Analysis
- max time kernel
142s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
18/02/2024, 21:34
General
- Target SecuriteInfo.com.Win32.Evo-gen.24852.20254.exe
- Size 355KB
- Sample240218-1eq2psfc58
- SHA256 5578a78576a35a6a95c8a5372e7d498fd4d2a4d5d7abe7369a14307d578192c6
Malware Config
Signatures
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.24852.20254.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.24852.20254.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1140-7-0x00000000759D0000-0x0000000075BE5000-memory.dmp
memory/1140-0-0x0000000000340000-0x00000000003AD000-memory.dmp
memory/1140-2-0x00000000040D0000-0x00000000044D0000-memory.dmp
memory/1140-3-0x00000000040D0000-0x00000000044D0000-memory.dmp
memory/1140-4-0x00007FFAD83D0000-0x00007FFAD85C5000-memory.dmp
memory/1140-6-0x00000000040D0000-0x00000000044D0000-memory.dmp
memory/1140-1-0x00000000040D0000-0x00000000044D0000-memory.dmp
memory/1140-9-0x0000000000340000-0x00000000003AD000-memory.dmp
memory/1440-12-0x00000000024F0000-0x00000000028F0000-memory.dmp
memory/1440-11-0x00000000024F0000-0x00000000028F0000-memory.dmp
memory/1440-8-0x0000000000780000-0x0000000000789000-memory.dmp
memory/1440-14-0x00000000024F0000-0x00000000028F0000-memory.dmp
memory/1440-13-0x00007FFAD83D0000-0x00007FFAD85C5000-memory.dmp
memory/1440-16-0x00000000759D0000-0x0000000075BE5000-memory.dmp
memory/1440-17-0x00000000024F0000-0x00000000028F0000-memory.dmp