Analysis
- max time kernel
118s - max time network
118s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
- submitted
05/09/2024, 23:28
General
- Target noname1.exe
- Size 230KB
- Sample240905-3f7rysvckd
- SHA256 8161fb4c042aac76e73980d52138488cbb52b0581a34ea312510e3af3413a0c9
Malware Config
Signatures
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\noname1.exe"C:\Users\Admin\AppData\Local\Temp\noname1.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\system32\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2652-13-0x0000000002CD0000-0x00000000030D0000-memory.dmp
memory/2652-1-0x0000000002CD0000-0x00000000030D0000-memory.dmp
memory/2652-6-0x000007FEFCDA0000-0x000007FEFCE0C000-memory.dmp
memory/2652-5-0x0000000076D20000-0x0000000076E3F000-memory.dmp
memory/2652-4-0x0000000076F40000-0x00000000770E9000-memory.dmp
memory/2652-3-0x0000000002CD0000-0x00000000030D0000-memory.dmp
memory/2652-2-0x0000000002CD0000-0x00000000030D0000-memory.dmp
memory/2652-21-0x0000000002CD0000-0x00000000030D0000-memory.dmp
memory/2652-9-0x000000013F490000-0x000000013F516000-memory.dmp
memory/2652-10-0x0000000076F41000-0x0000000077042000-memory.dmp
memory/2652-0-0x000000013F490000-0x000000013F516000-memory.dmp
memory/2748-18-0x0000000076F40000-0x00000000770E9000-memory.dmp
memory/2748-17-0x0000000076F41000-0x0000000077042000-memory.dmp
memory/2748-20-0x0000000001B70000-0x0000000001F70000-memory.dmp
memory/2748-19-0x0000000076F40000-0x00000000770E9000-memory.dmp
memory/2748-16-0x000007FEFCDA0000-0x000007FEFCE0C000-memory.dmp
memory/2748-15-0x0000000076D20000-0x0000000076E3F000-memory.dmp
memory/2748-14-0x0000000076F40000-0x00000000770E9000-memory.dmp
memory/2748-12-0x0000000001B70000-0x0000000001F70000-memory.dmp
memory/2748-7-0x00000000000E0000-0x00000000000EA000-memory.dmp