Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05-04-2024 11:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
open.exe
Resource
win7-20240221-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
open.exe
Resource
win10v2004-20240226-en
5 signatures
150 seconds
General
-
Target
open.exe
-
Size
353KB
-
MD5
fe36f2fda53c21f8f7e06629cdcc377b
-
SHA1
3988d1e0628299d29ef39bbb7f24ee347933ab9b
-
SHA256
4fb58687a364c3f6d6f7e0ca03654f9dec0f8832a499d61d40b0d424db1b1b14
-
SHA512
fa56f2dcd9fb050718389458f892a8ba2efddb81d3b72e18221333cae245e2a475a52dbc58d6ab51e0e508a31922de60f42dbd2405c7f1e0d634e46fb6261689
-
SSDEEP
6144:IM4ypBt/6bC6p/8jJkJaVnQUKRnazBrRYJs3mb2stMK39V8s98ix2p:IM1t/6+6pWG8aRna9RYSQTXtV8s98E2
Score
10/10
Malware Config
Signatures
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
open.exedescription pid process target process PID 2176 created 1192 2176 open.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
open.exedialer.exepid process 2176 open.exe 2176 open.exe 2268 dialer.exe 2268 dialer.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
open.exedescription pid process target process PID 2176 wrote to memory of 2268 2176 open.exe dialer.exe PID 2176 wrote to memory of 2268 2176 open.exe dialer.exe PID 2176 wrote to memory of 2268 2176 open.exe dialer.exe PID 2176 wrote to memory of 2268 2176 open.exe dialer.exe PID 2176 wrote to memory of 2268 2176 open.exe dialer.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\open.exe"C:\Users\Admin\AppData\Local\Temp\open.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Windows\system32\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2268