rhadamanthys | 6835d2fb7ed6115fdef679506399d83b641c4e2968d17716aff6b5668c416279

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26-08-2024 11:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Base_STBIDc.exe
Size

1.6MB
MD5

35151094603ecbfe4812758aaf7b9156
SHA1

cdbd4b4ea94295bc952841a70abaf2a98e625da9
SHA256

6835d2fb7ed6115fdef679506399d83b641c4e2968d17716aff6b5668c416279
SHA512

743b8979f08bb116032f139be2cd5d9a92510207ac1f4e3ab194d0ecaa418cc344a5cf420b7e6dfca3e92da4e3f70f2e106b60c59e438800635e955ea9759ba6
SSDEEP

12288:Xk9eNPHnvN2o2GwkOzDBTHG/aFoy2d5iTWjxUPIaC+:XKMPHnvN2hG/OvBGaFop5O

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

Base_STBIDc.exe

description	pid	Process	procid_target
PID 2304 created 1192	2304	Base_STBIDc.exe	21

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

Base_STBIDc.exedialer.exe

pid	Process
2304	Base_STBIDc.exe
2304	Base_STBIDc.exe
2972	dialer.exe
2972	dialer.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

Base_STBIDc.exe

description	pid	Process	procid_target
PID 2304 wrote to memory of 2972	2304	Base_STBIDc.exe	31
PID 2304 wrote to memory of 2972	2304	Base_STBIDc.exe	31
PID 2304 wrote to memory of 2972	2304	Base_STBIDc.exe	31
PID 2304 wrote to memory of 2972	2304	Base_STBIDc.exe	31
PID 2304 wrote to memory of 2972	2304	Base_STBIDc.exe	31

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1192
- C:\Users\Admin\AppData\Local\Temp\Base_STBIDc.exe
  "C:\Users\Admin\AppData\Local\Temp\Base_STBIDc.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2304
- C:\Windows\system32\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2304-2-0x00000000039D0000-0x0000000003DD0000-memory.dmp

Filesize
4.0MB

Download
memory/2304-6-0x000007FEFCD70000-0x000007FEFCDDC000-memory.dmp

Filesize
432KB

Download
memory/2304-8-0x0000000076CC0000-0x0000000076E69000-memory.dmp

Filesize
1.7MB

Download
memory/2304-7-0x0000000076CC1000-0x0000000076DC2000-memory.dmp

Filesize
1.0MB

Download
memory/2304-5-0x0000000076BA0000-0x0000000076CBF000-memory.dmp

Filesize
1.1MB

Download
memory/2304-4-0x00000000039D0000-0x0000000003DD0000-memory.dmp

Filesize
4.0MB

Download
memory/2304-11-0x00000000039D0000-0x0000000003DD0000-memory.dmp

Filesize
4.0MB

Download
memory/2304-10-0x0000000076CC0000-0x0000000076E69000-memory.dmp

Filesize
1.7MB

Download
memory/2304-0-0x0000000000350000-0x00000000003EC000-memory.dmp

Filesize
624KB

Download
memory/2304-1-0x00000000039D0000-0x0000000003DD0000-memory.dmp

Filesize
4.0MB

Download
memory/2972-9-0x00000000000E0000-0x00000000000E9000-memory.dmp

Filesize
36KB

Download
memory/2972-13-0x0000000076CC0000-0x0000000076E69000-memory.dmp

Filesize
1.7MB

Download
memory/2972-14-0x0000000001B80000-0x0000000001F80000-memory.dmp

Filesize
4.0MB

Download
memory/2972-18-0x0000000076CC0000-0x0000000076E69000-memory.dmp

Filesize
1.7MB

Download
memory/2972-16-0x0000000076BA0000-0x0000000076CBF000-memory.dmp

Filesize
1.1MB

Download
memory/2972-15-0x0000000076CC0000-0x0000000076E69000-memory.dmp

Filesize
1.7MB

Download
memory/2972-17-0x000007FEFCD70000-0x000007FEFCDDC000-memory.dmp

Filesize
432KB

Download
memory/2972-19-0x0000000076CC0000-0x0000000076E69000-memory.dmp

Filesize
1.7MB

Download