rhadamanthys | 8161fb4c042aac76e73980d52138488cbb52b0581a34ea312510e3af3413a0c9

Analysis

max time kernel
99s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-09-2024 23:28

Target

noname1.exe
Size

230KB
MD5

a7e0c20da5405e04b80b5c6a70c21ef5
SHA1

ce2cecc7bef86a654ad0861255c0c829bdba0a1b
SHA256

8161fb4c042aac76e73980d52138488cbb52b0581a34ea312510e3af3413a0c9
SHA512

fc216893f5a73fd343d7896eb73a728eab82c24cb8370c0f4584555b8ce434e43a69b8e317262113d3566296031a52a3dbcf77412d4cb0624e4d29ed39978eb5
SSDEEP

6144:KOqDycyyVJP4E2t+3ydnJhU9vWtrvz3w:Fmyc9UE2t++h6v2/g

Score

10^/10

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

noname1.exe

description pid process target process

PID 2172 created 2808 2172 noname1.exe sihost.exe

description	pid	process	target process
PID 2172 created 2808	2172	noname1.exe	sihost.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/2172-0-0x00007FF769710000-0x00007FF769796000-memory.dmp	upx
behavioral2/memory/2172-10-0x00007FF769710000-0x00007FF769796000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

noname1.exeopenwith.exe

pid process

2172 noname1.exe
2172 noname1.exe
4964 openwith.exe
4964 openwith.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

noname1.exe

description	pid	process	target process
PID 2172 wrote to memory of 4964	2172	noname1.exe	openwith.exe
PID 2172 wrote to memory of 4964	2172	noname1.exe	openwith.exe
PID 2172 wrote to memory of 4964	2172	noname1.exe	openwith.exe
PID 2172 wrote to memory of 4964	2172	noname1.exe	openwith.exe

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2808
- C:\Windows\system32\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4964

memory/2172-10-0x00007FF769710000-0x00007FF769796000-memory.dmp

Filesize
536KB

Download
memory/2172-1-0x0000024D00010000-0x0000024D00410000-memory.dmp

Filesize
4.0MB

Download
memory/2172-3-0x0000024D00010000-0x0000024D00410000-memory.dmp

Filesize
4.0MB

Download
memory/2172-2-0x0000024D00010000-0x0000024D00410000-memory.dmp

Filesize
4.0MB

Download
memory/2172-4-0x00007FF802AF0000-0x00007FF802CE5000-memory.dmp

Filesize
2.0MB

Download
memory/2172-7-0x0000024D00010000-0x0000024D00410000-memory.dmp

Filesize
4.0MB

Download
memory/2172-6-0x00007FF8004B0000-0x00007FF800779000-memory.dmp

Filesize
2.8MB

Download
memory/2172-5-0x00007FF800D80000-0x00007FF800E3E000-memory.dmp

Filesize
760KB

Download
memory/2172-0-0x00007FF769710000-0x00007FF769796000-memory.dmp

Filesize
536KB

Download
memory/4964-15-0x00007FF8004B0000-0x00007FF800779000-memory.dmp

Filesize
2.8MB

Download
memory/4964-16-0x0000027F4C460000-0x0000027F4C860000-memory.dmp

Filesize
4.0MB

Download
memory/4964-13-0x00007FF802AF0000-0x00007FF802CE5000-memory.dmp

Filesize
2.0MB

Download
memory/4964-17-0x0000027F4C460000-0x0000027F4C860000-memory.dmp

Filesize
4.0MB

Download
memory/4964-12-0x0000027F4C460000-0x0000027F4C860000-memory.dmp

Filesize
4.0MB

Download
memory/4964-14-0x00007FF800D80000-0x00007FF800E3E000-memory.dmp

Filesize
760KB

Download
memory/4964-8-0x0000027F4A9F0000-0x0000027F4A9FA000-memory.dmp

Filesize
40KB

Download