rhadamanthys | ef4788a45df8809851b18e5bfac1bad8fa8ea4850ac68fca2cca03b9b830a755

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/04/2024, 04:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ef4788a45df8809851b18e5bfac1bad8fa8ea4850ac68fca2cca03b9b830a755.exe
Size 436KB
Sample240402-espvxagb8v
SHA256 ef4788a45df8809851b18e5bfac1bad8fa8ea4850ac68fca2cca03b9b830a755
MD5 9b2a7e7f1001a3eaf7e83593d21a98ab
SHA1 e280ff25a527a9d11a30f7223a78e08544d09c85
SHA512 5edaa8940c152b24dbee854d86dcae1b02dbbcf182642e7d87a97372c38c7c5c8e450078b490dc4564b197e0df14ad9a7dcec0d193a9ad9646fbb3c0a472f4df
SSDEEP 12288:Oc5wlzDj6o+EiB0LryUXQwwfsmo6Qjgdz7XlDOT:f5wl/wfsmoHjgdz78
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2256 created 3064	2256	RegAsm.exe	52

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 668 set thread context of 2256	668	ef4788a45df8809851b18e5bfac1bad8fa8ea4850ac68fca2cca03b9b830a755.exe	87

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4208	668	WerFault.exe	84
2796	2256	WerFault.exe	87
3644	2256	WerFault.exe	87

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2256	RegAsm.exe
2256	RegAsm.exe
4476	dialer.exe
4476	dialer.exe
4476	dialer.exe
4476	dialer.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 668 wrote to memory of 2256	668	ef4788a45df8809851b18e5bfac1bad8fa8ea4850ac68fca2cca03b9b830a755.exe	87
PID 668 wrote to memory of 2256	668	ef4788a45df8809851b18e5bfac1bad8fa8ea4850ac68fca2cca03b9b830a755.exe	87
PID 668 wrote to memory of 2256	668	ef4788a45df8809851b18e5bfac1bad8fa8ea4850ac68fca2cca03b9b830a755.exe	87
PID 668 wrote to memory of 2256	668	ef4788a45df8809851b18e5bfac1bad8fa8ea4850ac68fca2cca03b9b830a755.exe	87
PID 668 wrote to memory of 2256	668	ef4788a45df8809851b18e5bfac1bad8fa8ea4850ac68fca2cca03b9b830a755.exe	87
PID 668 wrote to memory of 2256	668	ef4788a45df8809851b18e5bfac1bad8fa8ea4850ac68fca2cca03b9b830a755.exe	87
PID 668 wrote to memory of 2256	668	ef4788a45df8809851b18e5bfac1bad8fa8ea4850ac68fca2cca03b9b830a755.exe	87
PID 668 wrote to memory of 2256	668	ef4788a45df8809851b18e5bfac1bad8fa8ea4850ac68fca2cca03b9b830a755.exe	87
PID 668 wrote to memory of 2256	668	ef4788a45df8809851b18e5bfac1bad8fa8ea4850ac68fca2cca03b9b830a755.exe	87
PID 668 wrote to memory of 2256	668	ef4788a45df8809851b18e5bfac1bad8fa8ea4850ac68fca2cca03b9b830a755.exe	87
PID 668 wrote to memory of 2256	668	ef4788a45df8809851b18e5bfac1bad8fa8ea4850ac68fca2cca03b9b830a755.exe	87
PID 2256 wrote to memory of 4476	2256	RegAsm.exe	95
PID 2256 wrote to memory of 4476	2256	RegAsm.exe	95
PID 2256 wrote to memory of 4476	2256	RegAsm.exe	95
PID 2256 wrote to memory of 4476	2256	RegAsm.exe	95
PID 2256 wrote to memory of 4476	2256	RegAsm.exe	95

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:3064
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4476

C:\Users\Admin\AppData\Local\Temp\ef4788a45df8809851b18e5bfac1bad8fa8ea4850ac68fca2cca03b9b830a755.exe
"C:\Users\Admin\AppData\Local\Temp\ef4788a45df8809851b18e5bfac1bad8fa8ea4850ac68fca2cca03b9b830a755.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:668
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2256
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 608
    3⤵
    - Program crash
    PID:2796
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 600
    3⤵
    - Program crash
    PID:3644
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 668 -s 868
  2⤵
  - Program crash
  PID:4208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 668 -ip 668
1⤵
PID:3876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2256 -ip 2256
1⤵
PID:3932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2256 -ip 2256
1⤵
PID:4968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/668-9-0x0000000002DB0000-0x0000000004DB0000-memory.dmp

Download

memory/668-1-0x0000000075370000-0x0000000075B20000-memory.dmp

Download

memory/668-2-0x0000000005470000-0x0000000005480000-memory.dmp

Download

memory/668-0-0x00000000008A0000-0x000000000090E000-memory.dmp

Download

memory/668-11-0x0000000075370000-0x0000000075B20000-memory.dmp

Download

memory/2256-13-0x00000000038C0000-0x0000000003CC0000-memory.dmp

Download

memory/2256-27-0x00000000038C0000-0x0000000003CC0000-memory.dmp

Download

memory/2256-8-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2256-12-0x00000000038C0000-0x0000000003CC0000-memory.dmp

Download

memory/2256-14-0x00000000038C0000-0x0000000003CC0000-memory.dmp

Download

memory/2256-5-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2256-16-0x00007FFCC4990000-0x00007FFCC4B85000-memory.dmp

Download

memory/2256-15-0x00000000038C0000-0x0000000003CC0000-memory.dmp

Download

memory/2256-18-0x0000000077B60000-0x0000000077D75000-memory.dmp

Download

memory/2256-10-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4476-19-0x0000000001240000-0x0000000001249000-memory.dmp

Download

memory/4476-21-0x0000000002D80000-0x0000000003180000-memory.dmp

Download

memory/4476-24-0x0000000002D80000-0x0000000003180000-memory.dmp

Download

memory/4476-26-0x0000000077B60000-0x0000000077D75000-memory.dmp

Download

memory/4476-23-0x00007FFCC4990000-0x00007FFCC4B85000-memory.dmp

Download

memory/4476-22-0x0000000002D80000-0x0000000003180000-memory.dmp

Download

memory/4476-28-0x0000000002D80000-0x0000000003180000-memory.dmp

Download