Overview
overview
10Static
static
3bootstrap/...er.exe
windows7-x64
10bootstrap/...er.exe
windows10-2004-x64
10bootstrap/...64.dll
windows7-x64
1bootstrap/...64.dll
windows10-2004-x64
1bootstrap/...10.dll
windows7-x64
1bootstrap/...10.dll
windows10-2004-x64
8bootstrap/...11.dll
windows7-x64
1bootstrap/...11.dll
windows10-2004-x64
8bootstrap/...64.dll
windows7-x64
10bootstrap/...64.dll
windows10-2004-x64
10Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09-02-2025 21:35
Static task
static1
Behavioral task
behavioral1
Sample
bootstrap/bootstrapper.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral2
Sample
bootstrap/bootstrapper.exe
Resource
win10v2004-20250207-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
bootstrap/tier0_s64.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral4
Sample
bootstrap/tier0_s64.dll
Resource
win10v2004-20250129-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
bootstrap/vcruntime210.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral6
Sample
bootstrap/vcruntime210.dll
Resource
win10v2004-20250207-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
bootstrap/vcruntime211.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
bootstrap/vcruntime211.dll
Resource
win10v2004-20250207-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
bootstrap/vstdlib_s64.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
bootstrap/vstdlib_s64.dll
Resource
win10v2004-20250207-en
windows10-2004-x64
General
-
Target
bootstrap/vstdlib_s64.dll
-
Size
3.2MB
-
MD5
2af311d5fdb8df6250ee6681edea15bb
-
SHA1
68cea60147b29ae47fd18d97698e9bcf6f713c36
-
SHA256
c1cd2c6fd3c17d9e67ec45436064b911f2dc81fb2c32ece5ef9878b8af35dda5
-
SHA512
b20a08a1690dac97c456acc1cd8bfe01b3310c490abee3063a5189f45e28e0ac116f313524b9ca5003b84e2cc07c090e28a9fa9240fa3e4f03d9cf1fe00240de
-
SSDEEP
49152:wSN5WWMbW0m7Dng+arKHXKS2n4qBJ9X1LaYztS:FV4546S2n4Q9Fh
Malware Config
Signatures
-
Detects Rhadamanthys payload 1 IoCs
resource yara_rule behavioral9/memory/2972-3-0x0000000000400000-0x0000000000481000-memory.dmp Rhadamanthys_v8 -
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Rhadamanthys family
-
Enumerates VirtualBox registry keys 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo rundll32.exe -
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions rundll32.exe -
Looks for VMWare services registry key. 1 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmtools rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMMEMCTL rundll32.exe -
Uses the VBS compiler for execution 1 TTPs
-
Runs regedit.exe 1 IoCs
pid Process 2756 regedit.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2036 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2036 rundll32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2036 wrote to memory of 2972 2036 rundll32.exe 30 PID 2036 wrote to memory of 2972 2036 rundll32.exe 30 PID 2036 wrote to memory of 2972 2036 rundll32.exe 30 PID 2036 wrote to memory of 2972 2036 rundll32.exe 30 PID 2036 wrote to memory of 2972 2036 rundll32.exe 30 PID 2036 wrote to memory of 2972 2036 rundll32.exe 30 PID 2036 wrote to memory of 3040 2036 rundll32.exe 31 PID 2036 wrote to memory of 3040 2036 rundll32.exe 31 PID 2036 wrote to memory of 3040 2036 rundll32.exe 31 PID 2036 wrote to memory of 3040 2036 rundll32.exe 31 PID 2036 wrote to memory of 3044 2036 rundll32.exe 32 PID 2036 wrote to memory of 3044 2036 rundll32.exe 32 PID 2036 wrote to memory of 3044 2036 rundll32.exe 32 PID 2036 wrote to memory of 3044 2036 rundll32.exe 32 PID 2036 wrote to memory of 2336 2036 rundll32.exe 33 PID 2036 wrote to memory of 2336 2036 rundll32.exe 33 PID 2036 wrote to memory of 2336 2036 rundll32.exe 33 PID 2036 wrote to memory of 2336 2036 rundll32.exe 33 PID 2036 wrote to memory of 2340 2036 rundll32.exe 34 PID 2036 wrote to memory of 2340 2036 rundll32.exe 34 PID 2036 wrote to memory of 2340 2036 rundll32.exe 34 PID 2036 wrote to memory of 2340 2036 rundll32.exe 34 PID 2036 wrote to memory of 2340 2036 rundll32.exe 34 PID 2036 wrote to memory of 2340 2036 rundll32.exe 34 PID 2036 wrote to memory of 2788 2036 rundll32.exe 35 PID 2036 wrote to memory of 2788 2036 rundll32.exe 35 PID 2036 wrote to memory of 2788 2036 rundll32.exe 35 PID 2036 wrote to memory of 2788 2036 rundll32.exe 35 PID 2036 wrote to memory of 2788 2036 rundll32.exe 35 PID 2036 wrote to memory of 2696 2036 rundll32.exe 36 PID 2036 wrote to memory of 2696 2036 rundll32.exe 36 PID 2036 wrote to memory of 2696 2036 rundll32.exe 36 PID 2036 wrote to memory of 2696 2036 rundll32.exe 36 PID 2036 wrote to memory of 2696 2036 rundll32.exe 36 PID 2036 wrote to memory of 2716 2036 rundll32.exe 37 PID 2036 wrote to memory of 2716 2036 rundll32.exe 37 PID 2036 wrote to memory of 2716 2036 rundll32.exe 37 PID 2036 wrote to memory of 2716 2036 rundll32.exe 37 PID 2036 wrote to memory of 2716 2036 rundll32.exe 37 PID 2036 wrote to memory of 2736 2036 rundll32.exe 38 PID 2036 wrote to memory of 2736 2036 rundll32.exe 38 PID 2036 wrote to memory of 2736 2036 rundll32.exe 38 PID 2036 wrote to memory of 2736 2036 rundll32.exe 38 PID 2036 wrote to memory of 2736 2036 rundll32.exe 38 PID 2036 wrote to memory of 2892 2036 rundll32.exe 39 PID 2036 wrote to memory of 2892 2036 rundll32.exe 39 PID 2036 wrote to memory of 2892 2036 rundll32.exe 39 PID 2036 wrote to memory of 2892 2036 rundll32.exe 39 PID 2036 wrote to memory of 2892 2036 rundll32.exe 39 PID 2036 wrote to memory of 2892 2036 rundll32.exe 39 PID 2036 wrote to memory of 2896 2036 rundll32.exe 40 PID 2036 wrote to memory of 2896 2036 rundll32.exe 40 PID 2036 wrote to memory of 2896 2036 rundll32.exe 40 PID 2036 wrote to memory of 2896 2036 rundll32.exe 40 PID 2036 wrote to memory of 2896 2036 rundll32.exe 40 PID 2036 wrote to memory of 2896 2036 rundll32.exe 40 PID 2036 wrote to memory of 2756 2036 rundll32.exe 41 PID 2036 wrote to memory of 2756 2036 rundll32.exe 41 PID 2036 wrote to memory of 2756 2036 rundll32.exe 41 PID 2036 wrote to memory of 2756 2036 rundll32.exe 41 PID 2036 wrote to memory of 2756 2036 rundll32.exe 41 PID 2036 wrote to memory of 2872 2036 rundll32.exe 42 PID 2036 wrote to memory of 2872 2036 rundll32.exe 42 PID 2036 wrote to memory of 2872 2036 rundll32.exe 42
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bootstrap\vstdlib_s64.dll,#11⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare services registry key.
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"2⤵PID:2972
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"2⤵PID:3040
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"2⤵PID:3044
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵PID:2336
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"2⤵PID:2340
-
-
C:\Windows\System32\calc.exe"C:\Windows\System32\calc.exe"2⤵PID:2788
-
-
C:\Windows\System32\svchost.exe"C:\Windows\System32\svchost.exe"2⤵PID:2696
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"2⤵PID:2716
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:2736
-
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe"2⤵PID:2892
-
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"2⤵PID:2896
-
-
C:\Windows\regedit.exe"C:\Windows\regedit.exe"2⤵
- Runs regedit.exe
PID:2756
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵PID:2872
-