 2e34b7b454d33cb70a9a5468ec4c2ca9964de6cdd681d985e192102e530d9f189f173b8f29c45484b26e3c0f467554ed80d7e99dddc51c6441c6cfea8063eb92
SSDEEP 1536:RVHkJ5yskPCpRSRHo3EfE8e/RiiB9FI8ym:LkfyrRHoUfKdBLI8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

iScrPaint.exe

Path C:\Users\Admin\AppData\Local\Temp\iScrPaint.exe
Size 1.8MB
SHA256 46afbf1cbd2e1b5e108c133d4079faddc7347231b0c48566fd967a3070745e7f
MD5 098ac4621ee0e855e0710710736c2955
SHA1 ce7b88657c3449d5d05591314aaa43bd3e32bdaa
SHA512 3042785b81bd18b641f0a2b5d8aec8ef86f9bf1269421fb96d1db35a913e744eaff16d9da7a02c8001435d59befb9f26bc0bbfa6e794811abf4282ed68b185fe
SSDEEP 49152:GpjwrP6yVgBd39sUUzFti4aTotmIT3SxLmNKbx:GpjwrP6yKTOUmi4aTo1NK9
MD5 SHA1 SHA512 SSDEEP

Submit Download

squandermania.mov

Path C:\Users\Admin\AppData\Local\Temp\squandermania.mov
Size 826KB
SHA256 e18d4bda0b82812bf7d14e06f486ac1650d8dc47a29093370c435cf1fed8ea1b
MD5 d384e178093a9f7b88f0c5fa68355383
SHA1 90e0c5026eb6ed3ea340198002185121151b7632
SHA512 c817d0ac7c7c30c44285b4b9f113846a19315a1889773ed5aab213f6ab99f878efda786cd3b8c3324a7230d14137ef3ba71d9e0491e854c7dae3458b9f514942
SSDEEP 12288:PcwSTjKmQieKvJkPU5uC3oMqL8mBQ0Hxqz4W1cQU2IyIgw3n+ZBjtKNdNqyjz6Oq:PSYixvuPUJic0UReQU2IQ08tQ32kEIa
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1468-32-0x0000000073130000-0x00000000732AB000-memory.dmp

Download

memory/1468-34-0x0000000000400000-0x000000000061B000-memory.dmp

Download

memory/1468-30-0x0000000073130000-0x00000000732AB000-memory.dmp

Download

memory/1468-31-0x00007FFF560E0000-0x00007FFF562BB000-memory.dmp

Download

memory/2632-55-0x0000000075530000-0x00000000756F2000-memory.dmp

Download

memory/2632-53-0x00007FFF560E0000-0x00007FFF562BB000-memory.dmp

Download

memory/2632-48-0x0000000000130000-0x0000000000139000-memory.dmp

Download

memory/2632-52-0x0000000003FB0000-0x00000000043B0000-memory.dmp

Download

memory/4468-50-0x00000000008F0000-0x000000000095E000-memory.dmp

Download

memory/4468-39-0x00000000008F0000-0x000000000095E000-memory.dmp

Download

memory/4468-40-0x00007FFF560E0000-0x00007FFF562BB000-memory.dmp

Download

memory/4468-41-0x00000000008F0000-0x000000000095E000-memory.dmp

Download

memory/4468-43-0x0000000006330000-0x0000000006730000-memory.dmp

Download

memory/4468-44-0x0000000006330000-0x0000000006730000-memory.dmp

Download

memory/4468-47-0x0000000075530000-0x00000000756F2000-memory.dmp

Download

memory/4968-24-0x0000000000400000-0x000000000061B000-memory.dmp

Download

memory/4968-17-0x00007FFF560E0000-0x00007FFF562BB000-memory.dmp

Download

memory/4968-16-0x0000000072340000-0x00000000724BB000-memory.dmp

Download

memory/5104-37-0x0000000073130000-0x00000000732AB000-memory.dmp

Download

memory/5104-36-0x00007FFF560E0000-0x00007FFF562BB000-memory.dmp

Download