rhadamanthys | d671593564859879c1864906762f67c6b90efa92595ba4a0ad243a0a7be25c27

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 09:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
connection1503.exe
Size 43.9MB
Sample240404-lk8flsbe41
SHA256 97ad9ec5accd668882437d7af85ed8c5228fb2f5ceb035ebd15a569eb10ee957
MD5 43430554370c916d462360e4f99ce14e
SHA1 d8a319a2927bc70008d807f65c0b085424e17fde
SHA512 38aa7550e1babd193e19967a175c3986daaa7366bcbe621893f6eda2250d80feff63f2c26ffe39d225e9f6186dcfe40e44fb653e25c5419cbbc2dc2f998bd6e1
SSDEEP 196608:vchI3nkY+Za8caFGzCQJ2xo3NDeZfMITDFAi7xz19Adyah/tv:0S3kYckaFgso3ND4VFAQz12dttv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4900 created 2540	4900	BitLockerToGo.exe	45

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1008 set thread context of 4900	1008	connection1503.exe	95

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4964	4900	WerFault.exe	95
3092	4900	WerFault.exe	95

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4900	BitLockerToGo.exe
4900	BitLockerToGo.exe
860	dialer.exe
860	dialer.exe
860	dialer.exe
860	dialer.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 4900	1008	connection1503.exe	95
PID 1008 wrote to memory of 4900	1008	connection1503.exe	95
PID 1008 wrote to memory of 4900	1008	connection1503.exe	95
PID 1008 wrote to memory of 4900	1008	connection1503.exe	95
PID 1008 wrote to memory of 4900	1008	connection1503.exe	95
PID 4900 wrote to memory of 860	4900	BitLockerToGo.exe	96
PID 4900 wrote to memory of 860	4900	BitLockerToGo.exe	96
PID 4900 wrote to memory of 860	4900	BitLockerToGo.exe	96
PID 4900 wrote to memory of 860	4900	BitLockerToGo.exe	96
PID 4900 wrote to memory of 860	4900	BitLockerToGo.exe	96

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2540
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:860

C:\Users\Admin\AppData\Local\Temp\connection1503.exe
"C:\Users\Admin\AppData\Local\Temp\connection1503.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4900 -s 424
    3⤵
    - Program crash
    PID:4964
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4900 -s 440
    3⤵
    - Program crash
    PID:3092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4900 -ip 4900
1⤵
PID:4712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4900 -ip 4900
1⤵
PID:4912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/860-17-0x00000000009A0000-0x00000000009A9000-memory.dmp

Download

memory/860-26-0x00000000027C0000-0x0000000002BC0000-memory.dmp

Download

memory/860-24-0x00000000767E0000-0x00000000769F5000-memory.dmp

Download

memory/860-22-0x00000000027C0000-0x0000000002BC0000-memory.dmp

Download

memory/860-21-0x00007FFE3D090000-0x00007FFE3D285000-memory.dmp

Download

memory/860-20-0x00000000027C0000-0x0000000002BC0000-memory.dmp

Download

memory/860-19-0x00000000027C0000-0x0000000002BC0000-memory.dmp

Download

memory/1008-6-0x00007FF64F820000-0x00007FF6524AF000-memory.dmp

Download

memory/1008-2-0x00007FF64F820000-0x00007FF6524AF000-memory.dmp

Download

memory/4900-13-0x00007FFE3D090000-0x00007FFE3D285000-memory.dmp

Download

memory/4900-15-0x0000000003EE0000-0x00000000042E0000-memory.dmp

Download

memory/4900-16-0x00000000767E0000-0x00000000769F5000-memory.dmp

Download

memory/4900-12-0x0000000003EE0000-0x00000000042E0000-memory.dmp

Download

memory/4900-11-0x0000000003EE0000-0x00000000042E0000-memory.dmp

Download

memory/4900-10-0x0000000003EE0000-0x00000000042E0000-memory.dmp

Download

memory/4900-9-0x0000000000EB0000-0x0000000000F1D000-memory.dmp

Download

memory/4900-8-0x0000000000EB0000-0x0000000000F1D000-memory.dmp

Download

memory/4900-25-0x0000000003EE0000-0x00000000042E0000-memory.dmp

Download

memory/4900-5-0x0000000000EB0000-0x0000000000F1D000-memory.dmp

Download