Analysis
- max time kernel
151s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
- submitted
01/05/2023, 16:53
General
- Target 698ce2cd655de784d4c2d82f075bad56.exe
- Size 353KB
- Sample230501-vdy32aef75
- SHA256 e4e4d31befd74c000d49c480916ac805be52fc604b9dcb4f7ca7590fce972be6
Malware Config
Extracted
-
rhadamanthys
-
http://179.43.142.201/img/favicon.png
Signatures
- Detect rhadamanthys stealer shellcode 4 IoCs
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
Processes
-
C:\Users\Admin\AppData\Local\Temp\698ce2cd655de784d4c2d82f075bad56.exe"C:\Users\Admin\AppData\Local\Temp\698ce2cd655de784d4c2d82f075bad56.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3384-134-0x00000000021B0000-0x00000000021DE000-memory.dmp
memory/3384-135-0x0000000000400000-0x000000000046B000-memory.dmp
memory/3384-136-0x00000000021B0000-0x00000000021DE000-memory.dmp
memory/3384-137-0x0000000000400000-0x000000000046B000-memory.dmp
memory/3384-140-0x0000000000540000-0x000000000055C000-memory.dmp
memory/3384-141-0x0000000000540000-0x000000000055C000-memory.dmp
memory/3384-142-0x0000000000560000-0x000000000057A000-memory.dmp
memory/3384-143-0x0000000000540000-0x000000000055C000-memory.dmp
memory/3384-144-0x0000000000400000-0x000000000046B000-memory.dmp
memory/3384-145-0x0000000000540000-0x000000000055C000-memory.dmp
memory/3384-146-0x0000000000560000-0x000000000057A000-memory.dmp