Analysis
- max time kernel
142s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
08/08/2024, 18:14
General
- Target 5b2c5bd17a50bf0ffcc6b80277274ec4b6373aef889e22b896738df9b08d687f(1).exe
- Size 438KB
- Sample240808-wvb59sxaqk
- SHA256 5b2c5bd17a50bf0ffcc6b80277274ec4b6373aef889e22b896738df9b08d687f
Malware Config
Signatures
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\openwith.exe"C:\Windows\system32\openwith.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\5b2c5bd17a50bf0ffcc6b80277274ec4b6373aef889e22b896738df9b08d687f(1).exe"C:\Users\Admin\AppData\Local\Temp\5b2c5bd17a50bf0ffcc6b80277274ec4b6373aef889e22b896738df9b08d687f(1).exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=2820,i,10369132178352108590,11047993562598554317,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3032-0-0x00007FF6ED8E0000-0x00007FF6ED962000-memory.dmp
memory/3032-1-0x0000021000010000-0x0000021000410000-memory.dmp
memory/3032-3-0x0000021000010000-0x0000021000410000-memory.dmp
memory/3032-2-0x0000021000010000-0x0000021000410000-memory.dmp
memory/3032-5-0x0000021000010000-0x0000021000410000-memory.dmp
memory/3032-4-0x00007FFFCE690000-0x00007FFFCE885000-memory.dmp
memory/3032-6-0x00007FFFCD770000-0x00007FFFCD82E000-memory.dmp
memory/3032-7-0x00007FFFCBE00000-0x00007FFFCC0C9000-memory.dmp
memory/3032-11-0x00007FF6ED8E0000-0x00007FF6ED962000-memory.dmp
memory/4872-10-0x00000269E8830000-0x00000269E8C30000-memory.dmp
memory/4872-16-0x00000269E8830000-0x00000269E8C30000-memory.dmp
memory/4872-15-0x00000269E8830000-0x00000269E8C30000-memory.dmp
memory/4872-17-0x00000269E8830000-0x00000269E8C30000-memory.dmp
memory/4872-14-0x00007FFFCBE00000-0x00007FFFCC0C9000-memory.dmp
memory/4872-13-0x00007FFFCD770000-0x00007FFFCD82E000-memory.dmp
memory/4872-12-0x00007FFFCE690000-0x00007FFFCE885000-memory.dmp
memory/4872-8-0x00000269E6D30000-0x00000269E6D3A000-memory.dmp