rhadamanthys | d20181563c161b0772cfad41069a572fe4c5f4f64d08be9ef99992723cec6c87

Analysis

max time kernel
148s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
23/12/2023, 15:20

Target

tmp.exe
Size

2.9MB
MD5

50b5f7c97594361c760ecf27a93f3bd4
SHA1

b4347e675b7b5733ee9cccc9fdeda78f68d32fdc
SHA256

d20181563c161b0772cfad41069a572fe4c5f4f64d08be9ef99992723cec6c87
SHA512

671dbd211fa190482ef69f73440913ccf6cb1cb5b63ffb6177942986554512f76a770ebe801adbef14179eaca26934b9430ddef354007e56423814109eb552c5
SSDEEP

49152:pogLnkIaOPQlwORBCEM/97yzWTCiuw7Kz38Q8xTnQbv9+ktdxlISXaaVlKwBopNC:K2nkgKLCEMNBThuw7KzMQ8GF+UdnISXl

Score

10^/10

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3396 created 2552	3396	tmp.exe	62

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3396 wrote to memory of 2984	3396	tmp.exe	92
PID 3396 wrote to memory of 2984	3396	tmp.exe	92
PID 3396 wrote to memory of 2984	3396	tmp.exe	92
PID 3396 wrote to memory of 2984	3396	tmp.exe	92
PID 3396 wrote to memory of 2984	3396	tmp.exe	92

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2552
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2984

memory/2984-19-0x00007FFD55B30000-0x00007FFD55D25000-memory.dmp

Filesize
2.0MB

Download
memory/2984-14-0x00000000005F0000-0x00000000005F9000-memory.dmp

Filesize
36KB

Download
memory/2984-23-0x0000000002540000-0x0000000002940000-memory.dmp

Filesize
4.0MB

Download
memory/2984-22-0x0000000077710000-0x0000000077925000-memory.dmp

Filesize
2.1MB

Download
memory/2984-21-0x0000000002540000-0x0000000002940000-memory.dmp

Filesize
4.0MB

Download
memory/2984-18-0x0000000002540000-0x0000000002940000-memory.dmp

Filesize
4.0MB

Download
memory/3396-8-0x0000000003800000-0x0000000003C00000-memory.dmp

Filesize
4.0MB

Download
memory/3396-13-0x0000000077710000-0x0000000077925000-memory.dmp

Filesize
2.1MB

Download
memory/3396-1-0x0000000000400000-0x00000000008FE000-memory.dmp

Filesize
5.0MB

Download
memory/3396-15-0x0000000000400000-0x00000000008FE000-memory.dmp

Filesize
5.0MB

Download
memory/3396-9-0x0000000003800000-0x0000000003C00000-memory.dmp

Filesize
4.0MB

Download
memory/3396-10-0x00007FFD55B30000-0x00007FFD55D25000-memory.dmp

Filesize
2.0MB

Download
memory/3396-0-0x0000000000400000-0x00000000008FE000-memory.dmp

Filesize
5.0MB

Download
memory/3396-11-0x0000000003800000-0x0000000003C00000-memory.dmp

Filesize
4.0MB

Download
memory/3396-7-0x0000000003800000-0x0000000003C00000-memory.dmp

Filesize
4.0MB

Download
memory/3396-3-0x0000000000400000-0x00000000008FE000-memory.dmp

Filesize
5.0MB

Download