Analysis
- max time kernel
144s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
- submitted
01/05/2023, 14:59
General
- Target 05449538e49687a3ab632007f213fafa5287be8171e3253a3193f3303afc7c63.exe
- Size 398KB
- Sample230501-scshragc45
- SHA256 05449538e49687a3ab632007f213fafa5287be8171e3253a3193f3303afc7c63
Score
10/10
Malware Config
Extracted
Family
-
rhadamanthys
C2
-
http://179.43.142.201/img/favicon.png
Signatures
- Detect rhadamanthys stealer shellcode 4 IoCs
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
Processes
-
C:\Users\Admin\AppData\Local\Temp\05449538e49687a3ab632007f213fafa5287be8171e3253a3193f3303afc7c63.exe"C:\Users\Admin\AppData\Local\Temp\05449538e49687a3ab632007f213fafa5287be8171e3253a3193f3303afc7c63.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1044-134-0x00000000009A0000-0x00000000009CE000-memory.dmp
memory/1044-135-0x0000000000400000-0x0000000000808000-memory.dmp
memory/1044-138-0x00000000009D0000-0x00000000009EC000-memory.dmp
memory/1044-139-0x00000000009D0000-0x00000000009EC000-memory.dmp
memory/1044-140-0x00000000009F0000-0x0000000000A0A000-memory.dmp
memory/1044-141-0x00000000009D0000-0x00000000009EC000-memory.dmp
memory/1044-142-0x0000000000400000-0x0000000000808000-memory.dmp
memory/1044-143-0x00000000009D0000-0x00000000009EC000-memory.dmp
memory/1044-144-0x00000000009F0000-0x0000000000A0A000-memory.dmp