rhadamanthys | 34918278f6eb6b5e3afa8da406eb3c5a4cc3b7c4a1cee55320fecdbef4e0a463

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
18-08-2024 13:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

khle.exe
Size

438KB
MD5

ec0f07cb1f1f5b4dd1bd94958c20a5ad
SHA1

84718efb03c2ae32aa2c5800bf135f97275f9a74
SHA256

34918278f6eb6b5e3afa8da406eb3c5a4cc3b7c4a1cee55320fecdbef4e0a463
SHA512

58af6d13d8c43970cc9e964f8418ecb054e177d40f966d2d9e318f540370d219028c4694daf09ba8b101206d54b482f66ce3a2b29ec4716119a21644a899f3d7
SSDEEP

12288:6uZZani4FaYkizhRpfX54K+uiE8XZzhzJ:6+ZIi4Z95/54K+uiE8Jd

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

khle.exe

description	pid	Process	procid_target
PID 2656 created 1164	2656	khle.exe	21

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

khle.exedialer.exe

pid	Process
2656	khle.exe
2656	khle.exe
2712	dialer.exe
2712	dialer.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

khle.exe

description	pid	Process	procid_target
PID 2656 wrote to memory of 2712	2656	khle.exe	30
PID 2656 wrote to memory of 2712	2656	khle.exe	30
PID 2656 wrote to memory of 2712	2656	khle.exe	30
PID 2656 wrote to memory of 2712	2656	khle.exe	30
PID 2656 wrote to memory of 2712	2656	khle.exe	30

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1164
- C:\Users\Admin\AppData\Local\Temp\khle.exe
  "C:\Users\Admin\AppData\Local\Temp\khle.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2656
- C:\Windows\system32\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2712

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2656-5-0x0000000077080000-0x000000007719F000-memory.dmp

Filesize
1.1MB

Download
memory/2656-4-0x00000000772A0000-0x0000000077449000-memory.dmp

Filesize
1.7MB

Download
memory/2656-0-0x000000013F250000-0x000000013F2D2000-memory.dmp

Filesize
520KB

Download
memory/2656-2-0x0000000002D20000-0x0000000003120000-memory.dmp

Filesize
4.0MB

Download
memory/2656-7-0x0000000002D20000-0x0000000003120000-memory.dmp

Filesize
4.0MB

Download
memory/2656-6-0x000007FEFD100000-0x000007FEFD16C000-memory.dmp

Filesize
432KB

Download
memory/2656-8-0x00000000772A1000-0x00000000773A2000-memory.dmp

Filesize
1.0MB

Download
memory/2656-10-0x000000013F250000-0x000000013F2D2000-memory.dmp

Filesize
520KB

Download
memory/2656-3-0x0000000002D20000-0x0000000003120000-memory.dmp

Filesize
4.0MB

Download
memory/2656-1-0x0000000002D20000-0x0000000003120000-memory.dmp

Filesize
4.0MB

Download
memory/2712-9-0x0000000000060000-0x000000000006A000-memory.dmp

Filesize
40KB

Download
memory/2712-12-0x0000000001C80000-0x0000000002080000-memory.dmp

Filesize
4.0MB

Download
memory/2712-16-0x000007FEFD100000-0x000007FEFD16C000-memory.dmp

Filesize
432KB

Download
memory/2712-15-0x0000000077080000-0x000000007719F000-memory.dmp

Filesize
1.1MB

Download
memory/2712-17-0x00000000772A0000-0x0000000077449000-memory.dmp

Filesize
1.7MB

Download
memory/2712-13-0x00000000772A0000-0x0000000077449000-memory.dmp

Filesize
1.7MB

Download
memory/2712-18-0x00000000772A0000-0x0000000077449000-memory.dmp

Filesize
1.7MB

Download