rhadamanthys | 1b0215062992174a807e9203688e5727a27c8aaf8a1b5dbdcd10d0d0ea89f7aa

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 20:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

test (2).exe
Size

454KB
MD5

46f24f1f1eab7caa6d2610d2c4d294da
SHA1

6645c1ef54312d1d6edf830bbfc95d596b5aa387
SHA256

1b0215062992174a807e9203688e5727a27c8aaf8a1b5dbdcd10d0d0ea89f7aa
SHA512

98c619818ead05b322d892399d0a7c7ad26a20ba5992d10edf7a045fc00317bba8c8ad57fd0ddad0c5ea63a2fadad17df5d98da6396894d279e534578cd820bb
SSDEEP

6144:hC5hyUR+MhyfUj6qfozXYfIrvQ/zabJzYbLkBWBXpMcwLbjJgSqtUg83T36XE24O:l+BozmID/mQmpMcmSSIU16XE2e5Lq

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2232 created 1056	2232	test (2).exe	18

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2232	test (2).exe
2232	test (2).exe
2680	dialer.exe
2680	dialer.exe
2680	dialer.exe
2680	dialer.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2680	2232	test (2).exe	31
PID 2232 wrote to memory of 2680	2232	test (2).exe	31
PID 2232 wrote to memory of 2680	2232	test (2).exe	31
PID 2232 wrote to memory of 2680	2232	test (2).exe	31
PID 2232 wrote to memory of 2680	2232	test (2).exe	31
PID 2232 wrote to memory of 2680	2232	test (2).exe	31

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1056
- C:\Users\Admin\AppData\Local\Temp\test (2).exe
  "C:\Users\Admin\AppData\Local\Temp\test (2).exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2232
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2232-10-0x0000000002F10000-0x0000000003310000-memory.dmp

Filesize
4.0MB

Download
memory/2232-9-0x0000000077951000-0x0000000077A52000-memory.dmp

Filesize
1.0MB

Download
memory/2232-3-0x0000000002F10000-0x0000000003310000-memory.dmp

Filesize
4.0MB

Download
memory/2232-2-0x0000000002F10000-0x0000000003310000-memory.dmp

Filesize
4.0MB

Download
memory/2232-4-0x0000000077950000-0x0000000077AF9000-memory.dmp

Filesize
1.7MB

Download
memory/2232-6-0x0000000076090000-0x00000000760D7000-memory.dmp

Filesize
284KB

Download
memory/2232-20-0x0000000002F10000-0x0000000003310000-memory.dmp

Filesize
4.0MB

Download
memory/2232-8-0x00000000001B0000-0x000000000023A000-memory.dmp

Filesize
552KB

Download
memory/2232-1-0x0000000002F10000-0x0000000003310000-memory.dmp

Filesize
4.0MB

Download
memory/2232-0-0x00000000001B0000-0x000000000023A000-memory.dmp

Filesize
552KB

Download
memory/2680-13-0x0000000001DF0000-0x00000000021F0000-memory.dmp

Filesize
4.0MB

Download
memory/2680-12-0x0000000001DF0000-0x00000000021F0000-memory.dmp

Filesize
4.0MB

Download
memory/2680-14-0x0000000077950000-0x0000000077AF9000-memory.dmp

Filesize
1.7MB

Download
memory/2680-18-0x0000000077951000-0x0000000077A52000-memory.dmp

Filesize
1.0MB

Download
memory/2680-17-0x0000000001DF0000-0x00000000021F0000-memory.dmp

Filesize
4.0MB

Download
memory/2680-16-0x0000000076090000-0x00000000760D7000-memory.dmp

Filesize
284KB

Download
memory/2680-19-0x0000000001DF0000-0x00000000021F0000-memory.dmp

Filesize
4.0MB

Download
memory/2680-7-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download