rhadamanthys | ef4788a45df8809851b18e5bfac1bad8fa8ea4850ac68fca2cca03b9b830a755

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
02/04/2024, 04:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ef4788a45df8809851b18e5bfac1bad8fa8ea4850ac68fca2cca03b9b830a755.exe
Size 436KB
Sample240402-espvxagb8v
SHA256 ef4788a45df8809851b18e5bfac1bad8fa8ea4850ac68fca2cca03b9b830a755
MD5 9b2a7e7f1001a3eaf7e83593d21a98ab
SHA1 e280ff25a527a9d11a30f7223a78e08544d09c85
SHA512 5edaa8940c152b24dbee854d86dcae1b02dbbcf182642e7d87a97372c38c7c5c8e450078b490dc4564b197e0df14ad9a7dcec0d193a9ad9646fbb3c0a472f4df
SSDEEP 12288:Oc5wlzDj6o+EiB0LryUXQwwfsmo6Qjgdz7XlDOT:f5wl/wfsmoHjgdz78
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2884 created 1192	2884	RegAsm.exe	21

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3032 set thread context of 2884	3032	ef4788a45df8809851b18e5bfac1bad8fa8ea4850ac68fca2cca03b9b830a755.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2524	3032	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2884	RegAsm.exe
2884	RegAsm.exe
2648	dialer.exe
2648	dialer.exe
2648	dialer.exe
2648	dialer.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2884	3032	ef4788a45df8809851b18e5bfac1bad8fa8ea4850ac68fca2cca03b9b830a755.exe	29
PID 3032 wrote to memory of 2884	3032	ef4788a45df8809851b18e5bfac1bad8fa8ea4850ac68fca2cca03b9b830a755.exe	29
PID 3032 wrote to memory of 2884	3032	ef4788a45df8809851b18e5bfac1bad8fa8ea4850ac68fca2cca03b9b830a755.exe	29
PID 3032 wrote to memory of 2884	3032	ef4788a45df8809851b18e5bfac1bad8fa8ea4850ac68fca2cca03b9b830a755.exe	29
PID 3032 wrote to memory of 2884	3032	ef4788a45df8809851b18e5bfac1bad8fa8ea4850ac68fca2cca03b9b830a755.exe	29
PID 3032 wrote to memory of 2884	3032	ef4788a45df8809851b18e5bfac1bad8fa8ea4850ac68fca2cca03b9b830a755.exe	29
PID 3032 wrote to memory of 2884	3032	ef4788a45df8809851b18e5bfac1bad8fa8ea4850ac68fca2cca03b9b830a755.exe	29
PID 3032 wrote to memory of 2884	3032	ef4788a45df8809851b18e5bfac1bad8fa8ea4850ac68fca2cca03b9b830a755.exe	29
PID 3032 wrote to memory of 2884	3032	ef4788a45df8809851b18e5bfac1bad8fa8ea4850ac68fca2cca03b9b830a755.exe	29
PID 3032 wrote to memory of 2884	3032	ef4788a45df8809851b18e5bfac1bad8fa8ea4850ac68fca2cca03b9b830a755.exe	29
PID 3032 wrote to memory of 2884	3032	ef4788a45df8809851b18e5bfac1bad8fa8ea4850ac68fca2cca03b9b830a755.exe	29
PID 3032 wrote to memory of 2884	3032	ef4788a45df8809851b18e5bfac1bad8fa8ea4850ac68fca2cca03b9b830a755.exe	29
PID 3032 wrote to memory of 2884	3032	ef4788a45df8809851b18e5bfac1bad8fa8ea4850ac68fca2cca03b9b830a755.exe	29
PID 3032 wrote to memory of 2524	3032	ef4788a45df8809851b18e5bfac1bad8fa8ea4850ac68fca2cca03b9b830a755.exe	30
PID 3032 wrote to memory of 2524	3032	ef4788a45df8809851b18e5bfac1bad8fa8ea4850ac68fca2cca03b9b830a755.exe	30
PID 3032 wrote to memory of 2524	3032	ef4788a45df8809851b18e5bfac1bad8fa8ea4850ac68fca2cca03b9b830a755.exe	30
PID 3032 wrote to memory of 2524	3032	ef4788a45df8809851b18e5bfac1bad8fa8ea4850ac68fca2cca03b9b830a755.exe	30
PID 3032 wrote to memory of 2884	3032	ef4788a45df8809851b18e5bfac1bad8fa8ea4850ac68fca2cca03b9b830a755.exe	29
PID 2884 wrote to memory of 2648	2884	RegAsm.exe	31
PID 2884 wrote to memory of 2648	2884	RegAsm.exe	31
PID 2884 wrote to memory of 2648	2884	RegAsm.exe	31
PID 2884 wrote to memory of 2648	2884	RegAsm.exe	31
PID 2884 wrote to memory of 2648	2884	RegAsm.exe	31
PID 2884 wrote to memory of 2648	2884	RegAsm.exe	31

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1192
- C:\Users\Admin\AppData\Local\Temp\ef4788a45df8809851b18e5bfac1bad8fa8ea4850ac68fca2cca03b9b830a755.exe
  "C:\Users\Admin\AppData\Local\Temp\ef4788a45df8809851b18e5bfac1bad8fa8ea4850ac68fca2cca03b9b830a755.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2884
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 508
    3⤵
    - Program crash
    PID:2524
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2648-25-0x00000000000C0000-0x00000000000C9000-memory.dmp

Download

memory/2648-37-0x00000000771A0000-0x0000000077349000-memory.dmp

Download

memory/2648-36-0x0000000001B70000-0x0000000001F70000-memory.dmp

Download

memory/2648-34-0x0000000076D20000-0x0000000076D67000-memory.dmp

Download

memory/2648-33-0x0000000001B70000-0x0000000001F70000-memory.dmp

Download

memory/2648-31-0x00000000771A0000-0x0000000077349000-memory.dmp

Download

memory/2648-29-0x0000000001B70000-0x0000000001F70000-memory.dmp

Download

memory/2648-28-0x0000000001B70000-0x0000000001F70000-memory.dmp

Download

memory/2884-10-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2884-24-0x0000000076D20000-0x0000000076D67000-memory.dmp

Download

memory/2884-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2884-14-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2884-16-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2884-17-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2884-20-0x00000000036E0000-0x0000000003AE0000-memory.dmp

Download

memory/2884-19-0x00000000036E0000-0x0000000003AE0000-memory.dmp

Download

memory/2884-18-0x00000000036E0000-0x0000000003AE0000-memory.dmp

Download

memory/2884-21-0x00000000771A0000-0x0000000077349000-memory.dmp

Download

memory/2884-22-0x00000000036E0000-0x0000000003AE0000-memory.dmp

Download

memory/2884-11-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2884-5-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2884-26-0x00000000036E0000-0x0000000003AE0000-memory.dmp

Download

memory/2884-9-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2884-8-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2884-7-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3032-6-0x00000000020F0000-0x00000000040F0000-memory.dmp

Download

memory/3032-35-0x00000000742A0000-0x000000007498E000-memory.dmp

Download

memory/3032-0-0x00000000000E0000-0x000000000014E000-memory.dmp

Download

memory/3032-2-0x0000000004C50000-0x0000000004C90000-memory.dmp

Download

memory/3032-1-0x00000000742A0000-0x000000007498E000-memory.dmp

Download

memory/3032-38-0x0000000004C50000-0x0000000004C90000-memory.dmp

Download

memory/3032-39-0x00000000020F0000-0x00000000040F0000-memory.dmp

Download