rhadamanthys | 391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c

Analysis

max time kernel
93s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 01:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe
Size 363KB
Sample240417-b4865sac48
SHA256 391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c
MD5 e720940033d0a875c83f019ee7418487
SHA1 872728a8b723b37735a5eaeb35516f747b6b4f17
SHA512 bb6aebe4e825c72460ff6cc6b6ac17a23033e0faff0ff7c8d2d0a6781459ef5044ff482410863b46dc5f683512e602f7a04a17528ee9d8292f24fddabbb31cdf
SSDEEP 6144:wORjQKzqpAnLBZzxKnCoPoMiqbk9MKbzZJR7oM79fI7L+ZQe0cczk:7YSnFLKnCoXiqbkusj9jC+QPccY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3196 created 2928	3196	RegAsm.exe	49

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3884 set thread context of 3196	3884	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	86

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1916	3196	WerFault.exe	86
4876	3196	WerFault.exe	86

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3196	RegAsm.exe
3196	RegAsm.exe
4164	dialer.exe
4164	dialer.exe
4164	dialer.exe
4164	dialer.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3884 wrote to memory of 3196	3884	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	86
PID 3884 wrote to memory of 3196	3884	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	86
PID 3884 wrote to memory of 3196	3884	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	86
PID 3884 wrote to memory of 3196	3884	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	86
PID 3884 wrote to memory of 3196	3884	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	86
PID 3884 wrote to memory of 3196	3884	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	86
PID 3884 wrote to memory of 3196	3884	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	86
PID 3884 wrote to memory of 3196	3884	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	86
PID 3884 wrote to memory of 3196	3884	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	86
PID 3884 wrote to memory of 3196	3884	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	86
PID 3884 wrote to memory of 3196	3884	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	86
PID 3196 wrote to memory of 4164	3196	RegAsm.exe	90
PID 3196 wrote to memory of 4164	3196	RegAsm.exe	90
PID 3196 wrote to memory of 4164	3196	RegAsm.exe	90
PID 3196 wrote to memory of 4164	3196	RegAsm.exe	90
PID 3196 wrote to memory of 4164	3196	RegAsm.exe	90

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2928
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4164

C:\Users\Admin\AppData\Local\Temp\391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe
"C:\Users\Admin\AppData\Local\Temp\391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3196
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 592
    3⤵
    - Program crash
    PID:1916
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 616
    3⤵
    - Program crash
    PID:4876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3196 -ip 3196
1⤵
PID:4352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3196 -ip 3196
1⤵
PID:2208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3196-15-0x00007FFC688F0000-0x00007FFC68AE5000-memory.dmp

Download

memory/3196-28-0x00000000036D0000-0x0000000003AD0000-memory.dmp

Download

memory/3196-4-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3196-7-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3196-18-0x0000000074EC0000-0x00000000750D5000-memory.dmp

Download

memory/3196-16-0x00000000036D0000-0x0000000003AD0000-memory.dmp

Download

memory/3196-11-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3196-12-0x00000000036D0000-0x0000000003AD0000-memory.dmp

Download

memory/3196-14-0x00000000036D0000-0x0000000003AD0000-memory.dmp

Download

memory/3884-9-0x0000000003200000-0x0000000005200000-memory.dmp

Download

memory/3884-0-0x0000000000E50000-0x0000000000EB2000-memory.dmp

Download

memory/3884-10-0x0000000074490000-0x0000000074C40000-memory.dmp

Download

memory/3884-1-0x0000000074490000-0x0000000074C40000-memory.dmp

Download

memory/4164-19-0x0000000000BF0000-0x0000000000BF9000-memory.dmp

Download

memory/4164-21-0x0000000002960000-0x0000000002D60000-memory.dmp

Download

memory/4164-22-0x0000000002960000-0x0000000002D60000-memory.dmp

Download

memory/4164-23-0x00007FFC688F0000-0x00007FFC68AE5000-memory.dmp

Download

memory/4164-24-0x0000000002960000-0x0000000002D60000-memory.dmp

Download

memory/4164-26-0x0000000074EC0000-0x00000000750D5000-memory.dmp

Download

memory/4164-27-0x0000000002960000-0x0000000002D60000-memory.dmp

Download