rhadamanthys | f12f784ecc9c86111f82c2deed84facffa8761629b9604eabbc7e89aa3157c45

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 13:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HEARTB.dll
Size 762.9MB
Sample240417-qjwsmsha69
SHA256 4c10fd9d4054a3454750bcd9a130e3d852644e821fd18396f89deefa9ab3c75a
MD5 29655ea1367ead030a3bf40659327ca0
SHA1 d176cc3048e0727f2b81ea027b039bbde85db3e3
SHA512 b6e79c239097869eac20ee931171ab540f646752f498009c97a19fa4e83a96b8fbc85ae8a9bd5b49105de489ce45adada2b00620c016ae3b0ab81e60faee5144
SSDEEP 98304:oDHQXidDnBW0hcthSDnqDO5rzRQfaxcxVtn:oui9gDmyhrn
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1288 created 2608	1288	regsvr32.exe	44

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
4964	regsvr32.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
760	1288	WerFault.exe	88
2740	1288	WerFault.exe	88

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1288	regsvr32.exe
1288	regsvr32.exe
1964	dialer.exe
1964	dialer.exe
1964	dialer.exe
1964	dialer.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 4964	2708	regsvr32.exe	85
PID 2708 wrote to memory of 4964	2708	regsvr32.exe	85
PID 2708 wrote to memory of 4964	2708	regsvr32.exe	85
PID 4964 wrote to memory of 1288	4964	regsvr32.exe	88
PID 4964 wrote to memory of 1288	4964	regsvr32.exe	88
PID 4964 wrote to memory of 1288	4964	regsvr32.exe	88
PID 4964 wrote to memory of 1288	4964	regsvr32.exe	88
PID 4964 wrote to memory of 1288	4964	regsvr32.exe	88
PID 4964 wrote to memory of 1288	4964	regsvr32.exe	88
PID 1288 wrote to memory of 1964	1288	regsvr32.exe	89
PID 1288 wrote to memory of 1964	1288	regsvr32.exe	89
PID 1288 wrote to memory of 1964	1288	regsvr32.exe	89
PID 1288 wrote to memory of 1964	1288	regsvr32.exe	89
PID 1288 wrote to memory of 1964	1288	regsvr32.exe	89

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2608
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1964

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\HEARTB.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\HEARTB.dll
  2⤵
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\SysWOW64\regsvr32.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1288
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 596
      4⤵
      Program crash
      PID:760
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 592
      4⤵
      Program crash
      PID:2740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1288 -ip 1288
1⤵
PID:2260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1288 -ip 1288
1⤵
PID:216

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1288-13-0x0000000003260000-0x0000000003660000-memory.dmp

Download

memory/1288-10-0x0000000000190000-0x00000000001FD000-memory.dmp

Download

memory/1288-27-0x0000000003260000-0x0000000003660000-memory.dmp

Download

memory/1288-17-0x0000000076FF0000-0x0000000077205000-memory.dmp

Download

memory/1288-3-0x0000000000400000-0x0000000000401000-memory.dmp

Download

memory/1288-8-0x0000000000190000-0x00000000001FD000-memory.dmp

Download

memory/1288-9-0x0000000000190000-0x00000000001FD000-memory.dmp

Download

memory/1288-14-0x00007FFE1BA30000-0x00007FFE1BC25000-memory.dmp

Download

memory/1288-12-0x0000000003260000-0x0000000003660000-memory.dmp

Download

memory/1288-11-0x0000000003260000-0x0000000003660000-memory.dmp

Download

memory/1288-16-0x0000000003260000-0x0000000003660000-memory.dmp

Download

memory/1964-18-0x00000000005A0000-0x00000000005A9000-memory.dmp

Download

memory/1964-21-0x0000000003260000-0x0000000003660000-memory.dmp

Download

memory/1964-20-0x0000000002360000-0x0000000002760000-memory.dmp

Download

memory/1964-22-0x00007FFE1BA30000-0x00007FFE1BC25000-memory.dmp

Download

memory/1964-24-0x0000000002360000-0x0000000002760000-memory.dmp

Download

memory/1964-25-0x0000000076FF0000-0x0000000077205000-memory.dmp

Download

memory/1964-28-0x0000000002360000-0x0000000002760000-memory.dmp

Download

memory/4964-0-0x00000000679E0000-0x0000000068067000-memory.dmp

Download

memory/4964-7-0x00000000679E0000-0x0000000068067000-memory.dmp

Download

memory/4964-1-0x00000000679E0000-0x0000000068067000-memory.dmp

Download

memory/4964-5-0x00000000679E0000-0x0000000068067000-memory.dmp

Download

memory/4964-2-0x00000000679E0000-0x0000000068067000-memory.dmp

Download