Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06-04-2024 01:15
Static task
static1
Behavioral task
behavioral1
Sample
4fb58687a364c3f6d6f7e0ca03654f9dec0f8832a499d61d40b0d424db1b1b14.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4fb58687a364c3f6d6f7e0ca03654f9dec0f8832a499d61d40b0d424db1b1b14.exe
Resource
win10v2004-20240226-en
General
-
Target
4fb58687a364c3f6d6f7e0ca03654f9dec0f8832a499d61d40b0d424db1b1b14.exe
-
Size
353KB
-
MD5
fe36f2fda53c21f8f7e06629cdcc377b
-
SHA1
3988d1e0628299d29ef39bbb7f24ee347933ab9b
-
SHA256
4fb58687a364c3f6d6f7e0ca03654f9dec0f8832a499d61d40b0d424db1b1b14
-
SHA512
fa56f2dcd9fb050718389458f892a8ba2efddb81d3b72e18221333cae245e2a475a52dbc58d6ab51e0e508a31922de60f42dbd2405c7f1e0d634e46fb6261689
-
SSDEEP
6144:IM4ypBt/6bC6p/8jJkJaVnQUKRnazBrRYJs3mb2stMK39V8s98ix2p:IM1t/6+6pWG8aRna9RYSQTXtV8s98E2
Malware Config
Signatures
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
4fb58687a364c3f6d6f7e0ca03654f9dec0f8832a499d61d40b0d424db1b1b14.exedescription pid process target process PID 2300 created 1216 2300 4fb58687a364c3f6d6f7e0ca03654f9dec0f8832a499d61d40b0d424db1b1b14.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
4fb58687a364c3f6d6f7e0ca03654f9dec0f8832a499d61d40b0d424db1b1b14.exedialer.exepid process 2300 4fb58687a364c3f6d6f7e0ca03654f9dec0f8832a499d61d40b0d424db1b1b14.exe 2300 4fb58687a364c3f6d6f7e0ca03654f9dec0f8832a499d61d40b0d424db1b1b14.exe 2616 dialer.exe 2616 dialer.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
4fb58687a364c3f6d6f7e0ca03654f9dec0f8832a499d61d40b0d424db1b1b14.exedescription pid process target process PID 2300 wrote to memory of 2616 2300 4fb58687a364c3f6d6f7e0ca03654f9dec0f8832a499d61d40b0d424db1b1b14.exe dialer.exe PID 2300 wrote to memory of 2616 2300 4fb58687a364c3f6d6f7e0ca03654f9dec0f8832a499d61d40b0d424db1b1b14.exe dialer.exe PID 2300 wrote to memory of 2616 2300 4fb58687a364c3f6d6f7e0ca03654f9dec0f8832a499d61d40b0d424db1b1b14.exe dialer.exe PID 2300 wrote to memory of 2616 2300 4fb58687a364c3f6d6f7e0ca03654f9dec0f8832a499d61d40b0d424db1b1b14.exe dialer.exe PID 2300 wrote to memory of 2616 2300 4fb58687a364c3f6d6f7e0ca03654f9dec0f8832a499d61d40b0d424db1b1b14.exe dialer.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\4fb58687a364c3f6d6f7e0ca03654f9dec0f8832a499d61d40b0d424db1b1b14.exe"C:\Users\Admin\AppData\Local\Temp\4fb58687a364c3f6d6f7e0ca03654f9dec0f8832a499d61d40b0d424db1b1b14.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\system32\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2616