Analysis
- max time kernel
143s - max time network
168s - platform
windows7_x64 - resource
win7-20230220-en - resource tags
- submitted
01/05/2023, 16:14
General
- Target 3e9f2d6f3466bf7721416511da663aa526c7c3fec155738bcb38839cba209aa4.exe
- Size 338KB
- Sample230501-tp5vaaca94
- SHA256 3e9f2d6f3466bf7721416511da663aa526c7c3fec155738bcb38839cba209aa4
Score
10/10
Malware Config
Extracted
Family
-
rhadamanthys
C2
-
http://179.43.142.201/img/favicon.png
Signatures
- Detect rhadamanthys stealer shellcode 4 IoCs
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3e9f2d6f3466bf7721416511da663aa526c7c3fec155738bcb38839cba209aa4.exe"C:\Users\Admin\AppData\Local\Temp\3e9f2d6f3466bf7721416511da663aa526c7c3fec155738bcb38839cba209aa4.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1744-55-0x0000000000220000-0x000000000024E000-memory.dmp
memory/1744-56-0x0000000000400000-0x00000000007FA000-memory.dmp
memory/1744-59-0x0000000000250000-0x000000000026C000-memory.dmp
memory/1744-60-0x0000000000290000-0x0000000000291000-memory.dmp
memory/1744-61-0x0000000000250000-0x000000000026C000-memory.dmp
memory/1744-62-0x0000000000250000-0x000000000026C000-memory.dmp
memory/1744-63-0x0000000000400000-0x00000000007FA000-memory.dmp
memory/1744-65-0x0000000000250000-0x000000000026C000-memory.dmp