rhadamanthys | 38c17f2c490cee233f17e6484a1f3c25f3bff8d99ea0d6010f720b848d6a223e

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
14-06-2024 07:38

Target

hoge.exe
Size

621KB
MD5

be87ad5596852c9930270778e9eced54
SHA1

34a1842d2fd4dbcdc27b892d18ad920ac9d03826
SHA256

38c17f2c490cee233f17e6484a1f3c25f3bff8d99ea0d6010f720b848d6a223e
SHA512

a16e49beb95f461ff5d4af63017bdcd9844800e8037d43942e28e0a3dfa71ceb0808e5020f955380902fdb4c9887ed6e092cfce9a9cf24f6be2e3e9586dbef04
SSDEEP

12288:zE50GSHrG6W42JcycysY0V3D9wCV+2nXGwnUP345WRgG3OkGGs/Lwmm:o+GSHrG6W42JcychY0FD9wCVBHw3yeJF

Score

10^/10

Detects DLL dropped by Raspberry Robin. 2 IoCs

Raspberry Robin.

Processes:

resource	yara_rule
behavioral1/memory/1680-5-0x0000000077690000-0x00000000777AF000-memory.dmp	Raspberry_Robin_DLL_MAY_2022
behavioral1/memory/1372-15-0x0000000077690000-0x00000000777AF000-memory.dmp	Raspberry_Robin_DLL_MAY_2022

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

hoge.exe

description pid process target process

PID 1680 created 1260 1680 hoge.exe Explorer.EXE
Deletes itself 1 IoCs

Processes:

dialer.exe

pid process

1372 dialer.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

hoge.exedialer.exe

pid process

1680 hoge.exe
1680 hoge.exe
1372 dialer.exe
1372 dialer.exe

description	pid	process	target process
PID 1680 created 1260	1680	hoge.exe	Explorer.EXE

pid	process
1372	dialer.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

hoge.exe

description	pid	process	target process
PID 1680 wrote to memory of 1372	1680	hoge.exe	dialer.exe
PID 1680 wrote to memory of 1372	1680	hoge.exe	dialer.exe
PID 1680 wrote to memory of 1372	1680	hoge.exe	dialer.exe
PID 1680 wrote to memory of 1372	1680	hoge.exe	dialer.exe
PID 1680 wrote to memory of 1372	1680	hoge.exe	dialer.exe

memory/1372-17-0x00000000778B0000-0x0000000077A59000-memory.dmp

Filesize
1.7MB

Download
memory/1372-12-0x0000000001B50000-0x0000000001F50000-memory.dmp

Filesize
4.0MB

Download
memory/1372-18-0x00000000778B0000-0x0000000077A59000-memory.dmp

Filesize
1.7MB

Download
memory/1372-13-0x00000000778B0000-0x0000000077A59000-memory.dmp

Filesize
1.7MB

Download
memory/1372-9-0x0000000000060000-0x0000000000069000-memory.dmp

Filesize
36KB

Download
memory/1372-15-0x0000000077690000-0x00000000777AF000-memory.dmp

Filesize
1.1MB

Download
memory/1372-16-0x000007FEFD800000-0x000007FEFD86C000-memory.dmp

Filesize
432KB

Download
memory/1680-7-0x0000000002DE0000-0x00000000031E0000-memory.dmp

Filesize
4.0MB

Download
memory/1680-6-0x000007FEFD800000-0x000007FEFD86C000-memory.dmp

Filesize
432KB

Download
memory/1680-10-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/1680-4-0x00000000778B0000-0x0000000077A59000-memory.dmp

Filesize
1.7MB

Download
memory/1680-1-0x0000000002DE0000-0x00000000031E0000-memory.dmp

Filesize
4.0MB

Download
memory/1680-0-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/1680-8-0x00000000778B1000-0x00000000779B2000-memory.dmp

Filesize
1.0MB

Download
memory/1680-5-0x0000000077690000-0x00000000777AF000-memory.dmp

Filesize
1.1MB

Download
memory/1680-3-0x0000000002DE0000-0x00000000031E0000-memory.dmp

Filesize
4.0MB

Download