rhadamanthys | 8161fb4c042aac76e73980d52138488cbb52b0581a34ea312510e3af3413a0c9

Analysis

max time kernel
96s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-09-2024 15:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

download.exe
Size

230KB
MD5

a7e0c20da5405e04b80b5c6a70c21ef5
SHA1

ce2cecc7bef86a654ad0861255c0c829bdba0a1b
SHA256

8161fb4c042aac76e73980d52138488cbb52b0581a34ea312510e3af3413a0c9
SHA512

fc216893f5a73fd343d7896eb73a728eab82c24cb8370c0f4584555b8ce434e43a69b8e317262113d3566296031a52a3dbcf77412d4cb0624e4d29ed39978eb5
SSDEEP

6144:KOqDycyyVJP4E2t+3ydnJhU9vWtrvz3w:Fmyc9UE2t++h6v2/g

Score

10^/10

rhadamanthys stealer upx

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

download.exe

description	pid	Process	procid_target
PID 3884 created 2600	3884	download.exe	44

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3884-0-0x00007FF72D810000-0x00007FF72D896000-memory.dmp	upx
behavioral2/memory/3884-17-0x00007FF72D810000-0x00007FF72D896000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

download.exeopenwith.exe

pid	Process
3884	download.exe
3884	download.exe
2996	openwith.exe
2996	openwith.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

download.exe

description	pid	Process	procid_target
PID 3884 wrote to memory of 2996	3884	download.exe	88
PID 3884 wrote to memory of 2996	3884	download.exe	88
PID 3884 wrote to memory of 2996	3884	download.exe	88
PID 3884 wrote to memory of 2996	3884	download.exe	88

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2600
- C:\Windows\system32\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2996

C:\Users\Admin\AppData\Local\Temp\download.exe
"C:\Users\Admin\AppData\Local\Temp\download.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2996-14-0x000001B9C67E0000-0x000001B9C6BE0000-memory.dmp

Filesize
4.0MB

Download
memory/2996-18-0x000001B9C67E0000-0x000001B9C6BE0000-memory.dmp

Filesize
4.0MB

Download
memory/2996-8-0x000001B9C4CD0000-0x000001B9C4CDA000-memory.dmp

Filesize
40KB

Download
memory/2996-11-0x00007FF923270000-0x00007FF923465000-memory.dmp

Filesize
2.0MB

Download
memory/2996-12-0x00007FF922F40000-0x00007FF922FFE000-memory.dmp

Filesize
760KB

Download
memory/2996-10-0x000001B9C67E0000-0x000001B9C6BE0000-memory.dmp

Filesize
4.0MB

Download
memory/2996-15-0x000001B9C67E0000-0x000001B9C6BE0000-memory.dmp

Filesize
4.0MB

Download
memory/2996-13-0x00007FF920D50000-0x00007FF921019000-memory.dmp

Filesize
2.8MB

Download
memory/3884-6-0x0000027300010000-0x0000027300410000-memory.dmp

Filesize
4.0MB

Download
memory/3884-17-0x00007FF72D810000-0x00007FF72D896000-memory.dmp

Filesize
536KB

Download
memory/3884-0-0x00007FF72D810000-0x00007FF72D896000-memory.dmp

Filesize
536KB

Download
memory/3884-2-0x0000027300010000-0x0000027300410000-memory.dmp

Filesize
4.0MB

Download
memory/3884-7-0x00007FF920D50000-0x00007FF921019000-memory.dmp

Filesize
2.8MB

Download
memory/3884-5-0x00007FF922F40000-0x00007FF922FFE000-memory.dmp

Filesize
760KB

Download
memory/3884-3-0x0000027300010000-0x0000027300410000-memory.dmp

Filesize
4.0MB

Download
memory/3884-4-0x00007FF923270000-0x00007FF923465000-memory.dmp

Filesize
2.0MB

Download
memory/3884-1-0x0000027300010000-0x0000027300410000-memory.dmp

Filesize
4.0MB

Download