rhadamanthys | 57a34a1caae7f0426b32bc71b73785f820451c97d3c5db368da479183b037629

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 17:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa2355d799779408d9b50fa6ad3975c9eca4e30aa4405d6a01bf647c7c688db1.exe
Size

1.3MB
MD5

63d35dad49cabfe3e9b19406072d0cf2
SHA1

57651073be30963ce25b2a773714cf4f04b1437f
SHA256

aa2355d799779408d9b50fa6ad3975c9eca4e30aa4405d6a01bf647c7c688db1
SHA512

599f713aec7eb928c4a93e4e520b3db2acd594cc1be2028e35ab26592323bdd487766d402c22d1cfac6bbea38a9a3b67567f8c0aa38e095c90236b69eb331054
SSDEEP

24576:UIh8NUuIoPwItf8+2JnvnNY5d8NBDra9hUK:UKJoPwItf8+2JfcK+9hb

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2840 created 2556	2840	RegAsm.exe	44

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2796 set thread context of 2840	2796	aa2355d799779408d9b50fa6ad3975c9eca4e30aa4405d6a01bf647c7c688db1.exe	84

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4352	2796	WerFault.exe	83
2608	2840	WerFault.exe	84
4428	2840	WerFault.exe	84

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2840	RegAsm.exe
2840	RegAsm.exe
3988	dialer.exe
3988	dialer.exe
3988	dialer.exe
3988	dialer.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 2840	2796	aa2355d799779408d9b50fa6ad3975c9eca4e30aa4405d6a01bf647c7c688db1.exe	84
PID 2796 wrote to memory of 2840	2796	aa2355d799779408d9b50fa6ad3975c9eca4e30aa4405d6a01bf647c7c688db1.exe	84
PID 2796 wrote to memory of 2840	2796	aa2355d799779408d9b50fa6ad3975c9eca4e30aa4405d6a01bf647c7c688db1.exe	84
PID 2796 wrote to memory of 2840	2796	aa2355d799779408d9b50fa6ad3975c9eca4e30aa4405d6a01bf647c7c688db1.exe	84
PID 2796 wrote to memory of 2840	2796	aa2355d799779408d9b50fa6ad3975c9eca4e30aa4405d6a01bf647c7c688db1.exe	84
PID 2796 wrote to memory of 2840	2796	aa2355d799779408d9b50fa6ad3975c9eca4e30aa4405d6a01bf647c7c688db1.exe	84
PID 2796 wrote to memory of 2840	2796	aa2355d799779408d9b50fa6ad3975c9eca4e30aa4405d6a01bf647c7c688db1.exe	84
PID 2796 wrote to memory of 2840	2796	aa2355d799779408d9b50fa6ad3975c9eca4e30aa4405d6a01bf647c7c688db1.exe	84
PID 2796 wrote to memory of 2840	2796	aa2355d799779408d9b50fa6ad3975c9eca4e30aa4405d6a01bf647c7c688db1.exe	84
PID 2796 wrote to memory of 2840	2796	aa2355d799779408d9b50fa6ad3975c9eca4e30aa4405d6a01bf647c7c688db1.exe	84
PID 2796 wrote to memory of 2840	2796	aa2355d799779408d9b50fa6ad3975c9eca4e30aa4405d6a01bf647c7c688db1.exe	84
PID 2840 wrote to memory of 3988	2840	RegAsm.exe	91
PID 2840 wrote to memory of 3988	2840	RegAsm.exe	91
PID 2840 wrote to memory of 3988	2840	RegAsm.exe	91
PID 2840 wrote to memory of 3988	2840	RegAsm.exe	91
PID 2840 wrote to memory of 3988	2840	RegAsm.exe	91

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2556
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3988

C:\Users\Admin\AppData\Local\Temp\aa2355d799779408d9b50fa6ad3975c9eca4e30aa4405d6a01bf647c7c688db1.exe
"C:\Users\Admin\AppData\Local\Temp\aa2355d799779408d9b50fa6ad3975c9eca4e30aa4405d6a01bf647c7c688db1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 592
    3⤵
    - Program crash
    PID:2608
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 588
    3⤵
    - Program crash
    PID:4428
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 320
  2⤵
  - Program crash
  PID:4352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2796 -ip 2796
1⤵
PID:3972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2840 -ip 2840
1⤵
PID:2528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2840 -ip 2840
1⤵
PID:2584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2796-0-0x0000000000623000-0x0000000000625000-memory.dmp

Filesize
8KB

Download
memory/2840-11-0x0000000003D90000-0x0000000004190000-memory.dmp

Filesize
4.0MB

Download
memory/2840-20-0x0000000003D90000-0x0000000004190000-memory.dmp

Filesize
4.0MB

Download
memory/2840-4-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2840-5-0x0000000003D90000-0x0000000004190000-memory.dmp

Filesize
4.0MB

Download
memory/2840-7-0x0000000003D90000-0x0000000004190000-memory.dmp

Filesize
4.0MB

Download
memory/2840-6-0x0000000003D90000-0x0000000004190000-memory.dmp

Filesize
4.0MB

Download
memory/2840-3-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2840-8-0x00007FFF85090000-0x00007FFF85285000-memory.dmp

Filesize
2.0MB

Download
memory/2840-10-0x0000000075F00000-0x0000000076115000-memory.dmp

Filesize
2.1MB

Download
memory/2840-1-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/3988-12-0x00000000008A0000-0x00000000008A9000-memory.dmp

Filesize
36KB

Download
memory/3988-15-0x00007FFF85090000-0x00007FFF85285000-memory.dmp

Filesize
2.0MB

Download
memory/3988-18-0x00000000023F0000-0x00000000027F0000-memory.dmp

Filesize
4.0MB

Download
memory/3988-17-0x0000000075F00000-0x0000000076115000-memory.dmp

Filesize
2.1MB

Download
memory/3988-19-0x00000000023F0000-0x00000000027F0000-memory.dmp

Filesize
4.0MB

Download
memory/3988-14-0x00000000023F0000-0x00000000027F0000-memory.dmp

Filesize
4.0MB

Download