rhadamanthys | c529cd95c0c85ca18df3e690f840e51d0be33b5b92f8bf1e9f91821eaedac68c

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2024, 20:22

Target

file.exe
Size

39KB
MD5

f1b14f71252de9ac763dbfbfbfc8c2dc
SHA1

dcc2dcb26c1649887f1d5ae557a000b5fe34bb98
SHA256

796ea1d27ed5825e300c3c9505a87b2445886623235f3e41258de90ba1604cd5
SHA512

636a32fb8a88a542783aa57fe047b6bca47b2bd23b41b3902671c4e9036c6dbb97576be27fd2395a988653e6b63714277873e077519b4a06cdc5f63d3c4224e0
SSDEEP

768:YRQnUhG5bZDOTpkdD82YbQkRFokFWIILPUh:FWObZDOTpk5T6zqAh

Score

10^/10

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 880 created 2572	880	file.exe	43

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 4484	880	file.exe	89
PID 880 wrote to memory of 4484	880	file.exe	89
PID 880 wrote to memory of 4484	880	file.exe	89
PID 880 wrote to memory of 4484	880	file.exe	89
PID 880 wrote to memory of 4484	880	file.exe	89

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2572
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4484

memory/880-7-0x0000000076660000-0x0000000076875000-memory.dmp

Filesize
2.1MB

Download
memory/880-1-0x00000000037A0000-0x0000000003BA0000-memory.dmp

Filesize
4.0MB

Download
memory/880-3-0x00000000037A0000-0x0000000003BA0000-memory.dmp

Filesize
4.0MB

Download
memory/880-2-0x00000000037A0000-0x0000000003BA0000-memory.dmp

Filesize
4.0MB

Download
memory/880-4-0x00007FFDAC4D0000-0x00007FFDAC6C5000-memory.dmp

Filesize
2.0MB

Download
memory/880-0-0x0000000000060000-0x00000000000C1000-memory.dmp

Filesize
388KB

Download
memory/880-5-0x00000000037A0000-0x0000000003BA0000-memory.dmp

Filesize
4.0MB

Download
memory/4484-8-0x0000000001260000-0x0000000001269000-memory.dmp

Filesize
36KB

Download
memory/4484-10-0x0000000002E00000-0x0000000003200000-memory.dmp

Filesize
4.0MB

Download
memory/4484-11-0x00007FFDAC4D0000-0x00007FFDAC6C5000-memory.dmp

Filesize
2.0MB

Download
memory/4484-14-0x0000000002E00000-0x0000000003200000-memory.dmp

Filesize
4.0MB

Download
memory/4484-13-0x0000000076660000-0x0000000076875000-memory.dmp

Filesize
2.1MB

Download
memory/4484-15-0x0000000002E00000-0x0000000003200000-memory.dmp

Filesize
4.0MB

Download