rhadamanthys | 9722d6334bdc365eadebe9e8ddac2eb0fe01fe1c82cf059f32e2e9e91948fc0d

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-10-2024 10:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9722d6334bdc365eadebe9e8ddac2eb0fe01fe1c82cf059f32e2e9e91948fc0d.exe
Size

678KB
MD5

7286d3201342805034fb07a07675a630
SHA1

9bbd895e887afe9b5a2fa320ecc695189df9cc5e
SHA256

9722d6334bdc365eadebe9e8ddac2eb0fe01fe1c82cf059f32e2e9e91948fc0d
SHA512

64c549d4666704e604f7ce8d78deb848cefed34680f5b9e32a7ee009ff5c3d6505197132b97039e8842aa1836f2bddc0af95f4dd9e47aff340f620b48a85d55f
SSDEEP

12288:Af/1RgkVxftfwpdXO95bR0xJdur3P5tbM7YRX4pjERUho2s9Ca7ItJ:G1Rgkzlfwrsd0xJa3xu7YRX4pjMcsk9

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4768 created 3020	4768	9722d6334bdc365eadebe9e8ddac2eb0fe01fe1c82cf059f32e2e9e91948fc0d.exe	50

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4768	9722d6334bdc365eadebe9e8ddac2eb0fe01fe1c82cf059f32e2e9e91948fc0d.exe
4768	9722d6334bdc365eadebe9e8ddac2eb0fe01fe1c82cf059f32e2e9e91948fc0d.exe
5020	openwith.exe
5020	openwith.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 5020	4768	9722d6334bdc365eadebe9e8ddac2eb0fe01fe1c82cf059f32e2e9e91948fc0d.exe	84
PID 4768 wrote to memory of 5020	4768	9722d6334bdc365eadebe9e8ddac2eb0fe01fe1c82cf059f32e2e9e91948fc0d.exe	84
PID 4768 wrote to memory of 5020	4768	9722d6334bdc365eadebe9e8ddac2eb0fe01fe1c82cf059f32e2e9e91948fc0d.exe	84
PID 4768 wrote to memory of 5020	4768	9722d6334bdc365eadebe9e8ddac2eb0fe01fe1c82cf059f32e2e9e91948fc0d.exe	84

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:3020
- C:\Windows\system32\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5020

C:\Users\Admin\AppData\Local\Temp\9722d6334bdc365eadebe9e8ddac2eb0fe01fe1c82cf059f32e2e9e91948fc0d.exe
"C:\Users\Admin\AppData\Local\Temp\9722d6334bdc365eadebe9e8ddac2eb0fe01fe1c82cf059f32e2e9e91948fc0d.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4768

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4768-16-0x00007FF849A40000-0x00007FF84A501000-memory.dmp

Filesize
10.8MB

Download
memory/4768-1-0x0000000000ED0000-0x0000000000F80000-memory.dmp

Filesize
704KB

Download
memory/4768-2-0x00007FF849A40000-0x00007FF84A501000-memory.dmp

Filesize
10.8MB

Download
memory/4768-4-0x0000000003050000-0x0000000003060000-memory.dmp

Filesize
64KB

Download
memory/4768-3-0x0000000003040000-0x0000000003048000-memory.dmp

Filesize
32KB

Download
memory/4768-5-0x000000001BE50000-0x000000001C250000-memory.dmp

Filesize
4.0MB

Download
memory/4768-7-0x00007FF849A40000-0x00007FF84A501000-memory.dmp

Filesize
10.8MB

Download
memory/4768-6-0x000000001BE50000-0x000000001C250000-memory.dmp

Filesize
4.0MB

Download
memory/4768-9-0x00007FF85A020000-0x00007FF85A0DE000-memory.dmp

Filesize
760KB

Download
memory/4768-8-0x00007FF85BC10000-0x00007FF85BE05000-memory.dmp

Filesize
2.0MB

Download
memory/4768-0-0x00007FF849A43000-0x00007FF849A45000-memory.dmp

Filesize
8KB

Download
memory/4768-10-0x00007FF859590000-0x00007FF859859000-memory.dmp

Filesize
2.8MB

Download
memory/4768-15-0x00007FF849A40000-0x00007FF84A501000-memory.dmp

Filesize
10.8MB

Download
memory/5020-11-0x0000022ADD4E0000-0x0000022ADD4EA000-memory.dmp

Filesize
40KB

Download
memory/5020-14-0x0000022ADF0D0000-0x0000022ADF4D0000-memory.dmp

Filesize
4.0MB

Download
memory/5020-20-0x00007FF859590000-0x00007FF859859000-memory.dmp

Filesize
2.8MB

Download
memory/5020-21-0x0000022ADF0D0000-0x0000022ADF4D0000-memory.dmp

Filesize
4.0MB

Download
memory/5020-22-0x0000022ADF0D0000-0x0000022ADF4D0000-memory.dmp

Filesize
4.0MB

Download
memory/5020-19-0x00007FF85A020000-0x00007FF85A0DE000-memory.dmp

Filesize
760KB

Download
memory/5020-18-0x00007FF85BC10000-0x00007FF85BE05000-memory.dmp

Filesize
2.0MB

Download
memory/5020-17-0x0000022ADF0D0000-0x0000022ADF4D0000-memory.dmp

Filesize
4.0MB

Download