Behavioral task
behavioral1
Sample
2652-9-0x000000013F490000-0x000000013F516000-memory.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2652-9-0x000000013F490000-0x000000013F516000-memory.exe
Resource
win10v2004-20240802-en
General
-
Target
2652-9-0x000000013F490000-0x000000013F516000-memory.dmp
-
Size
536KB
-
MD5
6ce8ebd0201cf33e89ef7ef14482a743
-
SHA1
6218924d9b69e7ec5c900f92c2e7a22744186466
-
SHA256
b90e166ad379671547a1ca303474d2d91773cc8bfce72e59344ac91ff3d51eb4
-
SHA512
6302a10d6d132427d6de2a94e82f373a8629f1a36dca8d84c42df63f1181ed187936216ba4e00d5348bada50e89d00b8b9769a465188d1d2f4471356545cdcd8
-
SSDEEP
12288:ruZZani4FaYkizhRpfX54K+uiE8fZzhz+iC:r+ZIi4Z95/54K+uiE8hd
Malware Config
Signatures
-
Rhadamanthys family
-
Processes:
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2652-9-0x000000013F490000-0x000000013F516000-memory.dmp
Files
-
2652-9-0x000000013F490000-0x000000013F516000-memory.dmp.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
UPX0 Size: - Virtual size: 300KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
UPX1 Size: 224KB - Virtual size: 224KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE