Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2023, 13:51
Static task
static1
Behavioral task
behavioral1
Sample
rh_0.4.9rc1.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
rh_0.4.9rc1.exe
Resource
win10v2004-20230915-en
General
-
Target
rh_0.4.9rc1.exe
-
Size
456KB
-
MD5
c5c64755f463c91c92f516b3214c5b37
-
SHA1
04b2137cf45cf32ad141c52ac66f67687bc7f35c
-
SHA256
57939197bad88b1f26555826a1de37b5527483a5583745cd614aff349cb41ea4
-
SHA512
9435b7d5d14de252e75335c80091ae3670bdf3be2cf02116b52ae7c1852e00085d8a601b19440af4034ce42da716972943bf9368bcde77870f9981f5f779cdd0
-
SSDEEP
6144:2uWP/BtSnurUylcrGYlnIttxv8HbcLgsd1Gus5psdrvV44dixP+MHDkBYdxtG9+g:2uWP/BZUyoLu8Agsmxwrvejkd2
Malware Config
Signatures
-
Detect rhadamanthys stealer shellcode 5 IoCs
resource yara_rule behavioral2/memory/4044-1-0x0000000002420000-0x0000000002820000-memory.dmp family_rhadamanthys behavioral2/memory/4044-2-0x0000000002420000-0x0000000002820000-memory.dmp family_rhadamanthys behavioral2/memory/4044-3-0x0000000002420000-0x0000000002820000-memory.dmp family_rhadamanthys behavioral2/memory/4044-4-0x0000000002420000-0x0000000002820000-memory.dmp family_rhadamanthys behavioral2/memory/4044-12-0x0000000002420000-0x0000000002820000-memory.dmp family_rhadamanthys -
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 4044 created 3100 4044 rh_0.4.9rc1.exe 58 -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4044 rh_0.4.9rc1.exe 4044 rh_0.4.9rc1.exe 4044 rh_0.4.9rc1.exe 4044 rh_0.4.9rc1.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4044 wrote to memory of 3560 4044 rh_0.4.9rc1.exe 92 PID 4044 wrote to memory of 3560 4044 rh_0.4.9rc1.exe 92 PID 4044 wrote to memory of 3560 4044 rh_0.4.9rc1.exe 92 PID 4044 wrote to memory of 3560 4044 rh_0.4.9rc1.exe 92
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\rh_0.4.9rc1.exe"C:\Users\Admin\AppData\Local\Temp\rh_0.4.9rc1.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4044
-
-
C:\Windows\system32\certreq.exe"C:\Windows\system32\certreq.exe"2⤵PID:3560
-