Analysis
-
max time kernel
30s -
max time network
13s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
27-11-2024 10:00
General
-
Target
file.exe
-
Size
448KB
-
MD5
2809bff19753a15b31614cddde67f245
-
SHA1
aee8f16a80a6422885f3328d90a3621719249f96
-
SHA256
6266cd88962428cfc873a4c0390491375e91505a66e0165ec476e3be724b9b65
-
SHA512
b3d71df8109f205b3451fcba3bfa6ec5c7a39213d9bd90536d3ba438b8648d10cd1d95921ff8dae0b4797840f136c1e7004ce3b0d36f72a600fb735bc121f404
-
SSDEEP
6144:L/E8DIpjK28t4snQalp3z/pSZ+pDKpf9EkQbKxVK+PXItNOapG8RuzRiRh3Zi:dEpj7snJv/cgu4VGn6OaM+ucj
Score
10/10
Malware Config
Signatures
-
Detect rhadamanthys stealer shellcode 4 IoCs
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Rhadamanthys family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB