rhadamanthys | 513f373d78e2b628cb39d7b38ecb9868362e604592840f8c7f304c0c72a2fe82

Analysis

max time kernel
15s
max time network
17s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-04-2024 21:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

plugin8502.exe
Size

486KB
MD5

7cf3000c1ddfa922f33780b189455293
SHA1

5ae2a51a15e2e28e176f65acf76e734335e272d0
SHA256

513f373d78e2b628cb39d7b38ecb9868362e604592840f8c7f304c0c72a2fe82
SHA512

eac5e507370a939809eca03f4d2d777b15b819a54a55cd421cb0a27d65395c8d7dd43eaa5d6b7d641a0fdb2fa16c12c3c2cdbc9450c7994ddbfb7812ffe672f5
SSDEEP

12288:QoShub/nykamKx+eoXoN3r2qiCGM/MdmNe:QoSOyHmG+eoXoN3u2/Mdce

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

plugin8502.exe

description pid process target process

PID 2196 created 1196 2196 plugin8502.exe Explorer.EXE
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

plugin8502.exedialer.exe

pid process

2196 plugin8502.exe
2196 plugin8502.exe
1744 dialer.exe
1744 dialer.exe
1744 dialer.exe
1744 dialer.exe

description	pid	process	target process
PID 2196 created 1196	2196	plugin8502.exe	Explorer.EXE

pid	process
2196	plugin8502.exe
2196	plugin8502.exe
1744	dialer.exe
1744	dialer.exe
1744	dialer.exe
1744	dialer.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

plugin8502.exe

description	pid	process	target process
PID 2196 wrote to memory of 1744	2196	plugin8502.exe	dialer.exe
PID 2196 wrote to memory of 1744	2196	plugin8502.exe	dialer.exe
PID 2196 wrote to memory of 1744	2196	plugin8502.exe	dialer.exe
PID 2196 wrote to memory of 1744	2196	plugin8502.exe	dialer.exe
PID 2196 wrote to memory of 1744	2196	plugin8502.exe	dialer.exe
PID 2196 wrote to memory of 1744	2196	plugin8502.exe	dialer.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1196

C:\Users\Admin\AppData\Local\Temp\plugin8502.exe
"C:\Users\Admin\AppData\Local\Temp\plugin8502.exe"
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2196

C:\Windows\SysWOW64\dialer.exe
"C:\Windows\system32\dialer.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1744

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1744-16-0x0000000000880000-0x0000000000C80000-memory.dmp

Filesize
4.0MB

Download
memory/1744-23-0x00000000776D0000-0x0000000077879000-memory.dmp

Filesize
1.7MB

Download
memory/1744-10-0x00000000000C0000-0x00000000000C9000-memory.dmp

Filesize
36KB

Download
memory/1744-22-0x0000000000880000-0x0000000000C80000-memory.dmp

Filesize
4.0MB

Download
memory/1744-21-0x00000000766F0000-0x0000000076737000-memory.dmp

Filesize
284KB

Download
memory/1744-20-0x0000000000880000-0x0000000000C80000-memory.dmp

Filesize
4.0MB

Download
memory/1744-18-0x00000000776D0000-0x0000000077879000-memory.dmp

Filesize
1.7MB

Download
memory/2196-7-0x0000000005790000-0x0000000005B90000-memory.dmp

Filesize
4.0MB

Download
memory/2196-9-0x00000000766F0000-0x0000000076737000-memory.dmp

Filesize
284KB

Download
memory/2196-1-0x00000000002D0000-0x00000000003D0000-memory.dmp

Filesize
1024KB

Download
memory/2196-5-0x0000000005790000-0x0000000005B90000-memory.dmp

Filesize
4.0MB

Download
memory/2196-14-0x0000000005790000-0x0000000005B90000-memory.dmp

Filesize
4.0MB

Download
memory/2196-2-0x0000000002DD0000-0x0000000002E2A000-memory.dmp

Filesize
360KB

Download
memory/2196-6-0x00000000776D0000-0x0000000077879000-memory.dmp

Filesize
1.7MB

Download
memory/2196-3-0x0000000000400000-0x0000000002D58000-memory.dmp

Filesize
41.3MB

Download
memory/2196-4-0x0000000005790000-0x0000000005B90000-memory.dmp

Filesize
4.0MB

Download
memory/2196-13-0x0000000002DD0000-0x0000000002E2A000-memory.dmp

Filesize
360KB

Download
memory/2196-11-0x0000000000400000-0x0000000002D58000-memory.dmp

Filesize
41.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads