Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05-04-2024 11:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
open.exe
Resource
win7-20240221-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
open.exe
Resource
win10v2004-20240226-en
5 signatures
150 seconds
General
-
Target
open.exe
-
Size
353KB
-
MD5
fe36f2fda53c21f8f7e06629cdcc377b
-
SHA1
3988d1e0628299d29ef39bbb7f24ee347933ab9b
-
SHA256
4fb58687a364c3f6d6f7e0ca03654f9dec0f8832a499d61d40b0d424db1b1b14
-
SHA512
fa56f2dcd9fb050718389458f892a8ba2efddb81d3b72e18221333cae245e2a475a52dbc58d6ab51e0e508a31922de60f42dbd2405c7f1e0d634e46fb6261689
-
SSDEEP
6144:IM4ypBt/6bC6p/8jJkJaVnQUKRnazBrRYJs3mb2stMK39V8s98ix2p:IM1t/6+6pWG8aRna9RYSQTXtV8s98E2
Score
10/10
Malware Config
Signatures
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
open.exedescription pid process target process PID 3936 created 2868 3936 open.exe sihost.exe -
Deletes itself 1 IoCs
Processes:
dialer.exepid process 468 dialer.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
open.exedialer.exepid process 3936 open.exe 3936 open.exe 468 dialer.exe 468 dialer.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
open.exedescription pid process target process PID 3936 wrote to memory of 468 3936 open.exe dialer.exe PID 3936 wrote to memory of 468 3936 open.exe dialer.exe PID 3936 wrote to memory of 468 3936 open.exe dialer.exe PID 3936 wrote to memory of 468 3936 open.exe dialer.exe
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2868
-
C:\Windows\system32\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
PID:468
-
C:\Users\Admin\AppData\Local\Temp\open.exe"C:\Users\Admin\AppData\Local\Temp\open.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3936