Analysis
- max time kernel
92s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - submitted
09/04/2024, 13:03
General
- Target app.exe
- Size 353KB
- Sample240409-qaccmsff65
- SHA256 29f8b50f737feef9ec7439780daead395bf2bf278a4540ddffe64ca70aa9f462
Malware Config
Extracted
-
rhadamanthys
-
https://77.221.137.22/a8bdd0312f3daae757dcbbe2/s7gxggiw.fsc1l
Signatures
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
- Rhadamanthys family
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\app.exe"C:\Users\Admin\AppData\Local\Temp\app.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1520-12-0x0000021277060000-0x0000021277069000-memory.dmp
memory/1520-23-0x0000021278BB0000-0x0000021278FB0000-memory.dmp
memory/1520-22-0x00007FF8E3D40000-0x00007FF8E4009000-memory.dmp
memory/1520-20-0x0000021278BB0000-0x0000021278FB0000-memory.dmp
memory/1520-21-0x00007FF8E50C0000-0x00007FF8E517E000-memory.dmp
memory/1520-19-0x00007FF8E6450000-0x00007FF8E6645000-memory.dmp
memory/1520-17-0x0000021278BB0000-0x0000021278FB0000-memory.dmp
memory/1520-16-0x0000021278BB0000-0x0000021278FB0000-memory.dmp
memory/4272-3-0x000000001B070000-0x000000001B470000-memory.dmp
memory/4272-6-0x000000001B070000-0x000000001B470000-memory.dmp
memory/4272-9-0x000000001B070000-0x000000001B470000-memory.dmp
memory/4272-11-0x00007FF8E3D40000-0x00007FF8E4009000-memory.dmp
memory/4272-8-0x00007FF8E6450000-0x00007FF8E6645000-memory.dmp
memory/4272-15-0x000000001B070000-0x000000001B470000-memory.dmp
memory/4272-7-0x000000001AF60000-0x000000001AF70000-memory.dmp
memory/4272-10-0x00007FF8E50C0000-0x00007FF8E517E000-memory.dmp
memory/4272-18-0x00007FF8C8190000-0x00007FF8C8C51000-memory.dmp
memory/4272-0-0x0000000000210000-0x000000000026E000-memory.dmp
memory/4272-5-0x00000000024E0000-0x00000000024F0000-memory.dmp
memory/4272-4-0x00007FF8C8190000-0x00007FF8C8C51000-memory.dmp
memory/4272-2-0x000000001B070000-0x000000001B470000-memory.dmp
memory/4272-1-0x00000000024E0000-0x00000000024F0000-memory.dmp