Analysis
-
max time kernel
30s -
max time network
32s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
27-11-2024 10:02
General
-
Target
836dfa8ecf57ce861f4cacfe4a85572d.exe
-
Size
448KB
-
MD5
836dfa8ecf57ce861f4cacfe4a85572d
-
SHA1
ab1d13d733ce513953143c64440323b1969925a9
-
SHA256
8af7fadc968927f6d8a4056e3d15808c254bbee4080985d03d377c361e467357
-
SHA512
32f5c37ca495589c7d31f79c987f2f420e3ead46f09a008c2a8107ff81523986dc993b47a0425ff96be0e761177edeea79d272982e818c4935f087bb4e86ca98
-
SSDEEP
6144:qlE8DIpjK28t4sL4wlp3z/pSZ+pDKpf9EkQbKxVK+PXItNOapG8RuzRiRh3Zc:SEpj7sLLv/cgu4VGn6OaM+ucj
Score
10/10
Malware Config
Signatures
-
Detect rhadamanthys stealer shellcode 5 IoCs
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Rhadamanthys family
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\836dfa8ecf57ce861f4cacfe4a85572d.exe"C:\Users\Admin\AppData\Local\Temp\836dfa8ecf57ce861f4cacfe4a85572d.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\system32\certreq.exe"C:\Windows\system32\certreq.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
-
Filesize
28KB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
216KB
-
Filesize
4.0MB