rhadamanthys | e1439a6e07503da37e82957c7171c7567eeff71f312923fd1c14d598d9c6fa4b

Analysis

max time kernel
114s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-10-2024 20:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e1439a6e07503da37e82957c7171c7567eeff71f312923fd1c14d598d9c6fa4bN.exe
Size

781KB
MD5

8893d378c3cc09334f80bd7886926120
SHA1

7fd55045fe7f93814187b4f2c1885cf027caaed7
SHA256

e1439a6e07503da37e82957c7171c7567eeff71f312923fd1c14d598d9c6fa4b
SHA512

115115cfa372b4076c35a580c3821e3b46554902ef6568186169e16ecf70d4d1d9789f24f1b0f7d13ec0e87be5ddf3c195e67e11be160603f5833103c81d67d5
SSDEEP

24576:wdLziisXKKzyraHfaVd9Q2mfQEairKCGoQSqr1u2X2:wJmiKKKzyr2fahDmf4iuCGRSq

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2836 created 2968	2836	e1439a6e07503da37e82957c7171c7567eeff71f312923fd1c14d598d9c6fa4bN.exe	50

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2836	e1439a6e07503da37e82957c7171c7567eeff71f312923fd1c14d598d9c6fa4bN.exe
2836	e1439a6e07503da37e82957c7171c7567eeff71f312923fd1c14d598d9c6fa4bN.exe
2108	openwith.exe
2108	openwith.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 2108	2836	e1439a6e07503da37e82957c7171c7567eeff71f312923fd1c14d598d9c6fa4bN.exe	87
PID 2836 wrote to memory of 2108	2836	e1439a6e07503da37e82957c7171c7567eeff71f312923fd1c14d598d9c6fa4bN.exe	87
PID 2836 wrote to memory of 2108	2836	e1439a6e07503da37e82957c7171c7567eeff71f312923fd1c14d598d9c6fa4bN.exe	87
PID 2836 wrote to memory of 2108	2836	e1439a6e07503da37e82957c7171c7567eeff71f312923fd1c14d598d9c6fa4bN.exe	87

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2968
- C:\Windows\system32\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2108

C:\Users\Admin\AppData\Local\Temp\e1439a6e07503da37e82957c7171c7567eeff71f312923fd1c14d598d9c6fa4bN.exe
"C:\Users\Admin\AppData\Local\Temp\e1439a6e07503da37e82957c7171c7567eeff71f312923fd1c14d598d9c6fa4bN.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1028,i,12470628711992022444,7767535593390851522,262144 --variations-seed-version --mojo-platform-channel-handle=4064 /prefetch:8
1⤵
PID:4648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2108-15-0x00000200E9680000-0x00000200E968A000-memory.dmp

Filesize
40KB

Download
memory/2108-25-0x00000200EB220000-0x00000200EB620000-memory.dmp

Filesize
4.0MB

Download
memory/2108-20-0x00007FFEB4890000-0x00007FFEB4A85000-memory.dmp

Filesize
2.0MB

Download
memory/2108-21-0x00007FFEB2FC0000-0x00007FFEB307E000-memory.dmp

Filesize
760KB

Download
memory/2108-23-0x00000200EB220000-0x00000200EB620000-memory.dmp

Filesize
4.0MB

Download
memory/2108-22-0x00007FFEB21B0000-0x00007FFEB2479000-memory.dmp

Filesize
2.8MB

Download
memory/2108-19-0x00000200EB220000-0x00000200EB620000-memory.dmp

Filesize
4.0MB

Download
memory/2836-5-0x0000000000F50000-0x0000000000F56000-memory.dmp

Filesize
24KB

Download
memory/2836-13-0x00007FFE962F0000-0x00007FFE96DB1000-memory.dmp

Filesize
10.8MB

Download
memory/2836-10-0x00007FFE962F0000-0x00007FFE96DB1000-memory.dmp

Filesize
10.8MB

Download
memory/2836-11-0x00007FFEB4890000-0x00007FFEB4A85000-memory.dmp

Filesize
2.0MB

Download
memory/2836-12-0x00007FFEB2FC0000-0x00007FFEB307E000-memory.dmp

Filesize
760KB

Download
memory/2836-14-0x00007FFEB21B0000-0x00007FFEB2479000-memory.dmp

Filesize
2.8MB

Download
memory/2836-7-0x0000000000FA0000-0x0000000000FB0000-memory.dmp

Filesize
64KB

Download
memory/2836-8-0x000000001BC90000-0x000000001C090000-memory.dmp

Filesize
4.0MB

Download
memory/2836-6-0x0000000000F90000-0x0000000000F98000-memory.dmp

Filesize
32KB

Download
memory/2836-0-0x00007FFE962F3000-0x00007FFE962F5000-memory.dmp

Filesize
8KB

Download
memory/2836-4-0x000000001B6E0000-0x000000001B79C000-memory.dmp

Filesize
752KB

Download
memory/2836-24-0x00007FFE962F0000-0x00007FFE96DB1000-memory.dmp

Filesize
10.8MB

Download
memory/2836-3-0x00007FFE962F0000-0x00007FFE96DB1000-memory.dmp

Filesize
10.8MB

Download
memory/2836-2-0x0000000000F40000-0x0000000000F46000-memory.dmp

Filesize
24KB

Download
memory/2836-9-0x000000001BC90000-0x000000001C090000-memory.dmp

Filesize
4.0MB

Download
memory/2836-1-0x00000000006D0000-0x000000000079A000-memory.dmp

Filesize
808KB

Download