Analysis

  • max time kernel
    155s
  • max time network
    173s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-05-2023 17:07

General

  • Target

    79af3d56f147ca12b1bea965872338e4609d64efac9742103e11deed78b5f711.exe

  • Size

    416KB

  • MD5

    9adefd007c20b2d46239210d54c41335

  • SHA1

    4b3b4a3295154e64e3b487391816fc70278b391f

  • SHA256

    79af3d56f147ca12b1bea965872338e4609d64efac9742103e11deed78b5f711

  • SHA512

    b9cbcd3321fae57b30da2b30fe7988b7c5a676b5a01a8b413b76f55928f312e30a0bf6347771722a86cab7926b9b092bfb18bd3f34996b97439eb987a8b64b2b

  • SSDEEP

    6144:ixleYFZsOk3uIP8d5Jw0uKOew2Gyt3YuCSR2KkuAKvQ7LnFH/y:ixl3FZFk3R8fJwJKPbGcQDR1KkLnFH/

Score
10/10

Malware Config

Extracted

Family

rhadamanthys

C2

http://179.43.142.201/img/favicon.png

Signatures

  • Detect rhadamanthys stealer shellcode 3 IoCs
  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

Processes

  • C:\Users\Admin\AppData\Local\Temp\79af3d56f147ca12b1bea965872338e4609d64efac9742103e11deed78b5f711.exe
    "C:\Users\Admin\AppData\Local\Temp\79af3d56f147ca12b1bea965872338e4609d64efac9742103e11deed78b5f711.exe"
    1⤵
      PID:4116

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4116-134-0x0000000002540000-0x000000000256E000-memory.dmp

      Filesize

      184KB

    • memory/4116-135-0x0000000000400000-0x000000000080D000-memory.dmp

      Filesize

      4.1MB

    • memory/4116-138-0x00000000025B0000-0x00000000025CC000-memory.dmp

      Filesize

      112KB

    • memory/4116-139-0x0000000002570000-0x0000000002572000-memory.dmp

      Filesize

      8KB

    • memory/4116-140-0x00000000025B0000-0x00000000025CC000-memory.dmp

      Filesize

      112KB

    • memory/4116-141-0x00000000025B0000-0x00000000025CC000-memory.dmp

      Filesize

      112KB

    • memory/4116-142-0x0000000000400000-0x000000000080D000-memory.dmp

      Filesize

      4.1MB

    • memory/4116-143-0x0000000002570000-0x0000000002572000-memory.dmp

      Filesize

      8KB