rhadamanthys | e313cf05660e5631a53dcd2223438433e6df1c5526c8d2582c72a9a3b3fb4ea6

Analysis

max time kernel
152s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 12:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d50e028116d5df70e1315bddf283d6f2ced3754c497d18c5a31c1dbaf618195.exe
Size

378.5MB
MD5

42b344af30bb2cc4ec897a8896e08ac6
SHA1

76c844e2c65c3b9556f837175d04c11985add9f5
SHA256

1d50e028116d5df70e1315bddf283d6f2ced3754c497d18c5a31c1dbaf618195
SHA512

c7a59d5eccac1285f60a66373dd8f175a48af109283413476f1d1ff6b7afa6b189a0919c77f3b6d62911dc362b52391699628869777d70002a2d7c54289ebca0
SSDEEP

49152:lOO26ZtuoHjBw65ivfPxFY/Wc8Mjy+4vDF:lOO1nGRMW9MjEp

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2256 created 3076	2256	katD040.tmp	51

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4224 set thread context of 2256	4224	1d50e028116d5df70e1315bddf283d6f2ced3754c497d18c5a31c1dbaf618195.exe	89

Executes dropped EXE 1 IoCs

pid	Process
2256	katD040.tmp

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2256	katD040.tmp
2256	katD040.tmp
2628	dialer.exe
2628	dialer.exe
2628	dialer.exe
2628	dialer.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4224 wrote to memory of 2256	4224	1d50e028116d5df70e1315bddf283d6f2ced3754c497d18c5a31c1dbaf618195.exe	89
PID 4224 wrote to memory of 2256	4224	1d50e028116d5df70e1315bddf283d6f2ced3754c497d18c5a31c1dbaf618195.exe	89
PID 4224 wrote to memory of 2256	4224	1d50e028116d5df70e1315bddf283d6f2ced3754c497d18c5a31c1dbaf618195.exe	89
PID 4224 wrote to memory of 2256	4224	1d50e028116d5df70e1315bddf283d6f2ced3754c497d18c5a31c1dbaf618195.exe	89
PID 4224 wrote to memory of 2256	4224	1d50e028116d5df70e1315bddf283d6f2ced3754c497d18c5a31c1dbaf618195.exe	89
PID 4224 wrote to memory of 2256	4224	1d50e028116d5df70e1315bddf283d6f2ced3754c497d18c5a31c1dbaf618195.exe	89
PID 4224 wrote to memory of 2256	4224	1d50e028116d5df70e1315bddf283d6f2ced3754c497d18c5a31c1dbaf618195.exe	89
PID 4224 wrote to memory of 2256	4224	1d50e028116d5df70e1315bddf283d6f2ced3754c497d18c5a31c1dbaf618195.exe	89
PID 4224 wrote to memory of 2256	4224	1d50e028116d5df70e1315bddf283d6f2ced3754c497d18c5a31c1dbaf618195.exe	89
PID 2256 wrote to memory of 2628	2256	katD040.tmp	91
PID 2256 wrote to memory of 2628	2256	katD040.tmp	91
PID 2256 wrote to memory of 2628	2256	katD040.tmp	91
PID 2256 wrote to memory of 2628	2256	katD040.tmp	91
PID 2256 wrote to memory of 2628	2256	katD040.tmp	91

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:3076
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2628

C:\Users\Admin\AppData\Local\Temp\1d50e028116d5df70e1315bddf283d6f2ced3754c497d18c5a31c1dbaf618195.exe
"C:\Users\Admin\AppData\Local\Temp\1d50e028116d5df70e1315bddf283d6f2ced3754c497d18c5a31c1dbaf618195.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Users\Admin\AppData\Local\Temp\katD040.tmp
  C:\Users\Admin\AppData\Local\Temp\katD040.tmp
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\katD040.tmp

Filesize
861KB

MD5
66064dbdb70a5eb15ebf3bf65aba254b

SHA1
0284fd320f99f62aca800fb1251eff4c31ec4ed7

SHA256
6a94dbda2dd1edcff2331061d65e1baf09d4861cc7ba590c5ec754f3ac96a795

SHA512
b05c6c09ae7372c381fba591c3cb13a69a2451b9d38da1a95aac89413d7438083475d06796acb5440cd6ec65b030c9fa6cbdaa0d2fe91a926bae6499c360f17f

Download Submit
memory/2256-17-0x0000000076E30000-0x0000000077045000-memory.dmp

Filesize
2.1MB

Download
memory/2256-15-0x00007FFB5CBF0000-0x00007FFB5CDE5000-memory.dmp

Filesize
2.0MB

Download
memory/2256-10-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2256-22-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2256-8-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2256-4-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2256-12-0x0000000002FD0000-0x00000000033D0000-memory.dmp

Filesize
4.0MB

Download
memory/2256-13-0x0000000002FD0000-0x00000000033D0000-memory.dmp

Filesize
4.0MB

Download
memory/2256-14-0x0000000002FD0000-0x00000000033D0000-memory.dmp

Filesize
4.0MB

Download
memory/2256-20-0x0000000000490000-0x0000000000559000-memory.dmp

Filesize
804KB

Download
memory/2256-19-0x0000000002FD0000-0x00000000033D0000-memory.dmp

Filesize
4.0MB

Download
memory/2628-18-0x0000000000320000-0x0000000000329000-memory.dmp

Filesize
36KB

Download
memory/2628-24-0x0000000002410000-0x0000000002810000-memory.dmp

Filesize
4.0MB

Download
memory/2628-25-0x0000000002410000-0x0000000002810000-memory.dmp

Filesize
4.0MB

Download
memory/2628-26-0x00007FFB5CBF0000-0x00007FFB5CDE5000-memory.dmp

Filesize
2.0MB

Download
memory/2628-27-0x0000000002410000-0x0000000002810000-memory.dmp

Filesize
4.0MB

Download
memory/2628-29-0x0000000076E30000-0x0000000077045000-memory.dmp

Filesize
2.1MB

Download
memory/2628-30-0x0000000002410000-0x0000000002810000-memory.dmp

Filesize
4.0MB

Download
memory/4224-1-0x0000000002C60000-0x0000000002E73000-memory.dmp

Filesize
2.1MB

Download
memory/4224-0-0x0000000002420000-0x0000000002421000-memory.dmp

Filesize
4KB

Download
memory/4224-11-0x0000000000400000-0x000000000068C000-memory.dmp

Filesize
2.5MB

Download