rhadamanthys | 8fdf1b2809850293e4b76744a01e9497a4fa3cc0cadbda7c566d718762340c03

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 00:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
maisakura.exe
Size 364KB
Sample240524-a341csfa7y
SHA256 8fdf1b2809850293e4b76744a01e9497a4fa3cc0cadbda7c566d718762340c03
MD5 dbb5c74b58a777a498e4f7deab277cab
SHA1 f9c2fb7398c1cc1c18c7c49ffd75955a147f521a
SHA512 65da8e67e410d830fb1be3084bc69d0ed1acc87d4e86ecf01fe8ac1068ae2502bc29afbfc64abb3e16aa82506e136ea8fd01b892e73e27815b04bf353741318e
SSDEEP 6144:ez1B7wGwf/QyKk32TRepzysEA4eNgZLS1BdkWYrnzmOLkfzxEZwC:m1cRAiO+aLS1Bven7LCzxEG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4856 created 2584	4856	RegAsm.exe	44

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1548 set thread context of 4856	1548	maisakura.exe	85

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3760	4856	WerFault.exe	85
4392	4856	WerFault.exe	85

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4856	RegAsm.exe
4856	RegAsm.exe
3756	dialer.exe
3756	dialer.exe
3756	dialer.exe
3756	dialer.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 4856	1548	maisakura.exe	85
PID 1548 wrote to memory of 4856	1548	maisakura.exe	85
PID 1548 wrote to memory of 4856	1548	maisakura.exe	85
PID 1548 wrote to memory of 4856	1548	maisakura.exe	85
PID 1548 wrote to memory of 4856	1548	maisakura.exe	85
PID 1548 wrote to memory of 4856	1548	maisakura.exe	85
PID 1548 wrote to memory of 4856	1548	maisakura.exe	85
PID 1548 wrote to memory of 4856	1548	maisakura.exe	85
PID 1548 wrote to memory of 4856	1548	maisakura.exe	85
PID 1548 wrote to memory of 4856	1548	maisakura.exe	85
PID 1548 wrote to memory of 4856	1548	maisakura.exe	85
PID 4856 wrote to memory of 3756	4856	RegAsm.exe	93
PID 4856 wrote to memory of 3756	4856	RegAsm.exe	93
PID 4856 wrote to memory of 3756	4856	RegAsm.exe	93
PID 4856 wrote to memory of 3756	4856	RegAsm.exe	93
PID 4856 wrote to memory of 3756	4856	RegAsm.exe	93

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2584
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3756

C:\Users\Admin\AppData\Local\Temp\maisakura.exe
"C:\Users\Admin\AppData\Local\Temp\maisakura.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4856
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4856 -s 584
    3⤵
    - Program crash
    PID:3760
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4856 -s 600
    3⤵
    - Program crash
    PID:4392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4856 -ip 4856
1⤵
PID:4992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4856 -ip 4856
1⤵
PID:3164

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1548-9-0x0000000074950000-0x0000000075100000-memory.dmp

Download

memory/1548-1-0x0000000000F20000-0x0000000000F82000-memory.dmp

Download

memory/1548-0-0x000000007495E000-0x000000007495F000-memory.dmp

Download

memory/3756-18-0x0000000001200000-0x0000000001209000-memory.dmp

Download

memory/3756-25-0x00000000760E0000-0x00000000762F5000-memory.dmp

Download

memory/3756-27-0x0000000002E40000-0x0000000003240000-memory.dmp

Download

memory/3756-26-0x0000000002E40000-0x0000000003240000-memory.dmp

Download

memory/3756-23-0x00007FFEE98B0000-0x00007FFEE9AA5000-memory.dmp

Download

memory/3756-20-0x0000000002E40000-0x0000000003240000-memory.dmp

Download

memory/3756-21-0x0000000002E40000-0x0000000003240000-memory.dmp

Download

memory/4856-4-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4856-17-0x00000000760E0000-0x00000000762F5000-memory.dmp

Download

memory/4856-15-0x0000000003B70000-0x0000000003F70000-memory.dmp

Download

memory/4856-14-0x00007FFEE98B0000-0x00007FFEE9AA5000-memory.dmp

Download

memory/4856-11-0x0000000003B70000-0x0000000003F70000-memory.dmp

Download

memory/4856-22-0x0000000003B70000-0x0000000003F70000-memory.dmp

Download

memory/4856-10-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4856-12-0x0000000003B70000-0x0000000003F70000-memory.dmp

Download

memory/4856-13-0x0000000003B70000-0x0000000003F70000-memory.dmp

Download

memory/4856-8-0x0000000000400000-0x000000000046D000-memory.dmp

Download