rhadamanthys | 8161fb4c042aac76e73980d52138488cbb52b0581a34ea312510e3af3413a0c9

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-09-2024 15:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

download.exe
Size

230KB
MD5

a7e0c20da5405e04b80b5c6a70c21ef5
SHA1

ce2cecc7bef86a654ad0861255c0c829bdba0a1b
SHA256

8161fb4c042aac76e73980d52138488cbb52b0581a34ea312510e3af3413a0c9
SHA512

fc216893f5a73fd343d7896eb73a728eab82c24cb8370c0f4584555b8ce434e43a69b8e317262113d3566296031a52a3dbcf77412d4cb0624e4d29ed39978eb5
SSDEEP

6144:KOqDycyyVJP4E2t+3ydnJhU9vWtrvz3w:Fmyc9UE2t++h6v2/g

Score

10^/10

rhadamanthys stealer upx

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

download.exe

description pid process target process

PID 2204 created 1216 2204 download.exe Explorer.EXE

description	pid	process	target process
PID 2204 created 1216	2204	download.exe	Explorer.EXE

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2204-0-0x000000013F8D0000-0x000000013F956000-memory.dmp	upx
behavioral1/memory/2204-11-0x000000013F8D0000-0x000000013F956000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

download.exedialer.exe

pid process

2204 download.exe
2204 download.exe
2188 dialer.exe
2188 dialer.exe

pid	process
2204	download.exe
2204	download.exe
2188	dialer.exe
2188	dialer.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

download.exe

description	pid	process	target process
PID 2204 wrote to memory of 2188	2204	download.exe	dialer.exe
PID 2204 wrote to memory of 2188	2204	download.exe	dialer.exe
PID 2204 wrote to memory of 2188	2204	download.exe	dialer.exe
PID 2204 wrote to memory of 2188	2204	download.exe	dialer.exe
PID 2204 wrote to memory of 2188	2204	download.exe	dialer.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1216
- C:\Users\Admin\AppData\Local\Temp\download.exe
  "C:\Users\Admin\AppData\Local\Temp\download.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2204
- C:\Windows\system32\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2188-9-0x0000000000060000-0x000000000006A000-memory.dmp

Filesize
40KB

Download
memory/2188-13-0x0000000001B90000-0x0000000001F90000-memory.dmp

Filesize
4.0MB

Download
memory/2188-18-0x0000000077820000-0x00000000779C9000-memory.dmp

Filesize
1.7MB

Download
memory/2188-14-0x0000000077820000-0x00000000779C9000-memory.dmp

Filesize
1.7MB

Download
memory/2188-15-0x0000000077600000-0x000000007771F000-memory.dmp

Filesize
1.1MB

Download
memory/2188-17-0x0000000077820000-0x00000000779C9000-memory.dmp

Filesize
1.7MB

Download
memory/2188-16-0x000007FEFD6E0000-0x000007FEFD74C000-memory.dmp

Filesize
432KB

Download
memory/2204-5-0x0000000077600000-0x000000007771F000-memory.dmp

Filesize
1.1MB

Download
memory/2204-11-0x000000013F8D0000-0x000000013F956000-memory.dmp

Filesize
536KB

Download
memory/2204-6-0x000007FEFD6E0000-0x000007FEFD74C000-memory.dmp

Filesize
432KB

Download
memory/2204-4-0x0000000077820000-0x00000000779C9000-memory.dmp

Filesize
1.7MB

Download
memory/2204-7-0x0000000002D20000-0x0000000003120000-memory.dmp

Filesize
4.0MB

Download
memory/2204-8-0x0000000077821000-0x0000000077922000-memory.dmp

Filesize
1.0MB

Download
memory/2204-0-0x000000013F8D0000-0x000000013F956000-memory.dmp

Filesize
536KB

Download
memory/2204-2-0x0000000002D20000-0x0000000003120000-memory.dmp

Filesize
4.0MB

Download
memory/2204-3-0x0000000002D20000-0x0000000003120000-memory.dmp

Filesize
4.0MB

Download
memory/2204-1-0x0000000002D20000-0x0000000003120000-memory.dmp

Filesize
4.0MB

Download