Analysis
-
max time kernel
151s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
08-05-2023 09:24
Static task
static1
Behavioral task
behavioral1
Sample
f4fb68a3204764e70463115656dc47aad9ae736e996395cd5873727cc236d365.exe
Resource
win10v2004-20230220-en
General
-
Target
f4fb68a3204764e70463115656dc47aad9ae736e996395cd5873727cc236d365.exe
-
Size
390KB
-
MD5
5203fe9c09e97a5f0c063cbc9ee17642
-
SHA1
67fa045e0c23a4adf44517431afb45d7fa1ac22d
-
SHA256
f4fb68a3204764e70463115656dc47aad9ae736e996395cd5873727cc236d365
-
SHA512
0ed7050f9d0a90aea76470e65d76066f2fd751630df0eaa79f651dee6b250774be2fef9fa35aa5ab53d3e2506dbcd6356c1472455ec87ce4c1357b3e45b9ca69
-
SSDEEP
6144:D4R5DrILcsCI38WCBV0RFMYRcyfj8BEZ8AvFaDAy:DG5DrILc238fMvq08Ay
Malware Config
Extracted
rhadamanthys
http://179.43.142.201/img/favicon.png
Signatures
-
Detect rhadamanthys stealer shellcode 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2796-138-0x0000000002320000-0x000000000233C000-memory.dmp family_rhadamanthys behavioral1/memory/2796-139-0x0000000002320000-0x000000000233C000-memory.dmp family_rhadamanthys behavioral1/memory/2796-141-0x0000000002320000-0x000000000233C000-memory.dmp family_rhadamanthys behavioral1/memory/2796-143-0x0000000002320000-0x000000000233C000-memory.dmp family_rhadamanthys -
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2796-134-0x00000000022F0000-0x000000000231E000-memory.dmpFilesize
184KB
-
memory/2796-135-0x0000000000400000-0x00000000006DF000-memory.dmpFilesize
2.9MB
-
memory/2796-138-0x0000000002320000-0x000000000233C000-memory.dmpFilesize
112KB
-
memory/2796-139-0x0000000002320000-0x000000000233C000-memory.dmpFilesize
112KB
-
memory/2796-140-0x0000000000800000-0x0000000000802000-memory.dmpFilesize
8KB
-
memory/2796-141-0x0000000002320000-0x000000000233C000-memory.dmpFilesize
112KB
-
memory/2796-142-0x0000000000400000-0x00000000006DF000-memory.dmpFilesize
2.9MB
-
memory/2796-143-0x0000000002320000-0x000000000233C000-memory.dmpFilesize
112KB