rhadamanthys | a8b0aa62097048a307b1c77b86bdeb8943fdaa0ec955bb5d4b63671a758c9655

Analysis

max time kernel
234s
max time network
300s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2024 06:05

Target

test.exe
Size

355KB
MD5

b8e420187ad6ec1fb0a8ca7068e5a77c
SHA1

22d7ca966bb5ba798045d30911a618bbe6c07e13
SHA256

a8b0aa62097048a307b1c77b86bdeb8943fdaa0ec955bb5d4b63671a758c9655
SHA512

06490ab1f07be2f94cc5444636718b83a79d172f5f8b8bbea900982065211e0aa64f5fdc3873c25867dfc0c2d39f8086e85973c01a61e60ac5ef21a61de3677b
SSDEEP

6144:g2qezd2ab1/RuHk+M3k8M3W7XomjOJCqshrOlumY6DMIewgxQfqysb:gf2R/EEkCQFYDwRqd

Score

10^/10

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

test.exe

description pid process target process

PID 1836 created 2404 1836 test.exe sihost.exe
Deletes itself 1 IoCs

Processes:

dialer.exe

pid process

4188 dialer.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

test.exedialer.exe

pid process

1836 test.exe
1836 test.exe
4188 dialer.exe
4188 dialer.exe
4188 dialer.exe
4188 dialer.exe

description	pid	process	target process
PID 1836 created 2404	1836	test.exe	sihost.exe

pid	process
4188	dialer.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

test.exe

description	pid	process	target process
PID 1836 wrote to memory of 4188	1836	test.exe	dialer.exe
PID 1836 wrote to memory of 4188	1836	test.exe	dialer.exe
PID 1836 wrote to memory of 4188	1836	test.exe	dialer.exe
PID 1836 wrote to memory of 4188	1836	test.exe	dialer.exe
PID 1836 wrote to memory of 4188	1836	test.exe	dialer.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3692 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8
1⤵
PID:1212

memory/1836-7-0x0000000075270000-0x0000000075485000-memory.dmp

Filesize
2.1MB

Download
memory/1836-9-0x0000000000C50000-0x0000000000CBD000-memory.dmp

Filesize
436KB

Download
memory/1836-2-0x0000000003950000-0x0000000003D50000-memory.dmp

Filesize
4.0MB

Download
memory/1836-3-0x0000000003950000-0x0000000003D50000-memory.dmp

Filesize
4.0MB

Download
memory/1836-4-0x00007FFC422F0000-0x00007FFC424E5000-memory.dmp

Filesize
2.0MB

Download
memory/1836-5-0x0000000003950000-0x0000000003D50000-memory.dmp

Filesize
4.0MB

Download
memory/1836-1-0x0000000003950000-0x0000000003D50000-memory.dmp

Filesize
4.0MB

Download
memory/1836-0-0x0000000000C50000-0x0000000000CBD000-memory.dmp

Filesize
436KB

Download
memory/4188-8-0x0000000000830000-0x0000000000839000-memory.dmp

Filesize
36KB

Download
memory/4188-11-0x00000000024C0000-0x00000000028C0000-memory.dmp

Filesize
4.0MB

Download
memory/4188-12-0x00000000024C0000-0x00000000028C0000-memory.dmp

Filesize
4.0MB

Download
memory/4188-13-0x00007FFC422F0000-0x00007FFC424E5000-memory.dmp

Filesize
2.0MB

Download
memory/4188-15-0x00000000024C0000-0x00000000028C0000-memory.dmp

Filesize
4.0MB

Download
memory/4188-16-0x0000000075270000-0x0000000075485000-memory.dmp

Filesize
2.1MB

Download
memory/4188-17-0x00000000024C0000-0x00000000028C0000-memory.dmp

Filesize
4.0MB

Download