Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240319-en -
resource tags
arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system -
submitted
05-04-2024 15:56
Static task
static1
Behavioral task
behavioral1
Sample
redist.zip
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
redist.zip
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
buildrhadha.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
buildrhadha.exe
Resource
win10v2004-20240319-en
Behavioral task
behavioral5
Sample
data.bin
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
data.bin
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
g2m.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
g2m.dll
Resource
win10v2004-20240226-en
General
-
Target
buildrhadha.exe
-
Size
39KB
-
MD5
f1b14f71252de9ac763dbfbfbfc8c2dc
-
SHA1
dcc2dcb26c1649887f1d5ae557a000b5fe34bb98
-
SHA256
796ea1d27ed5825e300c3c9505a87b2445886623235f3e41258de90ba1604cd5
-
SHA512
636a32fb8a88a542783aa57fe047b6bca47b2bd23b41b3902671c4e9036c6dbb97576be27fd2395a988653e6b63714277873e077519b4a06cdc5f63d3c4224e0
-
SSDEEP
768:YRQnUhG5bZDOTpkdD82YbQkRFokFWIILPUh:FWObZDOTpk5T6zqAh
Malware Config
Signatures
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
buildrhadha.exedescription pid process target process PID 4080 created 2660 4080 buildrhadha.exe sihost.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
buildrhadha.exedialer.exepid process 4080 buildrhadha.exe 4080 buildrhadha.exe 3600 dialer.exe 3600 dialer.exe 3600 dialer.exe 3600 dialer.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
buildrhadha.exedescription pid process target process PID 4080 wrote to memory of 3600 4080 buildrhadha.exe dialer.exe PID 4080 wrote to memory of 3600 4080 buildrhadha.exe dialer.exe PID 4080 wrote to memory of 3600 4080 buildrhadha.exe dialer.exe PID 4080 wrote to memory of 3600 4080 buildrhadha.exe dialer.exe PID 4080 wrote to memory of 3600 4080 buildrhadha.exe dialer.exe
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2660
-
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3600
-
C:\Users\Admin\AppData\Local\Temp\buildrhadha.exe"C:\Users\Admin\AppData\Local\Temp\buildrhadha.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4080
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4140 --field-trial-handle=2320,i,3025503729105798828,9325691672526736153,262144 --variations-seed-version /prefetch:81⤵PID:1836