rhadamanthys | e17377801d9ebb354eba54a77b75eb3b89383c981b2af889c2b5a684edd8d907

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-10-2024 19:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e17377801d9ebb354eba54a77b75eb3b89383c981b2af889c2b5a684edd8d907N.exe
Size

685KB
MD5

b4968ff80e772d6ea3209994c41e74e0
SHA1

044ae1daae08822c2a9490ac8610ee02244d85b6
SHA256

e17377801d9ebb354eba54a77b75eb3b89383c981b2af889c2b5a684edd8d907
SHA512

7affcb602303249407169529dc4adb19df856a9168ef05a6e4c7506932d886ed5a4b1a08803fbdb6296f60f3b5c9ca44fef6f66d7115ff98d0bf4d1236f7aa01
SSDEEP

12288:wf/1RgkVxftfwpdXO95bR0xJdur3P5tbM7YRX4pjERUho2s9Ca7ItJN:W1Rgkzlfwrsd0xJa3xu7YRX4pjMcsk9

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2396 created 1192	2396	e17377801d9ebb354eba54a77b75eb3b89383c981b2af889c2b5a684edd8d907N.exe	21

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2396	e17377801d9ebb354eba54a77b75eb3b89383c981b2af889c2b5a684edd8d907N.exe
2396	e17377801d9ebb354eba54a77b75eb3b89383c981b2af889c2b5a684edd8d907N.exe
2512	dialer.exe
2512	dialer.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 2512	2396	e17377801d9ebb354eba54a77b75eb3b89383c981b2af889c2b5a684edd8d907N.exe	30
PID 2396 wrote to memory of 2512	2396	e17377801d9ebb354eba54a77b75eb3b89383c981b2af889c2b5a684edd8d907N.exe	30
PID 2396 wrote to memory of 2512	2396	e17377801d9ebb354eba54a77b75eb3b89383c981b2af889c2b5a684edd8d907N.exe	30
PID 2396 wrote to memory of 2512	2396	e17377801d9ebb354eba54a77b75eb3b89383c981b2af889c2b5a684edd8d907N.exe	30
PID 2396 wrote to memory of 2512	2396	e17377801d9ebb354eba54a77b75eb3b89383c981b2af889c2b5a684edd8d907N.exe	30

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1192
- C:\Users\Admin\AppData\Local\Temp\e17377801d9ebb354eba54a77b75eb3b89383c981b2af889c2b5a684edd8d907N.exe
  "C:\Users\Admin\AppData\Local\Temp\e17377801d9ebb354eba54a77b75eb3b89383c981b2af889c2b5a684edd8d907N.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2396
- C:\Windows\system32\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2396-9-0x0000000077C80000-0x0000000077E29000-memory.dmp

Filesize
1.7MB

Download
memory/2396-8-0x000007FEF6000000-0x000007FEF69EC000-memory.dmp

Filesize
9.9MB

Download
memory/2396-0-0x000007FEF6003000-0x000007FEF6004000-memory.dmp

Filesize
4KB

Download
memory/2396-3-0x0000000000160000-0x0000000000168000-memory.dmp

Filesize
32KB

Download
memory/2396-4-0x0000000000170000-0x0000000000180000-memory.dmp

Filesize
64KB

Download
memory/2396-5-0x000007FEF6000000-0x000007FEF69EC000-memory.dmp

Filesize
9.9MB

Download
memory/2396-6-0x000000001B4A0000-0x000000001B8A0000-memory.dmp

Filesize
4.0MB

Download
memory/2396-15-0x0000000077C81000-0x0000000077D82000-memory.dmp

Filesize
1.0MB

Download
memory/2396-11-0x000007FEFDC70000-0x000007FEFDCDC000-memory.dmp

Filesize
432KB

Download
memory/2396-7-0x000000001B4A0000-0x000000001B8A0000-memory.dmp

Filesize
4.0MB

Download
memory/2396-2-0x000007FEF6000000-0x000007FEF69EC000-memory.dmp

Filesize
9.9MB

Download
memory/2396-1-0x0000000000980000-0x0000000000A32000-memory.dmp

Filesize
712KB

Download
memory/2396-10-0x0000000077B60000-0x0000000077C7F000-memory.dmp

Filesize
1.1MB

Download
memory/2396-21-0x000007FEF6000000-0x000007FEF69EC000-memory.dmp

Filesize
9.9MB

Download
memory/2512-23-0x0000000001C60000-0x0000000002060000-memory.dmp

Filesize
4.0MB

Download
memory/2512-16-0x0000000077C80000-0x0000000077E29000-memory.dmp

Filesize
1.7MB

Download
memory/2512-17-0x0000000077C80000-0x0000000077E29000-memory.dmp

Filesize
1.7MB

Download
memory/2512-20-0x0000000077C80000-0x0000000077E29000-memory.dmp

Filesize
1.7MB

Download
memory/2512-19-0x000007FEFDC70000-0x000007FEFDCDC000-memory.dmp

Filesize
432KB

Download
memory/2512-18-0x0000000077B60000-0x0000000077C7F000-memory.dmp

Filesize
1.1MB

Download
memory/2512-14-0x0000000001C60000-0x0000000002060000-memory.dmp

Filesize
4.0MB

Download
memory/2512-22-0x0000000077C80000-0x0000000077E29000-memory.dmp

Filesize
1.7MB

Download
memory/2512-12-0x0000000000060000-0x000000000006A000-memory.dmp

Filesize
40KB

Download