Analysis
- max time kernel
166s - max time network
168s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
- submitted
01/05/2023, 15:30
General
- Target 1d31ab7ee42053b4f7eed00f003de6d5fa29ef0f6728e936cc8f4a774d849547.exe
- Size 353KB
- Sample230501-sxtasabe4z
- SHA256 1d31ab7ee42053b4f7eed00f003de6d5fa29ef0f6728e936cc8f4a774d849547
Malware Config
Extracted
-
rhadamanthys
-
http://179.43.142.201/img/favicon.png
Signatures
- Detect rhadamanthys stealer shellcode 4 IoCs
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d31ab7ee42053b4f7eed00f003de6d5fa29ef0f6728e936cc8f4a774d849547.exe"C:\Users\Admin\AppData\Local\Temp\1d31ab7ee42053b4f7eed00f003de6d5fa29ef0f6728e936cc8f4a774d849547.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1172-134-0x00000000021A0000-0x00000000021CE000-memory.dmp
memory/1172-135-0x0000000000400000-0x000000000046B000-memory.dmp
memory/1172-136-0x00000000021A0000-0x00000000021CE000-memory.dmp
memory/1172-139-0x00000000021D0000-0x00000000021EC000-memory.dmp
memory/1172-140-0x00000000021D0000-0x00000000021EC000-memory.dmp
memory/1172-141-0x00000000021F0000-0x000000000220A000-memory.dmp
memory/1172-142-0x00000000021D0000-0x00000000021EC000-memory.dmp
memory/1172-143-0x0000000000400000-0x000000000046B000-memory.dmp
memory/1172-144-0x00000000021D0000-0x00000000021EC000-memory.dmp
memory/1172-145-0x00000000021F0000-0x000000000220A000-memory.dmp