Analysis
- max time kernel
148s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
07/08/2024, 18:55
General
- Target 2e1444499438a47d083214d2b9f3e0af3b5bb164219bee59f0b584fe2df18ed8.exe
- Size 360KB
- Sample240807-xk64bswanf
- SHA256 2e1444499438a47d083214d2b9f3e0af3b5bb164219bee59f0b584fe2df18ed8
Malware Config
Signatures
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\2e1444499438a47d083214d2b9f3e0af3b5bb164219bee59f0b584fe2df18ed8.exe"C:\Users\Admin\AppData\Local\Temp\2e1444499438a47d083214d2b9f3e0af3b5bb164219bee59f0b584fe2df18ed8.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/116-7-0x00007FF8A1680000-0x00007FF8A173E000-memory.dmp
memory/116-16-0x00007FF883D30000-0x00007FF8847F1000-memory.dmp
memory/116-2-0x0000000002EF0000-0x0000000002F00000-memory.dmp
memory/116-4-0x000000001BB10000-0x000000001BF10000-memory.dmp
memory/116-3-0x000000001BB10000-0x000000001BF10000-memory.dmp
memory/116-6-0x00007FF883D30000-0x00007FF8847F1000-memory.dmp
memory/116-5-0x00007FF8A1DB0000-0x00007FF8A1FA5000-memory.dmp
memory/116-1-0x00007FF883D33000-0x00007FF883D35000-memory.dmp
memory/116-12-0x0000000002EF0000-0x0000000002F00000-memory.dmp
memory/116-13-0x000000001BB20000-0x000000001BF10000-memory.dmp
memory/116-0-0x0000000000E40000-0x0000000000EA0000-memory.dmp
memory/116-15-0x00007FF883D30000-0x00007FF8847F1000-memory.dmp
memory/116-8-0x00007FF89F940000-0x00007FF89FC09000-memory.dmp
memory/3664-14-0x0000020185F50000-0x0000020186350000-memory.dmp
memory/3664-17-0x0000020185F50000-0x0000020186350000-memory.dmp
memory/3664-9-0x0000020184440000-0x0000020184449000-memory.dmp
memory/3664-20-0x00007FF89F940000-0x00007FF89FC09000-memory.dmp
memory/3664-21-0x0000020185F50000-0x0000020186350000-memory.dmp
memory/3664-19-0x00007FF8A1680000-0x00007FF8A173E000-memory.dmp
memory/3664-18-0x00007FF8A1DB0000-0x00007FF8A1FA5000-memory.dmp
memory/3664-22-0x0000020185F50000-0x0000020186350000-memory.dmp