Resubmissions
27/11/2024, 09:54
241127-lxb8yavpck 1020/08/2024, 14:48
240820-r6q2casajl 1019/12/2023, 13:13
231219-qf3rsadcg7 10Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
19/12/2023, 13:13
General
-
Target
bb.exe
-
Size
479KB
-
MD5
b2dc71aeb389c4c5f6b3699163ea1d0f
-
SHA1
578239aefa2c93cae72624754146e8f3e275fa5e
-
SHA256
bb8bbcc948e8dca2e5a0270c41c062a29994a2d9b51e820ed74d9b6e2a01ddcf
-
SHA512
2ac4ebf5ca226384b299167c58aaf4e24ab4a2a4897ef914871803df23794a44a1c9ab638b1714653cd767e566fb5bd0745ebc26f0dc5a3be4e345e6ef5b9461
-
SSDEEP
6144:pTNlPsSiE0grIlHAjNL7SVAtKZnbr8qz6xzS06d17GQxAAXcpGZ5wIzkyOD+lRXs:pFR0gsAjNLJtQbr8w6xely1JcXgDsLm
Score
10/10
Malware Config
Signatures
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Deletes itself 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bb.exe"C:\Users\Admin\AppData\Local\Temp\bb.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
560KB
-
Filesize
560KB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
1.7MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
284KB
-
Filesize
4.0MB
-
Filesize
36KB
-
Filesize
4.0MB
-
Filesize
1.7MB
-
Filesize
284KB
-
Filesize
4.0MB
-
Filesize
1.7MB
-
Filesize
4.0MB