rhadamanthys | 593c5558cb8b7ee23720b06604ddf701b9239976fe02eaa3652bbcdf5d2ea346

Analysis

max time kernel
18s
max time network
20s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
04-05-2024 13:31

Target

Minty.exe
Size

355KB
MD5

c1e0eb74024ad09c5f3750e58de67199
SHA1

61b531ad13a86c7580d2a4de36589b3deeb7be3b
SHA256

593c5558cb8b7ee23720b06604ddf701b9239976fe02eaa3652bbcdf5d2ea346
SHA512

5d74eba5ed7e1452555faae90d8ee449890d9baf26fc67b7d12fbafeebc0f06c233646aaad56f266958d8654eadb471817e7d789db5433ec8481c5b85dffbcdd
SSDEEP

6144:g2qezd2ab1/RuHk+M3k8M3W7XomjOJCqshrOlumY6DMIewgxQfqLsb:gf2R/EEkCQFYDwRqQ

Score

10^/10

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

Minty.exe

description pid process target process

PID 2360 created 1196 2360 Minty.exe Explorer.EXE
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

Minty.exedialer.exe

pid process

2360 Minty.exe
2360 Minty.exe
904 dialer.exe
904 dialer.exe
904 dialer.exe
904 dialer.exe

description	pid	process	target process
PID 2360 created 1196	2360	Minty.exe	Explorer.EXE

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

Minty.exe

description	pid	process	target process
PID 2360 wrote to memory of 904	2360	Minty.exe	dialer.exe
PID 2360 wrote to memory of 904	2360	Minty.exe	dialer.exe
PID 2360 wrote to memory of 904	2360	Minty.exe	dialer.exe
PID 2360 wrote to memory of 904	2360	Minty.exe	dialer.exe
PID 2360 wrote to memory of 904	2360	Minty.exe	dialer.exe
PID 2360 wrote to memory of 904	2360	Minty.exe	dialer.exe

C:\Windows\SysWOW64\dialer.exe
"C:\Windows\system32\dialer.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:904

memory/904-8-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/904-16-0x0000000077350000-0x00000000774F9000-memory.dmp

Filesize
1.7MB

Download
memory/904-12-0x0000000001DF0000-0x00000000021F0000-memory.dmp

Filesize
4.0MB

Download
memory/904-15-0x0000000076800000-0x0000000076847000-memory.dmp

Filesize
284KB

Download
memory/904-11-0x0000000077350000-0x00000000774F9000-memory.dmp

Filesize
1.7MB

Download
memory/2360-7-0x0000000077351000-0x0000000077452000-memory.dmp

Filesize
1.0MB

Download
memory/2360-6-0x0000000003440000-0x0000000003840000-memory.dmp

Filesize
4.0MB

Download
memory/2360-3-0x0000000077350000-0x00000000774F9000-memory.dmp

Filesize
1.7MB

Download
memory/2360-9-0x0000000000E40000-0x0000000000EAD000-memory.dmp

Filesize
436KB

Download
memory/2360-5-0x0000000076800000-0x0000000076847000-memory.dmp

Filesize
284KB

Download
memory/2360-0-0x0000000000E40000-0x0000000000EAD000-memory.dmp

Filesize
436KB

Download
memory/2360-2-0x0000000003440000-0x0000000003840000-memory.dmp

Filesize
4.0MB

Download
memory/2360-1-0x0000000003440000-0x0000000003840000-memory.dmp

Filesize
4.0MB

Download