Resubmissions

27-11-2024 10:05

241127-l4rl7sypft 10

04-10-2023 13:49

231004-q4nmrsea72 10

Analysis

  • max time kernel
    117s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    04-10-2023 13:49

General

  • Target

    project2.exe

  • Size

    456KB

  • MD5

    0ee4d15340837e26bed18e42753a157b

  • SHA1

    f53fbe16fb8321646bb9884212229a5f65d3e705

  • SHA256

    6209b24f9ecaed037484199423f1151f9c7883196c58cd8faf2430ca219885cf

  • SHA512

    c872488cf0e4e437fa4b79ef582c023c5e0f4c657f6fabacda5bc443db1a0ff2439d8bfce466a5ca0999a4dc10e8251b1e0b285ea3f392f3844c1998d727835c

  • SSDEEP

    6144:2uWP/BtSnurUylcrGYlnIttxv8HbcLgsd1Gus5psdrvV44dixP+MHDkBYdxtG9+J:2uWP/BZUyoLu8Agsmxwrvejkd2

Score
10/10

Malware Config

Signatures

  • Detect rhadamanthys stealer shellcode 5 IoCs
  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\project2.exe
    "C:\Users\Admin\AppData\Local\Temp\project2.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:3056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3056-0-0x0000000000230000-0x0000000000237000-memory.dmp

    Filesize

    28KB

  • memory/3056-1-0x0000000002100000-0x0000000002500000-memory.dmp

    Filesize

    4.0MB

  • memory/3056-3-0x0000000002100000-0x0000000002500000-memory.dmp

    Filesize

    4.0MB

  • memory/3056-2-0x0000000002100000-0x0000000002500000-memory.dmp

    Filesize

    4.0MB

  • memory/3056-4-0x0000000002100000-0x0000000002500000-memory.dmp

    Filesize

    4.0MB

  • memory/3056-5-0x0000000002100000-0x0000000002500000-memory.dmp

    Filesize

    4.0MB