rhadamanthys | 6265ca0426b503618b3b48a5a423cb3d4798ab1208e8716aab8d5cee2cab9196

Analysis

max time kernel
93s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 16:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Launcher6.exe
Size 522KB
Sample240404-t671zacf81
SHA256 6265ca0426b503618b3b48a5a423cb3d4798ab1208e8716aab8d5cee2cab9196
MD5 019fbd8634db0f2b0ed63311956a72cf
SHA1 54af4f9d712ac5131d07fd29523a21fe970d93ab
SHA512 15be568f5f01caf9a0c12c43e32f1104397652619d306cd82ae28326bfe391664c98fd5c48e624736ab38c33c27d92b1678849acd7877b3555336b48a4383e1e
SSDEEP 6144:TXmSsdKbgJvF/zdzImDFtJnyf5BtY8NIFPQc0GLNaLXXFxL7SJ7Hr75zPgsCy0/X:NYKgR/FOftuSGwF57G9P6yvIYl9b2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rhadamanthys zgrat rat stealer

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral2/memory/4628-0-0x0000000000D40000-0x0000000000DC8000-memory.dmp	family_zgrat_v1

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2248 created 2832	2248	RegAsm.exe	50

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4628 set thread context of 2248	4628	Launcher6.exe	91

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3772	2248	WerFault.exe	91
1528	2248	WerFault.exe	91

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2248	RegAsm.exe
2248	RegAsm.exe
2376	dialer.exe
2376	dialer.exe
2376	dialer.exe
2376	dialer.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 2248	4628	Launcher6.exe	91
PID 4628 wrote to memory of 2248	4628	Launcher6.exe	91
PID 4628 wrote to memory of 2248	4628	Launcher6.exe	91
PID 4628 wrote to memory of 2248	4628	Launcher6.exe	91
PID 4628 wrote to memory of 2248	4628	Launcher6.exe	91
PID 4628 wrote to memory of 2248	4628	Launcher6.exe	91
PID 4628 wrote to memory of 2248	4628	Launcher6.exe	91
PID 4628 wrote to memory of 2248	4628	Launcher6.exe	91
PID 4628 wrote to memory of 2248	4628	Launcher6.exe	91
PID 4628 wrote to memory of 2248	4628	Launcher6.exe	91
PID 4628 wrote to memory of 2248	4628	Launcher6.exe	91
PID 2248 wrote to memory of 2376	2248	RegAsm.exe	93
PID 2248 wrote to memory of 2376	2248	RegAsm.exe	93
PID 2248 wrote to memory of 2376	2248	RegAsm.exe	93
PID 2248 wrote to memory of 2376	2248	RegAsm.exe	93
PID 2248 wrote to memory of 2376	2248	RegAsm.exe	93

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2832
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2376

C:\Users\Admin\AppData\Local\Temp\Launcher6.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2248
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2248 -s 592
    3⤵
    - Program crash
    PID:3772
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2248 -s 588
    3⤵
    - Program crash
    PID:1528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2248 -ip 2248
1⤵
PID:4172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2248 -ip 2248
1⤵
PID:3524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2248-16-0x00007FFE019B0000-0x00007FFE01BA5000-memory.dmp

Download

memory/2248-29-0x0000000003520000-0x0000000003920000-memory.dmp

Download

memory/2248-19-0x0000000075320000-0x0000000075535000-memory.dmp

Download

memory/2248-5-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2248-8-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2248-17-0x0000000003520000-0x0000000003920000-memory.dmp

Download

memory/2248-15-0x0000000003520000-0x0000000003920000-memory.dmp

Download

memory/2248-12-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2248-13-0x0000000003520000-0x0000000003920000-memory.dmp

Download

memory/2376-24-0x00007FFE019B0000-0x00007FFE01BA5000-memory.dmp

Download

memory/2376-20-0x00000000006B0000-0x00000000006B9000-memory.dmp

Download

memory/2376-23-0x00000000021F0000-0x00000000025F0000-memory.dmp

Download

memory/2376-26-0x00000000021F0000-0x00000000025F0000-memory.dmp

Download

memory/2376-27-0x0000000075320000-0x0000000075535000-memory.dmp

Download

memory/2376-28-0x00000000021F0000-0x00000000025F0000-memory.dmp

Download

memory/4628-11-0x0000000074680000-0x0000000074E30000-memory.dmp

Download

memory/4628-10-0x0000000003240000-0x0000000005240000-memory.dmp

Download

memory/4628-2-0x00000000057A0000-0x00000000057B0000-memory.dmp

Download

memory/4628-0-0x0000000000D40000-0x0000000000DC8000-memory.dmp

Download

memory/4628-1-0x0000000074680000-0x0000000074E30000-memory.dmp

Download