rhadamanthys | 9d380a3292854ec2522aeef19e219ca54317569a7ef9bf0cf2d48c39d58af05c

Analysis

max time kernel
142s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2024, 04:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmp.exe
Size 444KB
Sample240405-ev8e2abh61
SHA256 9d380a3292854ec2522aeef19e219ca54317569a7ef9bf0cf2d48c39d58af05c
MD5 a067c2e81ba8dfd1561aa823fd3239b3
SHA1 08263f5e2a206bceeb91ed7ec071e1a96794e442
SHA512 f6808ff48d8d9a15344968e320e112ec784bccacac5282b48da287ce89363b79bd6151880cd4b46605401e434039618b5dd1bb42289adde906289295a1ed11c2
SSDEEP 12288:Dr8pdFOvnlmRxBXjhfDnf0HfO6Ix02mPc+Trr:DrpnlmRxBXNfDf50lZj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1116 created 2652	1116	RegAsm.exe	49

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1204 set thread context of 1116	1204	tmp.exe	98

Program crash 3 IoCs

pid	pid_target	Process	procid_target
3056	1116	WerFault.exe	98
4244	1204	WerFault.exe	94
4276	1116	WerFault.exe	98

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1116	RegAsm.exe
1116	RegAsm.exe
3484	dialer.exe
3484	dialer.exe
3484	dialer.exe
3484	dialer.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1116	1204	tmp.exe	98
PID 1204 wrote to memory of 1116	1204	tmp.exe	98
PID 1204 wrote to memory of 1116	1204	tmp.exe	98
PID 1204 wrote to memory of 1116	1204	tmp.exe	98
PID 1204 wrote to memory of 1116	1204	tmp.exe	98
PID 1204 wrote to memory of 1116	1204	tmp.exe	98
PID 1204 wrote to memory of 1116	1204	tmp.exe	98
PID 1204 wrote to memory of 1116	1204	tmp.exe	98
PID 1204 wrote to memory of 1116	1204	tmp.exe	98
PID 1204 wrote to memory of 1116	1204	tmp.exe	98
PID 1204 wrote to memory of 1116	1204	tmp.exe	98
PID 1116 wrote to memory of 3484	1116	RegAsm.exe	101
PID 1116 wrote to memory of 3484	1116	RegAsm.exe	101
PID 1116 wrote to memory of 3484	1116	RegAsm.exe	101
PID 1116 wrote to memory of 3484	1116	RegAsm.exe	101
PID 1116 wrote to memory of 3484	1116	RegAsm.exe	101

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2652
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3484

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1116 -s 592
    3⤵
    - Program crash
    PID:3056
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1116 -s 596
    3⤵
    - Program crash
    PID:4276
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 868
  2⤵
  - Program crash
  PID:4244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1204 -ip 1204
1⤵
PID:4180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1116 -ip 1116
1⤵
PID:3536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1116 -ip 1116
1⤵
PID:4312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4088 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:8
1⤵
PID:3468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1116-14-0x0000000003C70000-0x0000000004070000-memory.dmp

Download

memory/1116-16-0x00000000765F0000-0x0000000076805000-memory.dmp

Download

memory/1116-4-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1116-26-0x0000000003C70000-0x0000000004070000-memory.dmp

Download

memory/1116-8-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1116-9-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1116-10-0x0000000003C70000-0x0000000004070000-memory.dmp

Download

memory/1116-11-0x0000000003C70000-0x0000000004070000-memory.dmp

Download

memory/1116-13-0x00007FFCACDB0000-0x00007FFCACFA5000-memory.dmp

Download

memory/1116-12-0x0000000003C70000-0x0000000004070000-memory.dmp

Download

memory/1204-1-0x00000000002E0000-0x0000000000356000-memory.dmp

Download

memory/1204-0-0x0000000075310000-0x0000000075AC0000-memory.dmp

Download

memory/1204-6-0x0000000002770000-0x0000000004770000-memory.dmp

Download

memory/1204-27-0x0000000075310000-0x0000000075AC0000-memory.dmp

Download

memory/3484-17-0x00000000001C0000-0x00000000001C9000-memory.dmp

Download

memory/3484-20-0x0000000000AD0000-0x0000000000ED0000-memory.dmp

Download

memory/3484-21-0x00007FFCACDB0000-0x00007FFCACFA5000-memory.dmp

Download

memory/3484-22-0x0000000000AD0000-0x0000000000ED0000-memory.dmp

Download

memory/3484-24-0x00000000765F0000-0x0000000076805000-memory.dmp

Download

memory/3484-25-0x0000000000AD0000-0x0000000000ED0000-memory.dmp

Download