rhadamanthys | 2e1444499438a47d083214d2b9f3e0af3b5bb164219bee59f0b584fe2df18ed8

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07-08-2024 18:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e1444499438a47d083214d2b9f3e0af3b5bb164219bee59f0b584fe2df18ed8.exe
Size

360KB
MD5

b87affd72eb26d3466795d92485cf59f
SHA1

b8a17fda447f29f20c95a86f6a856b0e95d24d8f
SHA256

2e1444499438a47d083214d2b9f3e0af3b5bb164219bee59f0b584fe2df18ed8
SHA512

b47407e588100fb6ffedff129c7d49f1c0297ae4b6d91375f33896fda336e0abbeef2c8bc9fbdb4b5bd5d4f296a0478e9bb84f6bc05e691c2695cfd246bae35a
SSDEEP

6144:9l4ypBt/6bC6p/8jJkJaVnQUKRnazBrRYJs3mb2stMK39V8s98ixP:f1t/6+6pWG8aRna9RYSQTXtV8s98E

Score

10^/10

rhadamanthys agilenet stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

2e1444499438a47d083214d2b9f3e0af3b5bb164219bee59f0b584fe2df18ed8.exe

description	pid	Process	procid_target
PID 116 created 2624	116	2e1444499438a47d083214d2b9f3e0af3b5bb164219bee59f0b584fe2df18ed8.exe	44

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral2/memory/116-0-0x0000000000E40000-0x0000000000EA0000-memory.dmp	agile_net

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

2e1444499438a47d083214d2b9f3e0af3b5bb164219bee59f0b584fe2df18ed8.exedialer.exe

pid	Process
116	2e1444499438a47d083214d2b9f3e0af3b5bb164219bee59f0b584fe2df18ed8.exe
116	2e1444499438a47d083214d2b9f3e0af3b5bb164219bee59f0b584fe2df18ed8.exe
3664	dialer.exe
3664	dialer.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2e1444499438a47d083214d2b9f3e0af3b5bb164219bee59f0b584fe2df18ed8.exe

description	pid	Process	procid_target
PID 116 wrote to memory of 3664	116	2e1444499438a47d083214d2b9f3e0af3b5bb164219bee59f0b584fe2df18ed8.exe	83
PID 116 wrote to memory of 3664	116	2e1444499438a47d083214d2b9f3e0af3b5bb164219bee59f0b584fe2df18ed8.exe	83
PID 116 wrote to memory of 3664	116	2e1444499438a47d083214d2b9f3e0af3b5bb164219bee59f0b584fe2df18ed8.exe	83
PID 116 wrote to memory of 3664	116	2e1444499438a47d083214d2b9f3e0af3b5bb164219bee59f0b584fe2df18ed8.exe	83

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2624
- C:\Windows\system32\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3664

C:\Users\Admin\AppData\Local\Temp\2e1444499438a47d083214d2b9f3e0af3b5bb164219bee59f0b584fe2df18ed8.exe
"C:\Users\Admin\AppData\Local\Temp\2e1444499438a47d083214d2b9f3e0af3b5bb164219bee59f0b584fe2df18ed8.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/116-7-0x00007FF8A1680000-0x00007FF8A173E000-memory.dmp

Filesize
760KB

Download
memory/116-3-0x000000001BB10000-0x000000001BF10000-memory.dmp

Filesize
4.0MB

Download
memory/116-1-0x00007FF883D33000-0x00007FF883D35000-memory.dmp

Filesize
8KB

Download
memory/116-15-0x00007FF883D30000-0x00007FF8847F1000-memory.dmp

Filesize
10.8MB

Download
memory/116-16-0x00007FF883D30000-0x00007FF8847F1000-memory.dmp

Filesize
10.8MB

Download
memory/116-6-0x00007FF883D30000-0x00007FF8847F1000-memory.dmp

Filesize
10.8MB

Download
memory/116-5-0x00007FF8A1DB0000-0x00007FF8A1FA5000-memory.dmp

Filesize
2.0MB

Download
memory/116-8-0x00007FF89F940000-0x00007FF89FC09000-memory.dmp

Filesize
2.8MB

Download
memory/116-12-0x0000000002EF0000-0x0000000002F00000-memory.dmp

Filesize
64KB

Download
memory/116-13-0x000000001BB20000-0x000000001BF10000-memory.dmp

Filesize
3.9MB

Download
memory/116-2-0x0000000002EF0000-0x0000000002F00000-memory.dmp

Filesize
64KB

Download
memory/116-0-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Filesize
384KB

Download
memory/116-4-0x000000001BB10000-0x000000001BF10000-memory.dmp

Filesize
4.0MB

Download
memory/3664-14-0x0000020185F50000-0x0000020186350000-memory.dmp

Filesize
4.0MB

Download
memory/3664-9-0x0000020184440000-0x0000020184449000-memory.dmp

Filesize
36KB

Download
memory/3664-17-0x0000020185F50000-0x0000020186350000-memory.dmp

Filesize
4.0MB

Download
memory/3664-20-0x00007FF89F940000-0x00007FF89FC09000-memory.dmp

Filesize
2.8MB

Download
memory/3664-21-0x0000020185F50000-0x0000020186350000-memory.dmp

Filesize
4.0MB

Download
memory/3664-19-0x00007FF8A1680000-0x00007FF8A173E000-memory.dmp

Filesize
760KB

Download
memory/3664-18-0x00007FF8A1DB0000-0x00007FF8A1FA5000-memory.dmp

Filesize
2.0MB

Download
memory/3664-22-0x0000020185F50000-0x0000020186350000-memory.dmp

Filesize
4.0MB

Download