rhadamanthys | 093eaa30f92181cf717baafbaaa8fca87fe4690ae84f362fa2eb47338f95fbaa

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TEST.exe
Size 444KB
Sample240409-pc6tlahh61
SHA256 093eaa30f92181cf717baafbaaa8fca87fe4690ae84f362fa2eb47338f95fbaa
MD5 5461d3497db4439a50b893fe86b4722f
SHA1 32be93e40709722b85fa90f547e573a37aad814b
SHA512 596f2b37f80042f2e5be42b3b25d3af016336a306a476dfba5675026ff9d0536a909313a6a92ec143dea86011e2d9d03eeacddeb4b0d23d357604af03f884072
SSDEEP 12288:vhpdFOnCEz6CeZSaUgerd/HnW6MLmTdouVJEsUT:vKLd8erd/HnyL0w
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3536 created 2680	3536	RegAsm.exe	44

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4600 set thread context of 3536	4600	TEST.exe	86

Program crash 3 IoCs

pid	pid_target	Process	procid_target
3856	4600	WerFault.exe	84
4864	3536	WerFault.exe	86
2632	3536	WerFault.exe	86

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3536	RegAsm.exe
3536	RegAsm.exe
4044	dialer.exe
4044	dialer.exe
4044	dialer.exe
4044	dialer.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 3536	4600	TEST.exe	86
PID 4600 wrote to memory of 3536	4600	TEST.exe	86
PID 4600 wrote to memory of 3536	4600	TEST.exe	86
PID 4600 wrote to memory of 3536	4600	TEST.exe	86
PID 4600 wrote to memory of 3536	4600	TEST.exe	86
PID 4600 wrote to memory of 3536	4600	TEST.exe	86
PID 4600 wrote to memory of 3536	4600	TEST.exe	86
PID 4600 wrote to memory of 3536	4600	TEST.exe	86
PID 4600 wrote to memory of 3536	4600	TEST.exe	86
PID 4600 wrote to memory of 3536	4600	TEST.exe	86
PID 4600 wrote to memory of 3536	4600	TEST.exe	86
PID 3536 wrote to memory of 4044	3536	RegAsm.exe	93
PID 3536 wrote to memory of 4044	3536	RegAsm.exe	93
PID 3536 wrote to memory of 4044	3536	RegAsm.exe	93
PID 3536 wrote to memory of 4044	3536	RegAsm.exe	93
PID 3536 wrote to memory of 4044	3536	RegAsm.exe	93

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2680
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4044

C:\Users\Admin\AppData\Local\Temp\TEST.exe
"C:\Users\Admin\AppData\Local\Temp\TEST.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3536
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3536 -s 596
    3⤵
    - Program crash
    PID:4864
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3536 -s 592
    3⤵
    - Program crash
    PID:2632
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 868
  2⤵
  - Program crash
  PID:3856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4600 -ip 4600
1⤵
PID:2980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3536 -ip 3536
1⤵
PID:4024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3536 -ip 3536
1⤵
PID:4896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3536-14-0x00007FFFC2330000-0x00007FFFC2525000-memory.dmp

Download

memory/3536-16-0x00000000775F0000-0x0000000077805000-memory.dmp

Download

memory/3536-4-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3536-7-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3536-26-0x0000000003B60000-0x0000000003F60000-memory.dmp

Download

memory/3536-9-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3536-13-0x0000000003B60000-0x0000000003F60000-memory.dmp

Download

memory/3536-11-0x0000000003B60000-0x0000000003F60000-memory.dmp

Download

memory/3536-12-0x0000000003B60000-0x0000000003F60000-memory.dmp

Download

memory/3536-17-0x0000000003B60000-0x0000000003F60000-memory.dmp

Download

memory/4044-18-0x0000000000FD0000-0x0000000000FD9000-memory.dmp

Download

memory/4044-21-0x0000000002D70000-0x0000000003170000-memory.dmp

Download

memory/4044-22-0x00007FFFC2330000-0x00007FFFC2525000-memory.dmp

Download

memory/4044-24-0x0000000002D70000-0x0000000003170000-memory.dmp

Download

memory/4044-25-0x00000000775F0000-0x0000000077805000-memory.dmp

Download

memory/4044-27-0x0000000002D70000-0x0000000003170000-memory.dmp

Download

memory/4600-1-0x0000000074E50000-0x0000000075600000-memory.dmp

Download

memory/4600-0-0x0000000000460000-0x00000000004D6000-memory.dmp

Download

memory/4600-10-0x0000000074E50000-0x0000000075600000-memory.dmp

Download

memory/4600-8-0x0000000002AA0000-0x0000000004AA0000-memory.dmp

Download