rhadamanthys | 593c5558cb8b7ee23720b06604ddf701b9239976fe02eaa3652bbcdf5d2ea346

Analysis

max time kernel
132s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04-05-2024 13:31

Target

Minty.exe
Size

355KB
MD5

c1e0eb74024ad09c5f3750e58de67199
SHA1

61b531ad13a86c7580d2a4de36589b3deeb7be3b
SHA256

593c5558cb8b7ee23720b06604ddf701b9239976fe02eaa3652bbcdf5d2ea346
SHA512

5d74eba5ed7e1452555faae90d8ee449890d9baf26fc67b7d12fbafeebc0f06c233646aaad56f266958d8654eadb471817e7d789db5433ec8481c5b85dffbcdd
SSDEEP

6144:g2qezd2ab1/RuHk+M3k8M3W7XomjOJCqshrOlumY6DMIewgxQfqLsb:gf2R/EEkCQFYDwRqQ

Score

10^/10

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

Minty.exe

description pid process target process

PID 5064 created 2644 5064 Minty.exe sihost.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

Minty.exedialer.exe

pid process

5064 Minty.exe
5064 Minty.exe
2436 dialer.exe
2436 dialer.exe
2436 dialer.exe
2436 dialer.exe

description	pid	process	target process
PID 5064 created 2644	5064	Minty.exe	sihost.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

Minty.exe

description	pid	process	target process
PID 5064 wrote to memory of 2436	5064	Minty.exe	dialer.exe
PID 5064 wrote to memory of 2436	5064	Minty.exe	dialer.exe
PID 5064 wrote to memory of 2436	5064	Minty.exe	dialer.exe
PID 5064 wrote to memory of 2436	5064	Minty.exe	dialer.exe
PID 5064 wrote to memory of 2436	5064	Minty.exe	dialer.exe

C:\Windows\SysWOW64\dialer.exe
"C:\Windows\system32\dialer.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2436

memory/2436-11-0x0000000002550000-0x0000000002950000-memory.dmp

Filesize
4.0MB

Download
memory/2436-17-0x0000000002550000-0x0000000002950000-memory.dmp

Filesize
4.0MB

Download
memory/2436-14-0x0000000002550000-0x0000000002950000-memory.dmp

Filesize
4.0MB

Download
memory/2436-16-0x0000000076350000-0x0000000076565000-memory.dmp

Filesize
2.1MB

Download
memory/2436-13-0x00007FF89B6F0000-0x00007FF89B8E5000-memory.dmp

Filesize
2.0MB

Download
memory/2436-12-0x0000000002550000-0x0000000002950000-memory.dmp

Filesize
4.0MB

Download
memory/2436-8-0x0000000000A00000-0x0000000000A09000-memory.dmp

Filesize
36KB

Download
memory/5064-2-0x0000000003A50000-0x0000000003E50000-memory.dmp

Filesize
4.0MB

Download
memory/5064-10-0x00000000005C0000-0x000000000062D000-memory.dmp

Filesize
436KB

Download
memory/5064-4-0x00007FF89B6F0000-0x00007FF89B8E5000-memory.dmp

Filesize
2.0MB

Download
memory/5064-7-0x0000000003A50000-0x0000000003E50000-memory.dmp

Filesize
4.0MB

Download
memory/5064-6-0x0000000076350000-0x0000000076565000-memory.dmp

Filesize
2.1MB

Download
memory/5064-0-0x00000000005C0000-0x000000000062D000-memory.dmp

Filesize
436KB

Download
memory/5064-3-0x0000000003A50000-0x0000000003E50000-memory.dmp

Filesize
4.0MB

Download
memory/5064-1-0x0000000003A50000-0x0000000003E50000-memory.dmp

Filesize
4.0MB

Download