rhadamanthys | fda3dd5344e004dc209fe24b2e383fbef569e11dc14f0d02c2051e8a69c80427

Analysis

max time kernel
91s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 18:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FortniteFPS.exe
Size 444KB
Sample240404-xk562aga64
SHA256 fda3dd5344e004dc209fe24b2e383fbef569e11dc14f0d02c2051e8a69c80427
MD5 ed8f9d380212722ab220453cf5c64524
SHA1 e7cf9a672de8766bb9db767f4b3aaf3a7a0f6b10
SHA512 137a381f40c6db23580350322ddbc2930504dac23b693611ff975efa042fe4ba24587580339c27664eae0ae3c63278dc00e11aa82db6b9acceb0dd806f0c37c8
SSDEEP 12288:khpdFOiCa+pp6DkqebgShtFRvKAOjzEcaY6RqTWmHH:kSa+E9SzFRy7jzEcB6UK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3296 created 2648	3296	RegAsm.exe	45

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 436 set thread context of 3296	436	FortniteFPS.exe	87

Program crash 3 IoCs

pid	pid_target	Process	procid_target
3928	436	WerFault.exe	84
2352	3296	WerFault.exe	87
2036	3296	WerFault.exe	87

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3296	RegAsm.exe
3296	RegAsm.exe
4400	dialer.exe
4400	dialer.exe
4400	dialer.exe
4400	dialer.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 436 wrote to memory of 2420	436	FortniteFPS.exe	86
PID 436 wrote to memory of 2420	436	FortniteFPS.exe	86
PID 436 wrote to memory of 2420	436	FortniteFPS.exe	86
PID 436 wrote to memory of 3296	436	FortniteFPS.exe	87
PID 436 wrote to memory of 3296	436	FortniteFPS.exe	87
PID 436 wrote to memory of 3296	436	FortniteFPS.exe	87
PID 436 wrote to memory of 3296	436	FortniteFPS.exe	87
PID 436 wrote to memory of 3296	436	FortniteFPS.exe	87
PID 436 wrote to memory of 3296	436	FortniteFPS.exe	87
PID 436 wrote to memory of 3296	436	FortniteFPS.exe	87
PID 436 wrote to memory of 3296	436	FortniteFPS.exe	87
PID 436 wrote to memory of 3296	436	FortniteFPS.exe	87
PID 436 wrote to memory of 3296	436	FortniteFPS.exe	87
PID 436 wrote to memory of 3296	436	FortniteFPS.exe	87
PID 3296 wrote to memory of 4400	3296	RegAsm.exe	91
PID 3296 wrote to memory of 4400	3296	RegAsm.exe	91
PID 3296 wrote to memory of 4400	3296	RegAsm.exe	91
PID 3296 wrote to memory of 4400	3296	RegAsm.exe	91
PID 3296 wrote to memory of 4400	3296	RegAsm.exe	91

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2648
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4400

C:\Users\Admin\AppData\Local\Temp\FortniteFPS.exe
"C:\Users\Admin\AppData\Local\Temp\FortniteFPS.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:436
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2420
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3296
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3296 -s 600
    3⤵
    - Program crash
    PID:2352
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3296 -s 596
    3⤵
    - Program crash
    PID:2036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 436 -s 876
  2⤵
  - Program crash
  PID:3928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 436 -ip 436
1⤵
PID:2584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3296 -ip 3296
1⤵
PID:4344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3296 -ip 3296
1⤵
PID:216

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/436-8-0x0000000002A30000-0x0000000004A30000-memory.dmp

Download

memory/436-1-0x0000000074730000-0x0000000074EE0000-memory.dmp

Download

memory/436-0-0x00000000005B0000-0x0000000000626000-memory.dmp

Download

memory/436-10-0x0000000074730000-0x0000000074EE0000-memory.dmp

Download

memory/3296-14-0x00007FF8D54D0000-0x00007FF8D56C5000-memory.dmp

Download

memory/3296-22-0x0000000003B50000-0x0000000003F50000-memory.dmp

Download

memory/3296-7-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3296-11-0x0000000003B50000-0x0000000003F50000-memory.dmp

Download

memory/3296-12-0x0000000003B50000-0x0000000003F50000-memory.dmp

Download

memory/3296-13-0x0000000003B50000-0x0000000003F50000-memory.dmp

Download

memory/3296-4-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3296-16-0x0000000075B00000-0x0000000075D15000-memory.dmp

Download

memory/3296-17-0x0000000003B50000-0x0000000003F50000-memory.dmp

Download

memory/3296-9-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4400-18-0x0000000000CA0000-0x0000000000CA9000-memory.dmp

Download

memory/4400-20-0x00000000028D0000-0x0000000002CD0000-memory.dmp

Download

memory/4400-21-0x00000000028D0000-0x0000000002CD0000-memory.dmp

Download

memory/4400-23-0x00007FF8D54D0000-0x00007FF8D56C5000-memory.dmp

Download

memory/4400-24-0x00000000028D0000-0x0000000002CD0000-memory.dmp

Download

memory/4400-26-0x0000000075B00000-0x0000000075D15000-memory.dmp

Download

memory/4400-27-0x00000000028D0000-0x0000000002CD0000-memory.dmp

Download