Analysis
- max time kernel
150s - max time network
150s - platform
windows7_x64 - resource
win7-20230220-en - resource tags
- submitted
18/04/2023, 16:00
General
- Target 60de8bdb2a6664035303aa070639569e.exe
- Size 423KB
- Sample230418-tfmmcaec5x
- SHA256 9e28586ab70b1abdccfe087d81e326a0703f75e9551ced187d37c51130ad02f5
Score
10/10
Malware Config
Extracted
Family
-
rhadamanthys
C2
-
http://179.43.142.201/img/favicon.png
Signatures
- Detect rhadamanthys stealer shellcode 4 IoCs
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
Processes
-
C:\Users\Admin\AppData\Local\Temp\60de8bdb2a6664035303aa070639569e.exe"C:\Users\Admin\AppData\Local\Temp\60de8bdb2a6664035303aa070639569e.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2044-55-0x0000000000220000-0x000000000024E000-memory.dmp
memory/2044-56-0x0000000000400000-0x000000000080F000-memory.dmp
memory/2044-59-0x0000000000250000-0x000000000026C000-memory.dmp
memory/2044-61-0x0000000000280000-0x0000000000281000-memory.dmp
memory/2044-60-0x0000000000250000-0x000000000026C000-memory.dmp
memory/2044-62-0x0000000000250000-0x000000000026C000-memory.dmp
memory/2044-63-0x0000000000400000-0x000000000080F000-memory.dmp
memory/2044-65-0x0000000000250000-0x000000000026C000-memory.dmp