rhadamanthys | 671cbf9e293f8dbafa21335a7c96c5a6d802c5860db95d811ef02e07519a8942

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2024, 23:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MediaKit/Promo agreement and terms of conditions WEB version.exe
Size 672.7MB
Sample240716-3dkjmsyajc
SHA256 37b4ac9bbd942211dc79bcf7309f6603fa27985519867448c252385a01c4d9cc
MD5 a1465334871aa174387b1894350125b3
SHA1 6ab848c84a42a168b7eccc67dcffabcfaa2313b7
SHA512 2518e64ed3299bb0642cdbfc046deba04d8b13b829b64649d83a88e82f5336fc6d0743d4fefd49d86e927803d87286f42aab15e8d292257bb1d7ff8b77fdfb0c
SSDEEP 49152:HGlUi4n6mwTJsg4Rb2opcS1b2DMDi6gdu5zuw+DZ5TmvqzRRUNPljy7Ls+qp:HGGipmBtdvpcS1h26gEXvqzgNPuE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 688 created 2648	688	svchost015.exe	44

Executes dropped EXE 1 IoCs

pid	Process
688	svchost015.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2880 set thread context of 688	2880	Promo agreement and terms of conditions WEB version.exe	90

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4132	688	WerFault.exe	90
316	688	WerFault.exe	90

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
688	svchost015.exe
688	svchost015.exe
3364	openwith.exe
3364	openwith.exe
3364	openwith.exe
3364	openwith.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
688	svchost015.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 688	2880	Promo agreement and terms of conditions WEB version.exe	90
PID 2880 wrote to memory of 688	2880	Promo agreement and terms of conditions WEB version.exe	90
PID 2880 wrote to memory of 688	2880	Promo agreement and terms of conditions WEB version.exe	90
PID 2880 wrote to memory of 688	2880	Promo agreement and terms of conditions WEB version.exe	90
PID 2880 wrote to memory of 688	2880	Promo agreement and terms of conditions WEB version.exe	90
PID 2880 wrote to memory of 688	2880	Promo agreement and terms of conditions WEB version.exe	90
PID 2880 wrote to memory of 688	2880	Promo agreement and terms of conditions WEB version.exe	90
PID 2880 wrote to memory of 688	2880	Promo agreement and terms of conditions WEB version.exe	90
PID 2880 wrote to memory of 688	2880	Promo agreement and terms of conditions WEB version.exe	90
PID 688 wrote to memory of 3364	688	svchost015.exe	92
PID 688 wrote to memory of 3364	688	svchost015.exe	92
PID 688 wrote to memory of 3364	688	svchost015.exe	92
PID 688 wrote to memory of 3364	688	svchost015.exe	92
PID 688 wrote to memory of 3364	688	svchost015.exe	92

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2648
- C:\Windows\SysWOW64\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3364

C:\Users\Admin\AppData\Local\Temp\MediaKit\Promo agreement and terms of conditions WEB version.exe
"C:\Users\Admin\AppData\Local\Temp\MediaKit\Promo agreement and terms of conditions WEB version.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Users\Admin\AppData\Local\Temp\svchost015.exe
  C:\Users\Admin\AppData\Local\Temp\svchost015.exe
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:688
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 688 -s 460
    3⤵
    - Program crash
    PID:4132
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 688 -s 368
    3⤵
    - Program crash
    PID:316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 688 -ip 688
1⤵
PID:1112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 688 -ip 688
1⤵
PID:3120

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

svchost015.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost015.exe
Size 2.9MB
SHA256 7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b
MD5 b826dd92d78ea2526e465a34324ebeea
SHA1 bf8a0093acfd2eb93c102e1a5745fb080575372e
SHA512 1ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17
SSDEEP 49152:/INqIwJA7BYAzLOhHpB63X4oQaM35DhnSYf7bPZcYsO5+th1:wNqC7BZEHSQz5DhnSy7ujL
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/688-13-0x0000000003410000-0x0000000003810000-memory.dmp

Download

memory/688-14-0x00007FFB41B10000-0x00007FFB41D05000-memory.dmp

Download

memory/688-4-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/688-16-0x0000000075F60000-0x0000000076175000-memory.dmp

Download

memory/688-10-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/688-9-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/688-8-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/688-11-0x0000000003410000-0x0000000003810000-memory.dmp

Download

memory/688-12-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/2880-2-0x00000000031A0000-0x00000000034F7000-memory.dmp

Download

memory/2880-6-0x0000000000400000-0x00000000007C7000-memory.dmp

Download

memory/2880-0-0x0000000002630000-0x0000000002631000-memory.dmp

Download

memory/3364-17-0x00000000004E0000-0x00000000004E9000-memory.dmp

Download

memory/3364-19-0x0000000002060000-0x0000000002460000-memory.dmp

Download

memory/3364-20-0x0000000002060000-0x0000000002460000-memory.dmp

Download

memory/3364-24-0x0000000002060000-0x0000000002460000-memory.dmp

Download

memory/3364-23-0x0000000075F60000-0x0000000076175000-memory.dmp

Download

memory/3364-21-0x00007FFB41B10000-0x00007FFB41D05000-memory.dmp

Download

memory/3364-25-0x0000000002060000-0x0000000002460000-memory.dmp

Download