rhadamanthys | eadf182fea66ffbff741e2b6294120bf351da9abf0bb79ad389b418d2d84734f

Analysis

max time kernel
595s
max time network
608s
platform
windows10-2004_x64
resource
win10v2004-20240319-es
resource tags

arch:x64arch:x86image:win10v2004-20240319-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
07/04/2024, 19:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
connection1503.exe
Size 12.6MB
Sample240407-x69rcacf75
SHA256 e5b2c3589600b94cdb519463969a8681e4ef64aba232a685295a7b40923100b2
MD5 581b0aa6e72f52705401ef356920afe0
SHA1 b849456cdc15cf86bc5dc981185d80b5ad24c733
SHA512 5a99d27064cd02e93e9cc710c6e65779bf0039b47977c78f4170c8dfc4a8f50645a748ec22a1a2b0e659f6d6c4a763e4a8d44be35182dd646ba6875db128856e
SSDEEP 49152:jXPH/UtpgzUyWDO9RlfY3hrQIbFORgNlyOJPlGUtMf2WyISOkOH2BDZP8Ns2bPll:+uA5aAFORH+LP8TJjQElhaBuaj16R1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3296 created 3108	3296	BitLockerToGo.exe	52

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4300 set thread context of 3296	4300	connection1503.exe	103

Program crash 2 IoCs

pid	pid_target	Process	procid_target
456	3296	WerFault.exe	103
332	3296	WerFault.exe	103

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3296	BitLockerToGo.exe
3296	BitLockerToGo.exe
3696	dialer.exe
3696	dialer.exe
3696	dialer.exe
3696	dialer.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 3296	4300	connection1503.exe	103
PID 4300 wrote to memory of 3296	4300	connection1503.exe	103
PID 4300 wrote to memory of 3296	4300	connection1503.exe	103
PID 4300 wrote to memory of 3296	4300	connection1503.exe	103
PID 4300 wrote to memory of 3296	4300	connection1503.exe	103
PID 3296 wrote to memory of 3696	3296	BitLockerToGo.exe	119
PID 3296 wrote to memory of 3696	3296	BitLockerToGo.exe	119
PID 3296 wrote to memory of 3696	3296	BitLockerToGo.exe	119
PID 3296 wrote to memory of 3696	3296	BitLockerToGo.exe	119
PID 3296 wrote to memory of 3696	3296	BitLockerToGo.exe	119

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:3108
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3696

C:\Users\Admin\AppData\Local\Temp\connection1503.exe
"C:\Users\Admin\AppData\Local\Temp\connection1503.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3296
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3296 -s 424
    3⤵
    - Program crash
    PID:456
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3296 -s 408
    3⤵
    - Program crash
    PID:332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4120 --field-trial-handle=2228,i,14525059162927627154,14514372337438120609,262144 --variations-seed-version /prefetch:8
1⤵
PID:2328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4896 --field-trial-handle=2228,i,14525059162927627154,14514372337438120609,262144 --variations-seed-version /prefetch:8
1⤵
PID:3176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3296 -ip 3296
1⤵
PID:1224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3296 -ip 3296
1⤵
PID:4764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3296-13-0x00007FFB3B930000-0x00007FFB3BB25000-memory.dmp

Download

memory/3296-15-0x0000000003470000-0x0000000003870000-memory.dmp

Download

memory/3296-25-0x0000000003470000-0x0000000003870000-memory.dmp

Download

memory/3296-16-0x0000000077230000-0x0000000077445000-memory.dmp

Download

memory/3296-9-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3296-10-0x0000000003470000-0x0000000003870000-memory.dmp

Download

memory/3296-11-0x0000000003470000-0x0000000003870000-memory.dmp

Download

memory/3296-12-0x0000000003470000-0x0000000003870000-memory.dmp

Download

memory/3296-5-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3296-8-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3696-17-0x0000000000340000-0x0000000000349000-memory.dmp

Download

memory/3696-19-0x0000000002230000-0x0000000002630000-memory.dmp

Download

memory/3696-20-0x0000000002230000-0x0000000002630000-memory.dmp

Download

memory/3696-21-0x00007FFB3B930000-0x00007FFB3BB25000-memory.dmp

Download

memory/3696-23-0x0000000002230000-0x0000000002630000-memory.dmp

Download

memory/3696-24-0x0000000077230000-0x0000000077445000-memory.dmp

Download

memory/3696-26-0x0000000002230000-0x0000000002630000-memory.dmp

Download

memory/4300-2-0x00007FF6FAEF0000-0x00007FF6FBC1B000-memory.dmp

Download

memory/4300-6-0x00007FF6FAEF0000-0x00007FF6FBC1B000-memory.dmp

Download