Analysis
- max time kernel
99s - max time network
102s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
05/09/2024, 23:28
General
- Target noname1.exe
- Size 230KB
- Sample240905-3f7rysvckd
- SHA256 8161fb4c042aac76e73980d52138488cbb52b0581a34ea312510e3af3413a0c9
Malware Config
Signatures
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\openwith.exe"C:\Windows\system32\openwith.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\noname1.exe"C:\Users\Admin\AppData\Local\Temp\noname1.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2172-10-0x00007FF769710000-0x00007FF769796000-memory.dmp
memory/2172-1-0x0000024D00010000-0x0000024D00410000-memory.dmp
memory/2172-3-0x0000024D00010000-0x0000024D00410000-memory.dmp
memory/2172-2-0x0000024D00010000-0x0000024D00410000-memory.dmp
memory/2172-4-0x00007FF802AF0000-0x00007FF802CE5000-memory.dmp
memory/2172-7-0x0000024D00010000-0x0000024D00410000-memory.dmp
memory/2172-6-0x00007FF8004B0000-0x00007FF800779000-memory.dmp
memory/2172-5-0x00007FF800D80000-0x00007FF800E3E000-memory.dmp
memory/2172-0-0x00007FF769710000-0x00007FF769796000-memory.dmp
memory/4964-15-0x00007FF8004B0000-0x00007FF800779000-memory.dmp
memory/4964-16-0x0000027F4C460000-0x0000027F4C860000-memory.dmp
memory/4964-13-0x00007FF802AF0000-0x00007FF802CE5000-memory.dmp
memory/4964-17-0x0000027F4C460000-0x0000027F4C860000-memory.dmp
memory/4964-12-0x0000027F4C460000-0x0000027F4C860000-memory.dmp
memory/4964-14-0x00007FF800D80000-0x00007FF800E3E000-memory.dmp
memory/4964-8-0x0000027F4A9F0000-0x0000027F4A9FA000-memory.dmp