Analysis
-
max time kernel
141s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
18-07-2023 04:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
772b9bb527943f418efc93641ac7d2c010bdbbcc5e08847074a7175f711e0b43.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
772b9bb527943f418efc93641ac7d2c010bdbbcc5e08847074a7175f711e0b43.exe
-
Size
456KB
-
MD5
073d7cd1899d330ac831fcb178a18f76
-
SHA1
00c7f0ca90e4cdd312c899547605236c4204928f
-
SHA256
772b9bb527943f418efc93641ac7d2c010bdbbcc5e08847074a7175f711e0b43
-
SHA512
043981c9ad979fe1c94f7a9b85482e2d3574bd218fd8589dd1c746546efe58e3e20433c4f42972a833970f9f1fa3b49267737ed6fa39f9a4af0a4343155da376
-
SSDEEP
6144:2uWP/BtSnurUylcrGYlnIttxv8HbcLgsd1Gus5psdrvV44dixP+MHDkBYdxtG9+Y:2uWP/BZUyoLu8Agsmxwrvejkd2
Score
10/10
Malware Config
Signatures
-
Detect rhadamanthys stealer shellcode 4 IoCs
resource yara_rule behavioral1/memory/3440-134-0x0000000002450000-0x0000000002850000-memory.dmp family_rhadamanthys behavioral1/memory/3440-135-0x0000000002450000-0x0000000002850000-memory.dmp family_rhadamanthys behavioral1/memory/3440-136-0x0000000002450000-0x0000000002850000-memory.dmp family_rhadamanthys behavioral1/memory/3440-137-0x0000000002450000-0x0000000002850000-memory.dmp family_rhadamanthys -
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3440 772b9bb527943f418efc93641ac7d2c010bdbbcc5e08847074a7175f711e0b43.exe 3440 772b9bb527943f418efc93641ac7d2c010bdbbcc5e08847074a7175f711e0b43.exe