Analysis
- max time kernel
151s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
- submitted
17/03/2023, 09:21
General
- Target b43bee14387161a9dc5f3cbbba8382a7.exe
- Size 246KB
- Sample230317-lbbqaahd6w
- SHA256 92f8ab34d7e6a41dd7bfbfdedf73269950aba3f0ff0a8fec0aea049c81024cc6
Malware Config
Signatures
- Detect rhadamanthys stealer shellcode 5 IoCs
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
- Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b43bee14387161a9dc5f3cbbba8382a7.exe"C:\Users\Admin\AppData\Local\Temp\b43bee14387161a9dc5f3cbbba8382a7.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1212-134-0x00000000021F0000-0x000000000221E000-memory.dmp
memory/1212-135-0x0000000000400000-0x00000000004BD000-memory.dmp
memory/1212-138-0x0000000002220000-0x000000000223C000-memory.dmp
memory/1212-139-0x0000000002240000-0x000000000225A000-memory.dmp
memory/1212-140-0x0000000002220000-0x000000000223C000-memory.dmp
memory/1212-142-0x0000000002220000-0x000000000223C000-memory.dmp
memory/1212-143-0x00000000024E0000-0x00000000034E0000-memory.dmp
memory/1212-144-0x0000000000400000-0x00000000004BD000-memory.dmp
memory/1212-145-0x0000000002220000-0x000000000223C000-memory.dmp
memory/1212-146-0x0000000002240000-0x000000000225A000-memory.dmp
memory/1212-147-0x00000000024E0000-0x00000000034E0000-memory.dmp