rhadamanthys | 8161fb4c042aac76e73980d52138488cbb52b0581a34ea312510e3af3413a0c9

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-09-2024 23:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

noname1.exe
Size

230KB
MD5

a7e0c20da5405e04b80b5c6a70c21ef5
SHA1

ce2cecc7bef86a654ad0861255c0c829bdba0a1b
SHA256

8161fb4c042aac76e73980d52138488cbb52b0581a34ea312510e3af3413a0c9
SHA512

fc216893f5a73fd343d7896eb73a728eab82c24cb8370c0f4584555b8ce434e43a69b8e317262113d3566296031a52a3dbcf77412d4cb0624e4d29ed39978eb5
SSDEEP

6144:KOqDycyyVJP4E2t+3ydnJhU9vWtrvz3w:Fmyc9UE2t++h6v2/g

Score

10^/10

rhadamanthys stealer upx

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

noname1.exe

description pid process target process

PID 2652 created 1228 2652 noname1.exe Explorer.EXE

description	pid	process	target process
PID 2652 created 1228	2652	noname1.exe	Explorer.EXE

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2652-0-0x000000013F490000-0x000000013F516000-memory.dmp	upx
behavioral1/memory/2652-9-0x000000013F490000-0x000000013F516000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

noname1.exedialer.exe

pid process

2652 noname1.exe
2652 noname1.exe
2748 dialer.exe
2748 dialer.exe

pid	process
2652	noname1.exe
2652	noname1.exe
2748	dialer.exe
2748	dialer.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

noname1.exe

description	pid	process	target process
PID 2652 wrote to memory of 2748	2652	noname1.exe	dialer.exe
PID 2652 wrote to memory of 2748	2652	noname1.exe	dialer.exe
PID 2652 wrote to memory of 2748	2652	noname1.exe	dialer.exe
PID 2652 wrote to memory of 2748	2652	noname1.exe	dialer.exe
PID 2652 wrote to memory of 2748	2652	noname1.exe	dialer.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1228
- C:\Users\Admin\AppData\Local\Temp\noname1.exe
  "C:\Users\Admin\AppData\Local\Temp\noname1.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2652
- C:\Windows\system32\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2652-13-0x0000000002CD0000-0x00000000030D0000-memory.dmp

Filesize
4.0MB

Download
memory/2652-9-0x000000013F490000-0x000000013F516000-memory.dmp

Filesize
536KB

Download
memory/2652-6-0x000007FEFCDA0000-0x000007FEFCE0C000-memory.dmp

Filesize
432KB

Download
memory/2652-5-0x0000000076D20000-0x0000000076E3F000-memory.dmp

Filesize
1.1MB

Download
memory/2652-4-0x0000000076F40000-0x00000000770E9000-memory.dmp

Filesize
1.7MB

Download
memory/2652-3-0x0000000002CD0000-0x00000000030D0000-memory.dmp

Filesize
4.0MB

Download
memory/2652-2-0x0000000002CD0000-0x00000000030D0000-memory.dmp

Filesize
4.0MB

Download
memory/2652-0-0x000000013F490000-0x000000013F516000-memory.dmp

Filesize
536KB

Download
memory/2652-21-0x0000000002CD0000-0x00000000030D0000-memory.dmp

Filesize
4.0MB

Download
memory/2652-1-0x0000000002CD0000-0x00000000030D0000-memory.dmp

Filesize
4.0MB

Download
memory/2652-10-0x0000000076F41000-0x0000000077042000-memory.dmp

Filesize
1.0MB

Download
memory/2748-14-0x0000000076F40000-0x00000000770E9000-memory.dmp

Filesize
1.7MB

Download
memory/2748-17-0x0000000076F41000-0x0000000077042000-memory.dmp

Filesize
1.0MB

Download
memory/2748-20-0x0000000001B70000-0x0000000001F70000-memory.dmp

Filesize
4.0MB

Download
memory/2748-19-0x0000000076F40000-0x00000000770E9000-memory.dmp

Filesize
1.7MB

Download
memory/2748-16-0x000007FEFCDA0000-0x000007FEFCE0C000-memory.dmp

Filesize
432KB

Download
memory/2748-15-0x0000000076D20000-0x0000000076E3F000-memory.dmp

Filesize
1.1MB

Download
memory/2748-18-0x0000000076F40000-0x00000000770E9000-memory.dmp

Filesize
1.7MB

Download
memory/2748-12-0x0000000001B70000-0x0000000001F70000-memory.dmp

Filesize
4.0MB

Download
memory/2748-7-0x00000000000E0000-0x00000000000EA000-memory.dmp

Filesize
40KB

Download