rhadamanthys | 938deb1fb95c5990b581fd5b988f8d5a980d0f4a117cc6957012602f0196987d

Analysis

max time kernel
7s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
23-02-2023 08:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7cbf389b3d3d7d0ac4fb9d1652c9b427.exe
Size

1.3MB
MD5

7cbf389b3d3d7d0ac4fb9d1652c9b427
SHA1

f8db12a3fd8fc5d02c7e56bc727d5411702852c6
SHA256

938deb1fb95c5990b581fd5b988f8d5a980d0f4a117cc6957012602f0196987d
SHA512

739c6ba8901708204a913f55a4d636c933ac9ef73af166d331f8db77f2b1b53430cd19b4f3a85cc2718d64b37ceb4bde14f5e31144749ef45b918ae22d22063d
SSDEEP

24576:IuTS4zbdAINM/2OLEJMVrxe+jRhWI7azyoQTz/fBU2Qt7XJjvo:/zBAmM/TAJM9vjvWp7QTr5U2+Vjvo

Score

10^/10

rhadamanthys systembc stealer trojan

Malware Config

Extracted

Family

systembc

210.16.67.250:3000

192.168.1.28:3000

Signatures

Detect rhadamanthys stealer shellcode 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2156-148-0x0000000001020000-0x000000000103C000-memory.dmp	family_rhadamanthys
behavioral2/memory/2156-150-0x0000000001020000-0x000000000103C000-memory.dmp	family_rhadamanthys
behavioral2/memory/2156-153-0x0000000001020000-0x000000000103C000-memory.dmp	family_rhadamanthys

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

C:\Users\Admin\AppData\Local\Temp\7cbf389b3d3d7d0ac4fb9d1652c9b427.exe
"C:\Users\Admin\AppData\Local\Temp\7cbf389b3d3d7d0ac4fb9d1652c9b427.exe"
1⤵
PID:1448

C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"
2⤵
PID:1800

C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"
2⤵
PID:1120

C:\Windows\SysWOW64\fontview.exe
"C:\Windows\SYSWOW64\fontview.exe"
1⤵
PID:2156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\240596984.dll
Filesize
334KB

MD5
0e22cfc0f6d3fd7dd763628326e5ebb6

SHA1
e782579c913c4eeefd20c5bfdc029a7510305f39

SHA256
40407a4d0e32069d6c1060e2c2fec7f826dfce7d06b3f3aaf2aa3a559f26cabc

SHA512
3b458f91e8b170b1c14396ad7da043465033d8e647ed87dbcf2fc475feca86908fe97082147e1a414f2d099289b8d15812eae1c809f659c2ec7097be653116bb

Download Submit
memory/1120-139-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1120-135-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1120-137-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1120-138-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1448-146-0x0000000002560000-0x000000000268A000-memory.dmp

Filesize
1.2MB

Download
memory/1448-134-0x000000000D010000-0x000000000D06A000-memory.dmp

Filesize
360KB

Download
memory/1448-133-0x0000000002560000-0x000000000268A000-memory.dmp

Filesize
1.2MB

Download
memory/1448-156-0x0000000002560000-0x000000000268A000-memory.dmp

Filesize
1.2MB

Download
memory/2156-144-0x0000000000D00000-0x0000000000D33000-memory.dmp

Filesize
204KB

Download
memory/2156-148-0x0000000001020000-0x000000000103C000-memory.dmp

Filesize
112KB

Download
memory/2156-150-0x0000000001020000-0x000000000103C000-memory.dmp

Filesize
112KB

Download
memory/2156-151-0x0000000001000000-0x0000000001002000-memory.dmp

Filesize
8KB

Download
memory/2156-152-0x0000000001000000-0x0000000001003000-memory.dmp

Filesize
12KB

Download
memory/2156-153-0x0000000001020000-0x000000000103C000-memory.dmp

Filesize
112KB

Download
memory/2156-154-0x0000000000D00000-0x0000000000D33000-memory.dmp

Filesize
204KB

Download