rhadamanthys | c571c64b91f117d2c59d80ef624507cb321d2c23a10166137d61ca4256d675ce

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
15-06-2024 19:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-15_329a36f52485ea098ab3432ecbb1952d_avoslocker.exe
Size

24.1MB
MD5

329a36f52485ea098ab3432ecbb1952d
SHA1

40f4ebe110f7fd02e84c054be92386640775aa7b
SHA256

c571c64b91f117d2c59d80ef624507cb321d2c23a10166137d61ca4256d675ce
SHA512

86a1f3e30159d8f4f3e6f80c912b526657f1933f3dbc1d64fc998476dffabc6aea154a1a36443a647b6e40238bcfb56c63783c996c1e0053658ca1b6074227fe
SSDEEP

393216:i0qpshZ+HQ7+HaJpecDr63xoIEGOmxlmXu00Mbz4dunERjgZG6xenwLv8PV2:i0ushlXqHEGjlc1b8gG+smv8o

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

2024-06-15_329a36f52485ea098ab3432ecbb1952d_avoslocker.exe

description pid process target process

PID 4332 created 2612 4332 2024-06-15_329a36f52485ea098ab3432ecbb1952d_avoslocker.exe sihost.exe
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4992 4332 WerFault.exe 2024-06-15_329a36f52485ea098ab3432ecbb1952d_avoslocker.exe
4352 4332 WerFault.exe 2024-06-15_329a36f52485ea098ab3432ecbb1952d_avoslocker.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

2024-06-15_329a36f52485ea098ab3432ecbb1952d_avoslocker.exedialer.exe

pid process

4332 2024-06-15_329a36f52485ea098ab3432ecbb1952d_avoslocker.exe
4332 2024-06-15_329a36f52485ea098ab3432ecbb1952d_avoslocker.exe
716 dialer.exe
716 dialer.exe
716 dialer.exe
716 dialer.exe

description	pid	process	target process
PID 4332 created 2612	4332	2024-06-15_329a36f52485ea098ab3432ecbb1952d_avoslocker.exe	sihost.exe

pid	pid_target	process	target process
4992	4332	WerFault.exe	2024-06-15_329a36f52485ea098ab3432ecbb1952d_avoslocker.exe
4352	4332	WerFault.exe	2024-06-15_329a36f52485ea098ab3432ecbb1952d_avoslocker.exe

pid	process
4332	2024-06-15_329a36f52485ea098ab3432ecbb1952d_avoslocker.exe
4332	2024-06-15_329a36f52485ea098ab3432ecbb1952d_avoslocker.exe
716	dialer.exe
716	dialer.exe
716	dialer.exe
716	dialer.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

2024-06-15_329a36f52485ea098ab3432ecbb1952d_avoslocker.exe

description	pid	process	target process
PID 4332 wrote to memory of 716	4332	2024-06-15_329a36f52485ea098ab3432ecbb1952d_avoslocker.exe	dialer.exe
PID 4332 wrote to memory of 716	4332	2024-06-15_329a36f52485ea098ab3432ecbb1952d_avoslocker.exe	dialer.exe
PID 4332 wrote to memory of 716	4332	2024-06-15_329a36f52485ea098ab3432ecbb1952d_avoslocker.exe	dialer.exe
PID 4332 wrote to memory of 716	4332	2024-06-15_329a36f52485ea098ab3432ecbb1952d_avoslocker.exe	dialer.exe
PID 4332 wrote to memory of 716	4332	2024-06-15_329a36f52485ea098ab3432ecbb1952d_avoslocker.exe	dialer.exe

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2612

C:\Windows\SysWOW64\dialer.exe
"C:\Windows\system32\dialer.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:716

C:\Users\Admin\AppData\Local\Temp\2024-06-15_329a36f52485ea098ab3432ecbb1952d_avoslocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-15_329a36f52485ea098ab3432ecbb1952d_avoslocker.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 468
2⤵
- Program crash
PID:4992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 420
2⤵
- Program crash
PID:4352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4332 -ip 4332
1⤵
PID:1756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4332 -ip 4332
1⤵
PID:3056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/716-16-0x00000000003E0000-0x00000000003E9000-memory.dmp

Filesize
36KB

Download
memory/716-25-0x0000000002150000-0x0000000002550000-memory.dmp

Filesize
4.0MB

Download
memory/716-24-0x0000000002150000-0x0000000002550000-memory.dmp

Filesize
4.0MB

Download
memory/716-22-0x0000000076FD0000-0x00000000771E5000-memory.dmp

Filesize
2.1MB

Download
memory/716-19-0x00007FFB505F0000-0x00007FFB507E5000-memory.dmp

Filesize
2.0MB

Download
memory/716-21-0x0000000002150000-0x0000000002550000-memory.dmp

Filesize
4.0MB

Download
memory/716-18-0x0000000002150000-0x0000000002550000-memory.dmp

Filesize
4.0MB

Download
memory/4332-6-0x0000000003850000-0x0000000003854000-memory.dmp

Filesize
16KB

Download
memory/4332-5-0x0000000003840000-0x0000000003847000-memory.dmp

Filesize
28KB

Download
memory/4332-10-0x0000000000400000-0x0000000001C1E000-memory.dmp

Filesize
24.1MB

Download
memory/4332-11-0x0000000004A70000-0x0000000004E70000-memory.dmp

Filesize
4.0MB

Download
memory/4332-12-0x0000000004A70000-0x0000000004E70000-memory.dmp

Filesize
4.0MB

Download
memory/4332-13-0x00007FFB505F0000-0x00007FFB507E5000-memory.dmp

Filesize
2.0MB

Download
memory/4332-15-0x0000000076FD0000-0x00000000771E5000-memory.dmp

Filesize
2.1MB

Download
memory/4332-4-0x0000000003840000-0x0000000003847000-memory.dmp

Filesize
28KB

Download
memory/4332-7-0x0000000003850000-0x0000000003854000-memory.dmp

Filesize
16KB

Download
memory/4332-1-0x0000000000404000-0x000000000041E000-memory.dmp

Filesize
104KB

Download
memory/4332-9-0x0000000003860000-0x0000000003879000-memory.dmp

Filesize
100KB

Download
memory/4332-8-0x0000000003860000-0x0000000003879000-memory.dmp

Filesize
100KB

Download
memory/4332-3-0x0000000003830000-0x000000000383A000-memory.dmp

Filesize
40KB

Download
memory/4332-23-0x0000000004A70000-0x0000000004E70000-memory.dmp

Filesize
4.0MB

Download
memory/4332-2-0x0000000003830000-0x000000000383A000-memory.dmp

Filesize
40KB

Download