rhadamanthys | 57939197bad88b1f26555826a1de37b5527483a5583745cd614aff349cb41ea4

Analysis

max time kernel
176s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 04:20

Target

SecuriteInfo.com.Trojan.Packed2.45463.31130.14404.exe
Size

456KB
MD5

c5c64755f463c91c92f516b3214c5b37
SHA1

04b2137cf45cf32ad141c52ac66f67687bc7f35c
SHA256

57939197bad88b1f26555826a1de37b5527483a5583745cd614aff349cb41ea4
SHA512

9435b7d5d14de252e75335c80091ae3670bdf3be2cf02116b52ae7c1852e00085d8a601b19440af4034ce42da716972943bf9368bcde77870f9981f5f779cdd0
SSDEEP

6144:2uWP/BtSnurUylcrGYlnIttxv8HbcLgsd1Gus5psdrvV44dixP+MHDkBYdxtG9+g:2uWP/BZUyoLu8Agsmxwrvejkd2

Score

10^/10

Detect rhadamanthys stealer shellcode 5 IoCs

resource	yara_rule
behavioral2/memory/4472-1-0x0000000002480000-0x0000000002880000-memory.dmp	family_rhadamanthys
behavioral2/memory/4472-2-0x0000000002480000-0x0000000002880000-memory.dmp	family_rhadamanthys
behavioral2/memory/4472-3-0x0000000002480000-0x0000000002880000-memory.dmp	family_rhadamanthys
behavioral2/memory/4472-4-0x0000000002480000-0x0000000002880000-memory.dmp	family_rhadamanthys
behavioral2/memory/4472-12-0x0000000002480000-0x0000000002880000-memory.dmp	family_rhadamanthys

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4472 created 3128	4472	SecuriteInfo.com.Trojan.Packed2.45463.31130.14404.exe	62

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4472	SecuriteInfo.com.Trojan.Packed2.45463.31130.14404.exe
4472	SecuriteInfo.com.Trojan.Packed2.45463.31130.14404.exe
4472	SecuriteInfo.com.Trojan.Packed2.45463.31130.14404.exe
4472	SecuriteInfo.com.Trojan.Packed2.45463.31130.14404.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 3688	4472	SecuriteInfo.com.Trojan.Packed2.45463.31130.14404.exe	92
PID 4472 wrote to memory of 3688	4472	SecuriteInfo.com.Trojan.Packed2.45463.31130.14404.exe	92
PID 4472 wrote to memory of 3688	4472	SecuriteInfo.com.Trojan.Packed2.45463.31130.14404.exe	92
PID 4472 wrote to memory of 3688	4472	SecuriteInfo.com.Trojan.Packed2.45463.31130.14404.exe	92

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3128
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Packed2.45463.31130.14404.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Packed2.45463.31130.14404.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4472
- C:\Windows\system32\certreq.exe
  "C:\Windows\system32\certreq.exe"
  2⤵
  PID:3688

C:\Windows\System32\Upfc.exe
C:\Windows\System32\Upfc.exe /launchtype periodic /cv qgv4MkUmrESiPIPnppfnqg.0
1⤵
PID:3964

memory/3688-5-0x00000245CBDF0000-0x00000245CBDF3000-memory.dmp

Filesize
12KB

Download
memory/4472-0-0x0000000000570000-0x0000000000577000-memory.dmp

Filesize
28KB

Download
memory/4472-1-0x0000000002480000-0x0000000002880000-memory.dmp

Filesize
4.0MB

Download
memory/4472-2-0x0000000002480000-0x0000000002880000-memory.dmp

Filesize
4.0MB

Download
memory/4472-3-0x0000000002480000-0x0000000002880000-memory.dmp

Filesize
4.0MB

Download
memory/4472-4-0x0000000002480000-0x0000000002880000-memory.dmp

Filesize
4.0MB

Download
memory/4472-6-0x0000000003210000-0x0000000003246000-memory.dmp

Filesize
216KB

Download
memory/4472-12-0x0000000002480000-0x0000000002880000-memory.dmp

Filesize
4.0MB

Download