rhadamanthys | 2e1444499438a47d083214d2b9f3e0af3b5bb164219bee59f0b584fe2df18ed8

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
07-08-2024 18:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e1444499438a47d083214d2b9f3e0af3b5bb164219bee59f0b584fe2df18ed8.exe
Size

360KB
MD5

b87affd72eb26d3466795d92485cf59f
SHA1

b8a17fda447f29f20c95a86f6a856b0e95d24d8f
SHA256

2e1444499438a47d083214d2b9f3e0af3b5bb164219bee59f0b584fe2df18ed8
SHA512

b47407e588100fb6ffedff129c7d49f1c0297ae4b6d91375f33896fda336e0abbeef2c8bc9fbdb4b5bd5d4f296a0478e9bb84f6bc05e691c2695cfd246bae35a
SSDEEP

6144:9l4ypBt/6bC6p/8jJkJaVnQUKRnazBrRYJs3mb2stMK39V8s98ixP:f1t/6+6pWG8aRna9RYSQTXtV8s98E

Score

10^/10

rhadamanthys agilenet stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

2e1444499438a47d083214d2b9f3e0af3b5bb164219bee59f0b584fe2df18ed8.exe

description	pid	Process	procid_target
PID 536 created 1220	536	2e1444499438a47d083214d2b9f3e0af3b5bb164219bee59f0b584fe2df18ed8.exe	21

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral1/memory/536-1-0x0000000000D30000-0x0000000000D90000-memory.dmp	agile_net

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

2e1444499438a47d083214d2b9f3e0af3b5bb164219bee59f0b584fe2df18ed8.exedialer.exe

pid	Process
536	2e1444499438a47d083214d2b9f3e0af3b5bb164219bee59f0b584fe2df18ed8.exe
536	2e1444499438a47d083214d2b9f3e0af3b5bb164219bee59f0b584fe2df18ed8.exe
3024	dialer.exe
3024	dialer.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

2e1444499438a47d083214d2b9f3e0af3b5bb164219bee59f0b584fe2df18ed8.exe

description	pid	Process	procid_target
PID 536 wrote to memory of 3024	536	2e1444499438a47d083214d2b9f3e0af3b5bb164219bee59f0b584fe2df18ed8.exe	31
PID 536 wrote to memory of 3024	536	2e1444499438a47d083214d2b9f3e0af3b5bb164219bee59f0b584fe2df18ed8.exe	31
PID 536 wrote to memory of 3024	536	2e1444499438a47d083214d2b9f3e0af3b5bb164219bee59f0b584fe2df18ed8.exe	31
PID 536 wrote to memory of 3024	536	2e1444499438a47d083214d2b9f3e0af3b5bb164219bee59f0b584fe2df18ed8.exe	31
PID 536 wrote to memory of 3024	536	2e1444499438a47d083214d2b9f3e0af3b5bb164219bee59f0b584fe2df18ed8.exe	31

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1220
- C:\Users\Admin\AppData\Local\Temp\2e1444499438a47d083214d2b9f3e0af3b5bb164219bee59f0b584fe2df18ed8.exe
  "C:\Users\Admin\AppData\Local\Temp\2e1444499438a47d083214d2b9f3e0af3b5bb164219bee59f0b584fe2df18ed8.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:536
- C:\Windows\system32\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/536-11-0x000000001B5C0000-0x000000001B5D0000-memory.dmp

Filesize
64KB

Download
memory/536-24-0x000007FEF57B0000-0x000007FEF619C000-memory.dmp

Filesize
9.9MB

Download
memory/536-0-0x000007FEF57B3000-0x000007FEF57B4000-memory.dmp

Filesize
4KB

Download
memory/536-3-0x000000001B5C0000-0x000000001B9C0000-memory.dmp

Filesize
4.0MB

Download
memory/536-8-0x000007FEFD450000-0x000007FEFD4BC000-memory.dmp

Filesize
432KB

Download
memory/536-7-0x00000000771C0000-0x00000000772DF000-memory.dmp

Filesize
1.1MB

Download
memory/536-6-0x00000000772E0000-0x0000000077489000-memory.dmp

Filesize
1.7MB

Download
memory/536-10-0x00000000003D0000-0x00000000003E0000-memory.dmp

Filesize
64KB

Download
memory/536-5-0x000007FEF57B0000-0x000007FEF619C000-memory.dmp

Filesize
9.9MB

Download
memory/536-12-0x000000001B5D0000-0x000000001B9C0000-memory.dmp

Filesize
3.9MB

Download
memory/536-2-0x00000000003D0000-0x00000000003E0000-memory.dmp

Filesize
64KB

Download
memory/536-1-0x0000000000D30000-0x0000000000D90000-memory.dmp

Filesize
384KB

Download
memory/536-4-0x000000001B5C0000-0x000000001B9C0000-memory.dmp

Filesize
4.0MB

Download
memory/536-14-0x00000000772E1000-0x00000000773E2000-memory.dmp

Filesize
1.0MB

Download
memory/3024-17-0x0000000001BF0000-0x0000000001FF0000-memory.dmp

Filesize
4.0MB

Download
memory/3024-16-0x0000000000060000-0x0000000000069000-memory.dmp

Filesize
36KB

Download
memory/3024-20-0x000007FEFD450000-0x000007FEFD4BC000-memory.dmp

Filesize
432KB

Download
memory/3024-19-0x00000000771C0000-0x00000000772DF000-memory.dmp

Filesize
1.1MB

Download
memory/3024-22-0x00000000772E1000-0x00000000773E2000-memory.dmp

Filesize
1.0MB

Download
memory/3024-21-0x0000000001BF0000-0x0000000001FF0000-memory.dmp

Filesize
4.0MB

Download
memory/3024-18-0x00000000772E0000-0x0000000077489000-memory.dmp

Filesize
1.7MB

Download
memory/3024-23-0x0000000001BF0000-0x0000000001FF0000-memory.dmp

Filesize
4.0MB

Download
memory/3024-9-0x0000000000060000-0x0000000000069000-memory.dmp

Filesize
36KB

Download