rhadamanthys | b1be23345dbd3740f9ef660fe23471ee12889cf341c12b1067a2edcac2f74fef

Analysis

max time kernel
97s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2024 04:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

test.exe
Size

437KB
MD5

0cfc0309bcf83d589d9ebdb1a84fe2f1
SHA1

f6cd1d5e7390de8a24398a79209d1a8ce2726647
SHA256

b1be23345dbd3740f9ef660fe23471ee12889cf341c12b1067a2edcac2f74fef
SHA512

ca1a702bf8b46cf07ddf3aa89f8c96208093bfd2bb56b9d87db6fca3bda416bcad14262fbcb6e228763fd64a8d162422afa2010d14b723fd37f4479096ab0b40
SSDEEP

12288:BuZZani4FaYkizhRpfX54K+uiE8fZzhzJA:B+ZIi4Z95/54K+uiE8hd

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

test.exe

description pid process target process

PID 4112 created 2608 4112 test.exe sihost.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

test.exeopenwith.exe

pid process

4112 test.exe
4112 test.exe
4560 openwith.exe
4560 openwith.exe

description	pid	process	target process
PID 4112 created 2608	4112	test.exe	sihost.exe

pid	process
4112	test.exe
4112	test.exe
4560	openwith.exe
4560	openwith.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

test.exe

description	pid	process	target process
PID 4112 wrote to memory of 4560	4112	test.exe	openwith.exe
PID 4112 wrote to memory of 4560	4112	test.exe	openwith.exe
PID 4112 wrote to memory of 4560	4112	test.exe	openwith.exe
PID 4112 wrote to memory of 4560	4112	test.exe	openwith.exe

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2608
- C:\Windows\system32\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4560

C:\Users\Admin\AppData\Local\Temp\test.exe
"C:\Users\Admin\AppData\Local\Temp\test.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4112-5-0x00007FFAECD90000-0x00007FFAECF85000-memory.dmp

Filesize
2.0MB

Download
memory/4112-1-0x00007FF7C6BB0000-0x00007FF7C6C32000-memory.dmp

Filesize
520KB

Download
memory/4112-2-0x0000020285E30000-0x0000020286230000-memory.dmp

Filesize
4.0MB

Download
memory/4112-3-0x0000020285E30000-0x0000020286230000-memory.dmp

Filesize
4.0MB

Download
memory/4112-4-0x0000020285E30000-0x0000020286230000-memory.dmp

Filesize
4.0MB

Download
memory/4112-7-0x0000020285E30000-0x0000020286230000-memory.dmp

Filesize
4.0MB

Download
memory/4112-8-0x00007FFAEA830000-0x00007FFAEAAF9000-memory.dmp

Filesize
2.8MB

Download
memory/4112-11-0x00007FF7C6BB0000-0x00007FF7C6C32000-memory.dmp

Filesize
520KB

Download
memory/4112-0-0x00007FF7C6BB0000-0x00007FF7C6C32000-memory.dmp

Filesize
520KB

Download
memory/4112-6-0x00007FFAEBE20000-0x00007FFAEBEDE000-memory.dmp

Filesize
760KB

Download
memory/4560-14-0x00007FFAECD90000-0x00007FFAECF85000-memory.dmp

Filesize
2.0MB

Download
memory/4560-16-0x00007FFAEA830000-0x00007FFAEAAF9000-memory.dmp

Filesize
2.8MB

Download
memory/4560-17-0x0000016038280000-0x0000016038680000-memory.dmp

Filesize
4.0MB

Download
memory/4560-18-0x0000016038280000-0x0000016038680000-memory.dmp

Filesize
4.0MB

Download
memory/4560-15-0x00007FFAEBE20000-0x00007FFAEBEDE000-memory.dmp

Filesize
760KB

Download
memory/4560-13-0x0000016038280000-0x0000016038680000-memory.dmp

Filesize
4.0MB

Download
memory/4560-12-0x0000016038280000-0x0000016038680000-memory.dmp

Filesize
4.0MB

Download
memory/4560-9-0x0000016036730000-0x000001603673A000-memory.dmp

Filesize
40KB

Download