rhadamanthys | ef4788a45df8809851b18e5bfac1bad8fa8ea4850ac68fca2cca03b9b830a755

Analysis

max time kernel
92s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 20:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9b2a7e7f1001a3eaf7e83593d21a98ab.exe
Size 436KB
Sample240409-ytxfxsce5w
SHA256 ef4788a45df8809851b18e5bfac1bad8fa8ea4850ac68fca2cca03b9b830a755
MD5 9b2a7e7f1001a3eaf7e83593d21a98ab
SHA1 e280ff25a527a9d11a30f7223a78e08544d09c85
SHA512 5edaa8940c152b24dbee854d86dcae1b02dbbcf182642e7d87a97372c38c7c5c8e450078b490dc4564b197e0df14ad9a7dcec0d193a9ad9646fbb3c0a472f4df
SSDEEP 12288:Oc5wlzDj6o+EiB0LryUXQwwfsmo6Qjgdz7XlDOT:f5wl/wfsmoHjgdz78
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3824 created 2524	3824	RegAsm.exe	43

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3604 set thread context of 3824	3604	9b2a7e7f1001a3eaf7e83593d21a98ab.exe	87

Program crash 3 IoCs

pid	pid_target	Process	procid_target
3332	3604	WerFault.exe	84
1644	3824	WerFault.exe	87
1504	3824	WerFault.exe	87

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3824	RegAsm.exe
3824	RegAsm.exe
3204	dialer.exe
3204	dialer.exe
3204	dialer.exe
3204	dialer.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3604 wrote to memory of 3824	3604	9b2a7e7f1001a3eaf7e83593d21a98ab.exe	87
PID 3604 wrote to memory of 3824	3604	9b2a7e7f1001a3eaf7e83593d21a98ab.exe	87
PID 3604 wrote to memory of 3824	3604	9b2a7e7f1001a3eaf7e83593d21a98ab.exe	87
PID 3604 wrote to memory of 3824	3604	9b2a7e7f1001a3eaf7e83593d21a98ab.exe	87
PID 3604 wrote to memory of 3824	3604	9b2a7e7f1001a3eaf7e83593d21a98ab.exe	87
PID 3604 wrote to memory of 3824	3604	9b2a7e7f1001a3eaf7e83593d21a98ab.exe	87
PID 3604 wrote to memory of 3824	3604	9b2a7e7f1001a3eaf7e83593d21a98ab.exe	87
PID 3604 wrote to memory of 3824	3604	9b2a7e7f1001a3eaf7e83593d21a98ab.exe	87
PID 3604 wrote to memory of 3824	3604	9b2a7e7f1001a3eaf7e83593d21a98ab.exe	87
PID 3604 wrote to memory of 3824	3604	9b2a7e7f1001a3eaf7e83593d21a98ab.exe	87
PID 3604 wrote to memory of 3824	3604	9b2a7e7f1001a3eaf7e83593d21a98ab.exe	87
PID 3824 wrote to memory of 3204	3824	RegAsm.exe	94
PID 3824 wrote to memory of 3204	3824	RegAsm.exe	94
PID 3824 wrote to memory of 3204	3824	RegAsm.exe	94
PID 3824 wrote to memory of 3204	3824	RegAsm.exe	94
PID 3824 wrote to memory of 3204	3824	RegAsm.exe	94

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2524
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3204

C:\Users\Admin\AppData\Local\Temp\9b2a7e7f1001a3eaf7e83593d21a98ab.exe
"C:\Users\Admin\AppData\Local\Temp\9b2a7e7f1001a3eaf7e83593d21a98ab.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3604
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3824
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3824 -s 596
    3⤵
    - Program crash
    PID:1504
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3824 -s 592
    3⤵
    - Program crash
    PID:1644
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3604 -s 832
  2⤵
  - Program crash
  PID:3332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3604 -ip 3604
1⤵
PID:1508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3824 -ip 3824
1⤵
PID:3548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3824 -ip 3824
1⤵
PID:2448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3204-22-0x00000000029B0000-0x0000000002DB0000-memory.dmp

Download

memory/3204-19-0x0000000000B70000-0x0000000000B79000-memory.dmp

Download

memory/3204-23-0x00007FF871DD0000-0x00007FF871FC5000-memory.dmp

Download

memory/3204-25-0x00000000029B0000-0x0000000002DB0000-memory.dmp

Download

memory/3204-26-0x0000000075B30000-0x0000000075D45000-memory.dmp

Download

memory/3204-28-0x00000000029B0000-0x0000000002DB0000-memory.dmp

Download

memory/3204-21-0x00000000029B0000-0x0000000002DB0000-memory.dmp

Download

memory/3604-9-0x0000000002DD0000-0x0000000004DD0000-memory.dmp

Download

memory/3604-11-0x0000000074D50000-0x0000000075500000-memory.dmp

Download

memory/3604-1-0x0000000074D50000-0x0000000075500000-memory.dmp

Download

memory/3604-2-0x00000000053B0000-0x00000000053C0000-memory.dmp

Download

memory/3604-0-0x0000000000A50000-0x0000000000ABE000-memory.dmp

Download

memory/3824-27-0x0000000003EB0000-0x00000000042B0000-memory.dmp

Download

memory/3824-10-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3824-12-0x0000000003EB0000-0x00000000042B0000-memory.dmp

Download

memory/3824-17-0x0000000003EB0000-0x00000000042B0000-memory.dmp

Download

memory/3824-8-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3824-5-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3824-15-0x00007FF871DD0000-0x00007FF871FC5000-memory.dmp

Download

memory/3824-13-0x0000000003EB0000-0x00000000042B0000-memory.dmp

Download

memory/3824-18-0x0000000075B30000-0x0000000075D45000-memory.dmp

Download

memory/3824-14-0x0000000003EB0000-0x00000000042B0000-memory.dmp

Download