rhadamanthys | 876c6f4d85012dc4c8a34598efe8f29c9f238a7b2a55444f45b062df258837ba

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24-09-2024 22:16

Target

876c6f4d85012dc4c8a34598efe8f29c9f238a7b2a55444f45b062df258837ba.exe
Size

437KB
MD5

2d5e47d6206c3f30d06eb38e118f5868
SHA1

5f7cd59b6254a6fe1dfbc4d56cc689deb66a32bf
SHA256

876c6f4d85012dc4c8a34598efe8f29c9f238a7b2a55444f45b062df258837ba
SHA512

d5d40e67f24fabc989ab7ac9627e4a2fea839a52e880a6f9db9982a26c9794c50be8e3be356df3a8c48b15f17364f1c0bb547bba89b9358776052f37aae99329
SSDEEP

12288:WuZZani4FaYkizhRpfX54K+uiE8fZzhzJA:W+ZIi4Z95/54K+uiE8hd

Score

10^/10

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

876c6f4d85012dc4c8a34598efe8f29c9f238a7b2a55444f45b062df258837ba.exe

description	pid	process	target process
PID 2556 wrote to memory of 2608	2556	876c6f4d85012dc4c8a34598efe8f29c9f238a7b2a55444f45b062df258837ba.exe	WerFault.exe
PID 2556 wrote to memory of 2608	2556	876c6f4d85012dc4c8a34598efe8f29c9f238a7b2a55444f45b062df258837ba.exe	WerFault.exe
PID 2556 wrote to memory of 2608	2556	876c6f4d85012dc4c8a34598efe8f29c9f238a7b2a55444f45b062df258837ba.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\876c6f4d85012dc4c8a34598efe8f29c9f238a7b2a55444f45b062df258837ba.exe
"C:\Users\Admin\AppData\Local\Temp\876c6f4d85012dc4c8a34598efe8f29c9f238a7b2a55444f45b062df258837ba.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2556 -s 88
  2⤵
  PID:2608

memory/2556-0-0x000000013FEA0000-0x000000013FF22000-memory.dmp

Filesize
520KB

Download
memory/2556-1-0x000000013FEA0000-0x000000013FF22000-memory.dmp

Filesize
520KB

Download