Analysis
-
max time kernel
127s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
21/12/2022, 07:31
General
-
Target
e4572b86c169b65b0e3d046efd83c91f96dbb7baddad8a32f842d4ad40de5460.exe
-
Size
292KB
-
MD5
20735b778ed03f5c0674578cecb26f54
-
SHA1
9d6be2af90756e7c78e75fb373fadfbf23a80e8a
-
SHA256
e4572b86c169b65b0e3d046efd83c91f96dbb7baddad8a32f842d4ad40de5460
-
SHA512
458a050eb4c4e14c4954ccc505eb76269516c13a1029d45d932cdfb3a6651fe0aa85fb67a24052ef2aaad6a4137a86d5ebbca3732e3f493017be0c9bd484f051
-
SSDEEP
6144:g1LAjR0NOIw+K9bcuCGItlIT3SenRWzgxrRhCa:g1ctL7bcJrDIOeniux
Score
10/10
Malware Config
Signatures
-
Detect rhadamanthys stealer shellcode 2 IoCs
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
-
Program crash 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e4572b86c169b65b0e3d046efd83c91f96dbb7baddad8a32f842d4ad40de5460.exe"C:\Users\Admin\AppData\Local\Temp\e4572b86c169b65b0e3d046efd83c91f96dbb7baddad8a32f842d4ad40de5460.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4888 -s 6562⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4888 -ip 48881⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136KB
-
Filesize
156KB
-
Filesize
460KB
-
Filesize
116KB
-
Filesize
136KB
-
Filesize
460KB
-
Filesize
116KB