Analysis
-
max time kernel
131s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
21/12/2022, 12:03
General
-
Target
42e0c2b53ad77355e1a8a7c9d3cab5e4a77bff5250ae4736e23e0801813b2bda.exe
-
Size
300KB
-
MD5
bee69d74c58afca034c6891aeec34925
-
SHA1
4c71bbd11ad13ec59715adfc5d9ccd0cdbd9d800
-
SHA256
42e0c2b53ad77355e1a8a7c9d3cab5e4a77bff5250ae4736e23e0801813b2bda
-
SHA512
7efffca1abd1c9a0c11f1a9e903fa490c716d9e6a1884640ec5876ced2407f144a9b2bfbd471212fcd45f2abbf9656855212ff76f59e0e2e1e87d7d0ced9f7d8
-
SSDEEP
6144:6R5LyW6dIVTPNXtYAsl4/kn4pBWW85cAu65eRu4:Q5mWzxtslqDNFV8
Score
10/10
Malware Config
Signatures
-
Detect rhadamanthys stealer shellcode 1 IoCs
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
-
Program crash 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\42e0c2b53ad77355e1a8a7c9d3cab5e4a77bff5250ae4736e23e0801813b2bda.exe"C:\Users\Admin\AppData\Local\Temp\42e0c2b53ad77355e1a8a7c9d3cab5e4a77bff5250ae4736e23e0801813b2bda.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 6722⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 4644 -ip 46441⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136KB
-
Filesize
156KB
-
Filesize
464KB
-
Filesize
116KB
-
Filesize
136KB
-
Filesize
464KB