Analysis
-
max time kernel
448s -
max time network
1172s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2024 02:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
RubixLauncher.exe
Resource
win10v2004-20231215-en
4 signatures
1800 seconds
General
-
Target
RubixLauncher.exe
-
Size
355KB
-
MD5
8a6f1580a5b9b94d7cd47cc6b1af1b9a
-
SHA1
e68768afd59e18091d345cb300e859572e8d4c5c
-
SHA256
bb1464e75c750d90c0c49d148c9e64eefe0c29b2f670d708c8085ddd3104dbfe
-
SHA512
1663a9e0868b3f5d7e1edd30259024e419c2d190ec8c31e76e66aef0c8a0e02da0c829584214b9e2f76cbd349a53bf77d01d03e9b0e9c8a99eb18021b1d53309
-
SSDEEP
6144:g2qezd2ab1/RuHk+M3k8M3W7XomjOJCqshrOlumY6DMIewgxQfqhsb:gf2R/EEkCQFYDwRqW
Score
10/10
Malware Config
Signatures
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
RubixLauncher.exedescription pid process target process PID 3984 created 2572 3984 RubixLauncher.exe sihost.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
RubixLauncher.exedialer.exepid process 3984 RubixLauncher.exe 3984 RubixLauncher.exe 2180 dialer.exe 2180 dialer.exe 2180 dialer.exe 2180 dialer.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
RubixLauncher.exedescription pid process target process PID 3984 wrote to memory of 2180 3984 RubixLauncher.exe dialer.exe PID 3984 wrote to memory of 2180 3984 RubixLauncher.exe dialer.exe PID 3984 wrote to memory of 2180 3984 RubixLauncher.exe dialer.exe PID 3984 wrote to memory of 2180 3984 RubixLauncher.exe dialer.exe PID 3984 wrote to memory of 2180 3984 RubixLauncher.exe dialer.exe
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2572
-
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2180
-
-
C:\Users\Admin\AppData\Local\Temp\RubixLauncher.exe"C:\Users\Admin\AppData\Local\Temp\RubixLauncher.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3984