rhadamanthys | 4fb58687a364c3f6d6f7e0ca03654f9dec0f8832a499d61d40b0d424db1b1b14

Analysis

max time kernel
114s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2024, 13:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

05042024_2141_DOC7096 - 70967096.exe
Size

353KB
MD5

fe36f2fda53c21f8f7e06629cdcc377b
SHA1

3988d1e0628299d29ef39bbb7f24ee347933ab9b
SHA256

4fb58687a364c3f6d6f7e0ca03654f9dec0f8832a499d61d40b0d424db1b1b14
SHA512

fa56f2dcd9fb050718389458f892a8ba2efddb81d3b72e18221333cae245e2a475a52dbc58d6ab51e0e508a31922de60f42dbd2405c7f1e0d634e46fb6261689
SSDEEP

6144:IM4ypBt/6bC6p/8jJkJaVnQUKRnazBrRYJs3mb2stMK39V8s98ix2p:IM1t/6+6pWG8aRna9RYSQTXtV8s98E2

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2316 created 2636	2316	05042024_2141_DOC7096 - 70967096.exe	45

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2316	05042024_2141_DOC7096 - 70967096.exe
2316	05042024_2141_DOC7096 - 70967096.exe
5008	dialer.exe
5008	dialer.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 5008	2316	05042024_2141_DOC7096 - 70967096.exe	91
PID 2316 wrote to memory of 5008	2316	05042024_2141_DOC7096 - 70967096.exe	91
PID 2316 wrote to memory of 5008	2316	05042024_2141_DOC7096 - 70967096.exe	91
PID 2316 wrote to memory of 5008	2316	05042024_2141_DOC7096 - 70967096.exe	91

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2636
- C:\Windows\system32\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5008

C:\Users\Admin\AppData\Local\Temp\05042024_2141_DOC7096 - 70967096.exe
"C:\Users\Admin\AppData\Local\Temp\05042024_2141_DOC7096 - 70967096.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5092 --field-trial-handle=2284,i,2771196087253062161,8107167670425198948,262144 --variations-seed-version /prefetch:8
1⤵
PID:4500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2316-9-0x000000001B3E0000-0x000000001B7E0000-memory.dmp

Filesize
4.0MB

Download
memory/2316-11-0x00007FF908E70000-0x00007FF909139000-memory.dmp

Filesize
2.8MB

Download
memory/2316-2-0x000000001B3E0000-0x000000001B7E0000-memory.dmp

Filesize
4.0MB

Download
memory/2316-4-0x00007FF8EB770000-0x00007FF8EC231000-memory.dmp

Filesize
10.8MB

Download
memory/2316-5-0x00000000026C0000-0x00000000026D0000-memory.dmp

Filesize
64KB

Download
memory/2316-6-0x000000001B3E0000-0x000000001B7E0000-memory.dmp

Filesize
4.0MB

Download
memory/2316-3-0x000000001B3E0000-0x000000001B7E0000-memory.dmp

Filesize
4.0MB

Download
memory/2316-7-0x000000001B350000-0x000000001B360000-memory.dmp

Filesize
64KB

Download
memory/2316-8-0x00007FF90B230000-0x00007FF90B425000-memory.dmp

Filesize
2.0MB

Download
memory/2316-10-0x00007FF909340000-0x00007FF9093FE000-memory.dmp

Filesize
760KB

Download
memory/2316-1-0x00000000026C0000-0x00000000026D0000-memory.dmp

Filesize
64KB

Download
memory/2316-18-0x00007FF8EB770000-0x00007FF8EC231000-memory.dmp

Filesize
10.8MB

Download
memory/2316-0-0x0000000000610000-0x000000000066E000-memory.dmp

Filesize
376KB

Download
memory/2316-15-0x000000001B3E0000-0x000000001B7E0000-memory.dmp

Filesize
4.0MB

Download
memory/5008-17-0x000002C69F0D0000-0x000002C69F4D0000-memory.dmp

Filesize
4.0MB

Download
memory/5008-12-0x000002C69D5E0000-0x000002C69D5E9000-memory.dmp

Filesize
36KB

Download
memory/5008-19-0x000002C69F0D0000-0x000002C69F4D0000-memory.dmp

Filesize
4.0MB

Download
memory/5008-21-0x00007FF909340000-0x00007FF9093FE000-memory.dmp

Filesize
760KB

Download
memory/5008-20-0x00007FF90B230000-0x00007FF90B425000-memory.dmp

Filesize
2.0MB

Download
memory/5008-22-0x00007FF908E70000-0x00007FF909139000-memory.dmp

Filesize
2.8MB

Download
memory/5008-23-0x000002C69F0D0000-0x000002C69F4D0000-memory.dmp

Filesize
4.0MB

Download