Analysis
-
max time kernel
147s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240319-en -
resource tags
arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system -
submitted
05-04-2024 11:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
open.exe
Resource
win7-20240319-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
open.exe
Resource
win10v2004-20240319-en
4 signatures
150 seconds
General
-
Target
open.exe
-
Size
353KB
-
MD5
fe36f2fda53c21f8f7e06629cdcc377b
-
SHA1
3988d1e0628299d29ef39bbb7f24ee347933ab9b
-
SHA256
4fb58687a364c3f6d6f7e0ca03654f9dec0f8832a499d61d40b0d424db1b1b14
-
SHA512
fa56f2dcd9fb050718389458f892a8ba2efddb81d3b72e18221333cae245e2a475a52dbc58d6ab51e0e508a31922de60f42dbd2405c7f1e0d634e46fb6261689
-
SSDEEP
6144:IM4ypBt/6bC6p/8jJkJaVnQUKRnazBrRYJs3mb2stMK39V8s98ix2p:IM1t/6+6pWG8aRna9RYSQTXtV8s98E2
Score
10/10
Malware Config
Signatures
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
open.exedescription pid process target process PID 2568 created 2452 2568 open.exe sihost.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
open.exedialer.exepid process 2568 open.exe 2568 open.exe 768 dialer.exe 768 dialer.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
open.exedescription pid process target process PID 2568 wrote to memory of 768 2568 open.exe dialer.exe PID 2568 wrote to memory of 768 2568 open.exe dialer.exe PID 2568 wrote to memory of 768 2568 open.exe dialer.exe PID 2568 wrote to memory of 768 2568 open.exe dialer.exe
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2452
-
C:\Windows\system32\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:768
-
C:\Users\Admin\AppData\Local\Temp\open.exe"C:\Users\Admin\AppData\Local\Temp\open.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2568
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4140 --field-trial-handle=2228,i,8155065313278028490,17854605419281052753,262144 --variations-seed-version /prefetch:81⤵PID:4464