rhadamanthys | d8362d68a0b05f34630f57fcb3308f8c293c1002c338155a58a7531dca457cc4

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
10-04-2024 10:24

Target

2024-04-10_00b26ad812167d0b26c44566d9eb19eb_magniber.exe
Size

22.2MB
MD5

00b26ad812167d0b26c44566d9eb19eb
SHA1

b961421555304a3bb348978a08d25d9c7e93add6
SHA256

d8362d68a0b05f34630f57fcb3308f8c293c1002c338155a58a7531dca457cc4
SHA512

4c54e8d20d50033c2dea0bbe1e9a1d619015251b0b9e2202154a1253b9d22a363142785ed8e8fc5f7ae883525fd0153e10790fb46c23c976e9039eb8c9e2a2e6
SSDEEP

393216:G7ZbIAeJ3zJilTphDVOcjX2TEmENNW2T9D3NfUIfaetLLu6yvMdEmqNqS5:yNAlol9hxtXoBENYiD3j9LuBmbw

Score

10^/10

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2244 created 1336	2244	2024-04-10_00b26ad812167d0b26c44566d9eb19eb_magniber.exe	21

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2612	2244	2024-04-10_00b26ad812167d0b26c44566d9eb19eb_magniber.exe	28
PID 2244 wrote to memory of 2612	2244	2024-04-10_00b26ad812167d0b26c44566d9eb19eb_magniber.exe	28
PID 2244 wrote to memory of 2612	2244	2024-04-10_00b26ad812167d0b26c44566d9eb19eb_magniber.exe	28
PID 2244 wrote to memory of 2612	2244	2024-04-10_00b26ad812167d0b26c44566d9eb19eb_magniber.exe	28
PID 2244 wrote to memory of 2612	2244	2024-04-10_00b26ad812167d0b26c44566d9eb19eb_magniber.exe	28
PID 2244 wrote to memory of 2612	2244	2024-04-10_00b26ad812167d0b26c44566d9eb19eb_magniber.exe	28

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1336
- C:\Users\Admin\AppData\Local\Temp\2024-04-10_00b26ad812167d0b26c44566d9eb19eb_magniber.exe
  "C:\Users\Admin\AppData\Local\Temp\2024-04-10_00b26ad812167d0b26c44566d9eb19eb_magniber.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2244
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2612

memory/2244-9-0x0000000000920000-0x0000000000D20000-memory.dmp

Filesize
4.0MB

Download
memory/2244-7-0x0000000075F30000-0x0000000075F77000-memory.dmp

Filesize
284KB

Download
memory/2244-2-0x0000000000920000-0x0000000000D20000-memory.dmp

Filesize
4.0MB

Download
memory/2244-3-0x0000000000920000-0x0000000000D20000-memory.dmp

Filesize
4.0MB

Download
memory/2244-0-0x0000000000440000-0x00000000004AD000-memory.dmp

Filesize
436KB

Download
memory/2244-6-0x0000000000920000-0x0000000000D20000-memory.dmp

Filesize
4.0MB

Download
memory/2244-1-0x0000000000920000-0x0000000000D20000-memory.dmp

Filesize
4.0MB

Download
memory/2244-4-0x0000000076E90000-0x0000000077039000-memory.dmp

Filesize
1.7MB

Download
memory/2612-8-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/2612-12-0x0000000001D10000-0x0000000002110000-memory.dmp

Filesize
4.0MB

Download
memory/2612-11-0x0000000001D10000-0x0000000002110000-memory.dmp

Filesize
4.0MB

Download
memory/2612-14-0x0000000001D10000-0x0000000002110000-memory.dmp

Filesize
4.0MB

Download
memory/2612-13-0x0000000076E90000-0x0000000077039000-memory.dmp

Filesize
1.7MB

Download
memory/2612-17-0x0000000075F30000-0x0000000075F77000-memory.dmp

Filesize
284KB

Download
memory/2612-16-0x0000000076E90000-0x0000000077039000-memory.dmp

Filesize
1.7MB

Download
memory/2612-18-0x0000000001D10000-0x0000000002110000-memory.dmp

Filesize
4.0MB

Download