rhadamanthys | 6d38ecc7c7421b3294ece31e257138dba7c1e933d5d4aecac68acd1b0395f7f8

Analysis

max time kernel
147s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
23/04/2024, 17:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6d38ecc7c7421b3294ece31e257138dba7c1e933d5d4aecac68acd1b0395f7f8.exe
Size 777KB
Sample240423-vvc7wsab96
SHA256 6d38ecc7c7421b3294ece31e257138dba7c1e933d5d4aecac68acd1b0395f7f8
MD5 f20953273a29f211ad2fbd1db9961349
SHA1 e6ed3e4123dc0d727ea759f9560eab6971f1fcc0
SHA512 a5c9e0e4711d869fea9589ac7df843c1a66e93250997c1e009ebaa4afe219edf48a340f9435ff233b92e3a1d810713b901de3bc41b7f8f77d454ade549e048f7
SSDEEP 12288:dEUWVser3NvH4qsanwmgW7gPLKp/31lOXwAH5eawCZyNRpJeSzEZFf9J/hw8:dJmBDZHfPgGgzKtjUZeaL2feHbjh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rhadamanthys zgrat rat stealer

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral2/memory/4392-0-0x00000000004C0000-0x0000000000588000-memory.dmp	family_zgrat_v1

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3508 created 1988	3508	AddInProcess32.exe	49

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4392 set thread context of 3508	4392	6d38ecc7c7421b3294ece31e257138dba7c1e933d5d4aecac68acd1b0395f7f8.exe	80

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3752	3508	WerFault.exe	80
4148	3508	WerFault.exe	80

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4392	6d38ecc7c7421b3294ece31e257138dba7c1e933d5d4aecac68acd1b0395f7f8.exe
3508	AddInProcess32.exe
3508	AddInProcess32.exe
2468	dialer.exe
2468	dialer.exe
2468	dialer.exe
2468	dialer.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4392	6d38ecc7c7421b3294ece31e257138dba7c1e933d5d4aecac68acd1b0395f7f8.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 3508	4392	6d38ecc7c7421b3294ece31e257138dba7c1e933d5d4aecac68acd1b0395f7f8.exe	80
PID 4392 wrote to memory of 3508	4392	6d38ecc7c7421b3294ece31e257138dba7c1e933d5d4aecac68acd1b0395f7f8.exe	80
PID 4392 wrote to memory of 3508	4392	6d38ecc7c7421b3294ece31e257138dba7c1e933d5d4aecac68acd1b0395f7f8.exe	80
PID 4392 wrote to memory of 3508	4392	6d38ecc7c7421b3294ece31e257138dba7c1e933d5d4aecac68acd1b0395f7f8.exe	80
PID 4392 wrote to memory of 3508	4392	6d38ecc7c7421b3294ece31e257138dba7c1e933d5d4aecac68acd1b0395f7f8.exe	80
PID 4392 wrote to memory of 3508	4392	6d38ecc7c7421b3294ece31e257138dba7c1e933d5d4aecac68acd1b0395f7f8.exe	80
PID 4392 wrote to memory of 3508	4392	6d38ecc7c7421b3294ece31e257138dba7c1e933d5d4aecac68acd1b0395f7f8.exe	80
PID 4392 wrote to memory of 3508	4392	6d38ecc7c7421b3294ece31e257138dba7c1e933d5d4aecac68acd1b0395f7f8.exe	80
PID 4392 wrote to memory of 3508	4392	6d38ecc7c7421b3294ece31e257138dba7c1e933d5d4aecac68acd1b0395f7f8.exe	80
PID 4392 wrote to memory of 3508	4392	6d38ecc7c7421b3294ece31e257138dba7c1e933d5d4aecac68acd1b0395f7f8.exe	80
PID 3508 wrote to memory of 2468	3508	AddInProcess32.exe	81
PID 3508 wrote to memory of 2468	3508	AddInProcess32.exe	81
PID 3508 wrote to memory of 2468	3508	AddInProcess32.exe	81
PID 3508 wrote to memory of 2468	3508	AddInProcess32.exe	81
PID 3508 wrote to memory of 2468	3508	AddInProcess32.exe	81

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:1988
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2468

C:\Users\Admin\AppData\Local\Temp\6d38ecc7c7421b3294ece31e257138dba7c1e933d5d4aecac68acd1b0395f7f8.exe
"C:\Users\Admin\AppData\Local\Temp\6d38ecc7c7421b3294ece31e257138dba7c1e933d5d4aecac68acd1b0395f7f8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  #cmd
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3508
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3508 -s 468
    3⤵
    - Program crash
    PID:3752
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3508 -s 464
    3⤵
    - Program crash
    PID:4148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3508 -ip 3508
1⤵
PID:4100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3508 -ip 3508
1⤵
PID:2624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2468-18-0x0000000000310000-0x0000000000319000-memory.dmp

Download

memory/2468-28-0x00007FFC1A360000-0x00007FFC1A569000-memory.dmp

Download

memory/2468-27-0x0000000002210000-0x0000000002610000-memory.dmp

Download

memory/2468-26-0x00007FFC1A360000-0x00007FFC1A569000-memory.dmp

Download

memory/2468-24-0x0000000002210000-0x0000000002610000-memory.dmp

Download

memory/2468-25-0x0000000075CE0000-0x0000000075F32000-memory.dmp

Download

memory/2468-22-0x00007FFC1A360000-0x00007FFC1A569000-memory.dmp

Download

memory/2468-21-0x0000000002210000-0x0000000002610000-memory.dmp

Download

memory/3508-5-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3508-10-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3508-13-0x0000000003730000-0x0000000003B30000-memory.dmp

Download

memory/3508-14-0x00007FFC1A360000-0x00007FFC1A569000-memory.dmp

Download

memory/3508-15-0x0000000003730000-0x0000000003B30000-memory.dmp

Download

memory/3508-17-0x0000000075CE0000-0x0000000075F32000-memory.dmp

Download

memory/3508-29-0x0000000003730000-0x0000000003B30000-memory.dmp

Download

memory/3508-11-0x0000000003730000-0x0000000003B30000-memory.dmp

Download

memory/3508-8-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4392-0-0x00000000004C0000-0x0000000000588000-memory.dmp

Download

memory/4392-4-0x0000000005000000-0x0000000005060000-memory.dmp

Download

memory/4392-3-0x0000000004E20000-0x0000000004E21000-memory.dmp

Download

memory/4392-2-0x0000000005070000-0x0000000005080000-memory.dmp

Download

memory/4392-9-0x0000000075200000-0x00000000759B1000-memory.dmp

Download

memory/4392-1-0x0000000075200000-0x00000000759B1000-memory.dmp

Download