rhadamanthys | eadf182fea66ffbff741e2b6294120bf351da9abf0bb79ad389b418d2d84734f

Analysis

max time kernel
316s
max time network
377s
platform
windows10-1703_x64
resource
win10-20240404-es
resource tags

arch:x64arch:x86image:win10-20240404-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
07/04/2024, 19:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
connection1503.exe
Size 12.6MB
Sample240407-x69rcacf75
SHA256 e5b2c3589600b94cdb519463969a8681e4ef64aba232a685295a7b40923100b2
MD5 581b0aa6e72f52705401ef356920afe0
SHA1 b849456cdc15cf86bc5dc981185d80b5ad24c733
SHA512 5a99d27064cd02e93e9cc710c6e65779bf0039b47977c78f4170c8dfc4a8f50645a748ec22a1a2b0e659f6d6c4a763e4a8d44be35182dd646ba6875db128856e
SSDEEP 49152:jXPH/UtpgzUyWDO9RlfY3hrQIbFORgNlyOJPlGUtMf2WyISOkOH2BDZP8Ns2bPll:+uA5aAFORH+LP8TJjQElhaBuaj16R1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4588 created 2604	4588	BitLockerToGo.exe	44

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2380 set thread context of 4588	2380	connection1503.exe	73

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2356	4588	WerFault.exe	73
4944	4588	WerFault.exe	73

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4588	BitLockerToGo.exe
4588	BitLockerToGo.exe
1240	dialer.exe
1240	dialer.exe
1240	dialer.exe
1240	dialer.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 4588	2380	connection1503.exe	73
PID 2380 wrote to memory of 4588	2380	connection1503.exe	73
PID 2380 wrote to memory of 4588	2380	connection1503.exe	73
PID 2380 wrote to memory of 4588	2380	connection1503.exe	73
PID 2380 wrote to memory of 4588	2380	connection1503.exe	73
PID 4588 wrote to memory of 1240	4588	BitLockerToGo.exe	74
PID 4588 wrote to memory of 1240	4588	BitLockerToGo.exe	74
PID 4588 wrote to memory of 1240	4588	BitLockerToGo.exe	74
PID 4588 wrote to memory of 1240	4588	BitLockerToGo.exe	74
PID 4588 wrote to memory of 1240	4588	BitLockerToGo.exe	74

c:\windows\system32\sihost.exe
sihost.exe
1⤵
PID:2604
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1240

C:\Users\Admin\AppData\Local\Temp\connection1503.exe
"C:\Users\Admin\AppData\Local\Temp\connection1503.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 504
    3⤵
    - Program crash
    PID:2356
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 484
    3⤵
    - Program crash
    PID:4944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1240-17-0x0000000000460000-0x0000000000469000-memory.dmp

Download

memory/1240-27-0x0000000000B90000-0x0000000000F90000-memory.dmp

Download

memory/1240-25-0x0000000077600000-0x00000000777C2000-memory.dmp

Download

memory/1240-20-0x0000000000B90000-0x0000000000F90000-memory.dmp

Download

memory/1240-24-0x00007FFCA4400000-0x00007FFCA45DB000-memory.dmp

Download

memory/1240-22-0x0000000000B90000-0x0000000000F90000-memory.dmp

Download

memory/1240-21-0x00007FFCA4400000-0x00007FFCA45DB000-memory.dmp

Download

memory/2380-6-0x00007FF6E0CC0000-0x00007FF6E19EB000-memory.dmp

Download

memory/2380-4-0x00007FF6E0CC0000-0x00007FF6E19EB000-memory.dmp

Download

memory/4588-9-0x0000000002510000-0x000000000257D000-memory.dmp

Download

memory/4588-16-0x0000000077600000-0x00000000777C2000-memory.dmp

Download

memory/4588-14-0x00000000055E0000-0x00000000059E0000-memory.dmp

Download

memory/4588-13-0x00007FFCA4400000-0x00007FFCA45DB000-memory.dmp

Download

memory/4588-10-0x00000000055E0000-0x00000000059E0000-memory.dmp

Download

memory/4588-11-0x00000000055E0000-0x00000000059E0000-memory.dmp

Download

memory/4588-12-0x00000000055E0000-0x00000000059E0000-memory.dmp

Download

memory/4588-8-0x0000000002510000-0x000000000257D000-memory.dmp

Download

memory/4588-26-0x00000000055E0000-0x00000000059E0000-memory.dmp

Download

memory/4588-5-0x0000000002510000-0x000000000257D000-memory.dmp

Download