Analysis
- max time kernel
146s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
- submitted
09/05/2023, 06:55
General
- Target f916846ad99f77ebb27edaa95f085566.exe
- Size 406KB
- Sample230509-hptapsge8v
- SHA256 597a4ade5d862166430037813118d0e94d993d87490fed195c0ade3fb6ab3e42
Malware Config
Extracted
-
rhadamanthys
-
http://179.43.142.201/img/favicon.png
Signatures
- Detect rhadamanthys stealer shellcode 4 IoCs
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f916846ad99f77ebb27edaa95f085566.exe"C:\Users\Admin\AppData\Local\Temp\f916846ad99f77ebb27edaa95f085566.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3384-134-0x0000000000880000-0x00000000008AE000-memory.dmp
memory/3384-135-0x0000000000400000-0x00000000006E3000-memory.dmp
memory/3384-136-0x0000000000880000-0x00000000008AE000-memory.dmp
memory/3384-139-0x00000000008B0000-0x00000000008CC000-memory.dmp
memory/3384-140-0x00000000008B0000-0x00000000008CC000-memory.dmp
memory/3384-141-0x0000000002480000-0x000000000249A000-memory.dmp
memory/3384-142-0x00000000008B0000-0x00000000008CC000-memory.dmp
memory/3384-143-0x0000000000400000-0x00000000006E3000-memory.dmp
memory/3384-144-0x00000000008B0000-0x00000000008CC000-memory.dmp
memory/3384-145-0x0000000002480000-0x000000000249A000-memory.dmp