rhadamanthys | 513f373d78e2b628cb39d7b38ecb9868362e604592840f8c7f304c0c72a2fe82

Analysis

max time kernel
32s
max time network
35s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
23-04-2024 21:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

plugin8502.exe
Size

486KB
MD5

7cf3000c1ddfa922f33780b189455293
SHA1

5ae2a51a15e2e28e176f65acf76e734335e272d0
SHA256

513f373d78e2b628cb39d7b38ecb9868362e604592840f8c7f304c0c72a2fe82
SHA512

eac5e507370a939809eca03f4d2d777b15b819a54a55cd421cb0a27d65395c8d7dd43eaa5d6b7d641a0fdb2fa16c12c3c2cdbc9450c7994ddbfb7812ffe672f5
SSDEEP

12288:QoShub/nykamKx+eoXoN3r2qiCGM/MdmNe:QoSOyHmG+eoXoN3u2/Mdce

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

plugin8502.exe

description pid process target process

PID 5056 created 2996 5056 plugin8502.exe sihost.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

856 5056 WerFault.exe plugin8502.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

plugin8502.exedialer.exe

pid process

5056 plugin8502.exe
5056 plugin8502.exe
636 dialer.exe
636 dialer.exe
636 dialer.exe
636 dialer.exe

description	pid	process	target process
PID 5056 created 2996	5056	plugin8502.exe	sihost.exe

pid	pid_target	process	target process
856	5056	WerFault.exe	plugin8502.exe

pid	process
5056	plugin8502.exe
5056	plugin8502.exe
636	dialer.exe
636	dialer.exe
636	dialer.exe
636	dialer.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

plugin8502.exe

description	pid	process	target process
PID 5056 wrote to memory of 636	5056	plugin8502.exe	dialer.exe
PID 5056 wrote to memory of 636	5056	plugin8502.exe	dialer.exe
PID 5056 wrote to memory of 636	5056	plugin8502.exe	dialer.exe
PID 5056 wrote to memory of 636	5056	plugin8502.exe	dialer.exe
PID 5056 wrote to memory of 636	5056	plugin8502.exe	dialer.exe

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2996

C:\Windows\SysWOW64\dialer.exe
"C:\Windows\system32\dialer.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:636

C:\Users\Admin\AppData\Local\Temp\plugin8502.exe
"C:\Users\Admin\AppData\Local\Temp\plugin8502.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 508
2⤵
- Program crash
PID:856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5056 -ip 5056
1⤵
PID:2320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/636-11-0x0000000000D50000-0x0000000000D59000-memory.dmp

Filesize
36KB

Download
memory/636-19-0x0000000002B80000-0x0000000002F80000-memory.dmp

Filesize
4.0MB

Download
memory/636-18-0x00000000758B0000-0x0000000075AC5000-memory.dmp

Filesize
2.1MB

Download
memory/636-16-0x0000000002B80000-0x0000000002F80000-memory.dmp

Filesize
4.0MB

Download
memory/636-15-0x00007FFE07FF0000-0x00007FFE081E5000-memory.dmp

Filesize
2.0MB

Download
memory/636-13-0x0000000002B80000-0x0000000002F80000-memory.dmp

Filesize
4.0MB

Download
memory/636-14-0x0000000002B80000-0x0000000002F80000-memory.dmp

Filesize
4.0MB

Download
memory/5056-5-0x0000000005D10000-0x0000000006110000-memory.dmp

Filesize
4.0MB

Download
memory/5056-10-0x00000000758B0000-0x0000000075AC5000-memory.dmp

Filesize
2.1MB

Download
memory/5056-7-0x00007FFE07FF0000-0x00007FFE081E5000-memory.dmp

Filesize
2.0MB

Download
memory/5056-8-0x0000000005D10000-0x0000000006110000-memory.dmp

Filesize
4.0MB

Download
memory/5056-6-0x0000000005D10000-0x0000000006110000-memory.dmp

Filesize
4.0MB

Download
memory/5056-1-0x0000000003050000-0x0000000003150000-memory.dmp

Filesize
1024KB

Download
memory/5056-4-0x0000000005D10000-0x0000000006110000-memory.dmp

Filesize
4.0MB

Download
memory/5056-3-0x0000000000400000-0x0000000002D58000-memory.dmp

Filesize
41.3MB

Download
memory/5056-2-0x0000000002FF0000-0x000000000304A000-memory.dmp

Filesize
360KB

Download
memory/5056-20-0x0000000000400000-0x0000000002D58000-memory.dmp

Filesize
41.3MB

Download
memory/5056-21-0x0000000005D10000-0x0000000006110000-memory.dmp

Filesize
4.0MB

Download