rhadamanthys | 354679c17ca0de4db1b0362d7bb3f814e106aa5032886fd60c2c21c9bc066927

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 17:27

Target

Full_Set_up.exe
Size

7.7MB
MD5

3de78a79444a5258ee168e2da6b7b7d1
SHA1

884d5a20d4da7d3229bdda5f5bacb51d06a8d121
SHA256

354679c17ca0de4db1b0362d7bb3f814e106aa5032886fd60c2c21c9bc066927
SHA512

52e3595eb71129f84a2d7208bf57f1d86f35001f6c111b33a741e7bff0155e4e19296fdaabff5f9740f4b4c56c8a5030f1166b149b73a9c70cdccc6e3c25d2f1
SSDEEP

98304:anrZtEflEbVlkew5n0iH961svNIXRBS6KwysAyyrznkeqJUiB7Qmi5mm4jO:SrZtEflEc5n0iH90svNIVYHkeI7jmqO

Score

10^/10

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2584 created 1200	2584	Full_Set_up.exe	21

Suspicious behavior: EnumeratesProcesses 7 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 2940	2584	Full_Set_up.exe	33
PID 2584 wrote to memory of 2940	2584	Full_Set_up.exe	33
PID 2584 wrote to memory of 2940	2584	Full_Set_up.exe	33
PID 2584 wrote to memory of 2940	2584	Full_Set_up.exe	33
PID 2584 wrote to memory of 2940	2584	Full_Set_up.exe	33
PID 2584 wrote to memory of 2940	2584	Full_Set_up.exe	33

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1200
- C:\Users\Admin\AppData\Local\Temp\Full_Set_up.exe
  "C:\Users\Admin\AppData\Local\Temp\Full_Set_up.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2584
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:2732
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2940

memory/2584-11-0x00000000779A1000-0x0000000077AA2000-memory.dmp

Filesize
1.0MB

Download
memory/2584-8-0x0000000075720000-0x0000000075767000-memory.dmp

Filesize
284KB

Download
memory/2584-3-0x0000000004170000-0x0000000004570000-memory.dmp

Filesize
4.0MB

Download
memory/2584-5-0x0000000004170000-0x0000000004570000-memory.dmp

Filesize
4.0MB

Download
memory/2584-4-0x0000000004170000-0x0000000004570000-memory.dmp

Filesize
4.0MB

Download
memory/2584-6-0x00000000779A0000-0x0000000077B49000-memory.dmp

Filesize
1.7MB

Download
memory/2584-1-0x0000000000260000-0x00000000002D0000-memory.dmp

Filesize
448KB

Download
memory/2584-19-0x0000000000400000-0x0000000000C05000-memory.dmp

Filesize
8.0MB

Download
memory/2584-0-0x0000000000400000-0x0000000000C05000-memory.dmp

Filesize
8.0MB

Download
memory/2584-10-0x0000000004170000-0x0000000004570000-memory.dmp

Filesize
4.0MB

Download
memory/2940-9-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/2940-17-0x0000000075720000-0x0000000075767000-memory.dmp

Filesize
284KB

Download
memory/2940-14-0x00000000779A0000-0x0000000077B49000-memory.dmp

Filesize
1.7MB

Download
memory/2940-13-0x0000000001C10000-0x0000000002010000-memory.dmp

Filesize
4.0MB

Download
memory/2940-18-0x00000000779A0000-0x0000000077B49000-memory.dmp

Filesize
1.7MB

Download