Analysis
- max time kernel
181s - max time network
218s - platform
windows10-2004_x64 - resource
win10v2004-20230221-en - resource tags
- submitted
01/05/2023, 16:49
General
- Target 661ae25c0714cc7d2bbc3988fa27317a1971804d3d91f06685b0d19c4b0e6399.exe
- Size 278KB
- Sample230501-vb5sssed96
- SHA256 661ae25c0714cc7d2bbc3988fa27317a1971804d3d91f06685b0d19c4b0e6399
Malware Config
Extracted
-
rhadamanthys
-
http://179.43.142.201/img/favicon.png
Signatures
- Detect rhadamanthys stealer shellcode 4 IoCs
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
Processes
-
C:\Users\Admin\AppData\Local\Temp\661ae25c0714cc7d2bbc3988fa27317a1971804d3d91f06685b0d19c4b0e6399.exe"C:\Users\Admin\AppData\Local\Temp\661ae25c0714cc7d2bbc3988fa27317a1971804d3d91f06685b0d19c4b0e6399.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/636-134-0x00000000047B0000-0x00000000047DE000-memory.dmp
memory/636-135-0x0000000000400000-0x0000000002BA0000-memory.dmp
memory/636-136-0x00000000047B0000-0x00000000047DE000-memory.dmp
memory/636-137-0x0000000000400000-0x0000000002BA0000-memory.dmp
memory/636-140-0x0000000002C20000-0x0000000002C3C000-memory.dmp
memory/636-141-0x0000000002C20000-0x0000000002C3C000-memory.dmp
memory/636-142-0x00000000047E0000-0x00000000047E2000-memory.dmp
memory/636-143-0x0000000002C20000-0x0000000002C3C000-memory.dmp
memory/636-144-0x0000000000400000-0x0000000002BA0000-memory.dmp
memory/636-145-0x0000000002C20000-0x0000000002C3C000-memory.dmp