rhadamanthys | 7b4f73624fa6f3b155bd1adb5e32c703f4c7afb3120d2d3d0e1f36bf173687dc

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
03/04/2024, 01:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5d93c67ddde2e5fdc00a4e5777aa37d9ea4639227c633d044fb467b210640d28.exe
Size 386KB
Sample240403-b8p9tscd3t
SHA256 5d93c67ddde2e5fdc00a4e5777aa37d9ea4639227c633d044fb467b210640d28
MD5 cfd2733ba128f49a373042a1a6c3fe19
SHA1 5782fffc3d9e4d815fa0ec6315c5f237edfb9ae9
SHA512 be1a9fae4148cd6b567903f8fe707c1812d2782c8a718f81f6d30240c498f1aa5419f5fc22a318727a07e0e232c1538209743a97b9c01e5f4a679462ac2819d8
SSDEEP 12288:DHKzTnUs8oF7lWrf4p0fM5kzzLsK8Qll6V:DqzTUvEjCfMiHYMoV
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2068 created 2400	2068	RegAsm.exe	42

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2484 set thread context of 2068	2484	5d93c67ddde2e5fdc00a4e5777aa37d9ea4639227c633d044fb467b210640d28.exe	97

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2020	2484	WerFault.exe	94
1984	2068	WerFault.exe	97
720	2068	WerFault.exe	97

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2068	RegAsm.exe
2068	RegAsm.exe
2688	dialer.exe
2688	dialer.exe
2688	dialer.exe
2688	dialer.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 2068	2484	5d93c67ddde2e5fdc00a4e5777aa37d9ea4639227c633d044fb467b210640d28.exe	97
PID 2484 wrote to memory of 2068	2484	5d93c67ddde2e5fdc00a4e5777aa37d9ea4639227c633d044fb467b210640d28.exe	97
PID 2484 wrote to memory of 2068	2484	5d93c67ddde2e5fdc00a4e5777aa37d9ea4639227c633d044fb467b210640d28.exe	97
PID 2484 wrote to memory of 2068	2484	5d93c67ddde2e5fdc00a4e5777aa37d9ea4639227c633d044fb467b210640d28.exe	97
PID 2484 wrote to memory of 2068	2484	5d93c67ddde2e5fdc00a4e5777aa37d9ea4639227c633d044fb467b210640d28.exe	97
PID 2484 wrote to memory of 2068	2484	5d93c67ddde2e5fdc00a4e5777aa37d9ea4639227c633d044fb467b210640d28.exe	97
PID 2484 wrote to memory of 2068	2484	5d93c67ddde2e5fdc00a4e5777aa37d9ea4639227c633d044fb467b210640d28.exe	97
PID 2484 wrote to memory of 2068	2484	5d93c67ddde2e5fdc00a4e5777aa37d9ea4639227c633d044fb467b210640d28.exe	97
PID 2484 wrote to memory of 2068	2484	5d93c67ddde2e5fdc00a4e5777aa37d9ea4639227c633d044fb467b210640d28.exe	97
PID 2484 wrote to memory of 2068	2484	5d93c67ddde2e5fdc00a4e5777aa37d9ea4639227c633d044fb467b210640d28.exe	97
PID 2484 wrote to memory of 2068	2484	5d93c67ddde2e5fdc00a4e5777aa37d9ea4639227c633d044fb467b210640d28.exe	97
PID 2068 wrote to memory of 2688	2068	RegAsm.exe	104
PID 2068 wrote to memory of 2688	2068	RegAsm.exe	104
PID 2068 wrote to memory of 2688	2068	RegAsm.exe	104
PID 2068 wrote to memory of 2688	2068	RegAsm.exe	104
PID 2068 wrote to memory of 2688	2068	RegAsm.exe	104

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2400
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2688

C:\Users\Admin\AppData\Local\Temp\5d93c67ddde2e5fdc00a4e5777aa37d9ea4639227c633d044fb467b210640d28.exe
"C:\Users\Admin\AppData\Local\Temp\5d93c67ddde2e5fdc00a4e5777aa37d9ea4639227c633d044fb467b210640d28.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 568
    3⤵
    - Program crash
    PID:1984
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 584
    3⤵
    - Program crash
    PID:720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 824
  2⤵
  - Program crash
  PID:2020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2484 -ip 2484
1⤵
PID:4616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2068 -ip 2068
1⤵
PID:4292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2068 -ip 2068
1⤵
PID:3540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4968 --field-trial-handle=2276,i,5672504106535478802,17394903851940863593,262144 --variations-seed-version /prefetch:8
1⤵
PID:5020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2068-13-0x00007FFC60530000-0x00007FFC60725000-memory.dmp

Download

memory/2068-16-0x0000000076C90000-0x0000000076EA5000-memory.dmp

Download

memory/2068-4-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2068-25-0x0000000003470000-0x0000000003870000-memory.dmp

Download

memory/2068-7-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2068-9-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2068-10-0x0000000003470000-0x0000000003870000-memory.dmp

Download

memory/2068-11-0x0000000003470000-0x0000000003870000-memory.dmp

Download

memory/2068-12-0x0000000003470000-0x0000000003870000-memory.dmp

Download

memory/2068-14-0x0000000003470000-0x0000000003870000-memory.dmp

Download

memory/2484-1-0x00000000002C0000-0x0000000000322000-memory.dmp

Download

memory/2484-0-0x0000000075180000-0x0000000075930000-memory.dmp

Download

memory/2484-8-0x0000000002750000-0x0000000004750000-memory.dmp

Download

memory/2484-26-0x0000000075180000-0x0000000075930000-memory.dmp

Download

memory/2688-17-0x00000000007D0000-0x00000000007D9000-memory.dmp

Download

memory/2688-20-0x0000000002610000-0x0000000002A10000-memory.dmp

Download

memory/2688-19-0x0000000002610000-0x0000000002A10000-memory.dmp

Download

memory/2688-21-0x00007FFC60530000-0x00007FFC60725000-memory.dmp

Download

memory/2688-24-0x0000000076C90000-0x0000000076EA5000-memory.dmp

Download

memory/2688-23-0x0000000002610000-0x0000000002A10000-memory.dmp

Download

memory/2688-27-0x0000000002610000-0x0000000002A10000-memory.dmp

Download