rhadamanthys | 22f47140db34f26f896c3ac4874c17d6acaa4617c8590f25fc475f8a9d2ab462

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 08:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22f47140db34f26f896c3ac4874c17d6acaa4617c8590f25fc475f8a9d2ab462.exe
Size

5.9MB
MD5

c33e71d23c8bc915bac8e70c39f3a930
SHA1

5826bc9cae78700b301f68449d43387bde2774e7
SHA256

22f47140db34f26f896c3ac4874c17d6acaa4617c8590f25fc475f8a9d2ab462
SHA512

f598e74e2c6bd3ae89a4fe9bac8b05cadfec9d080fc06e6e6c4ebb75d584a3f007630a1f82e7ee578fa7ab20e8a08a79c6713762728a440644d1697e1e824bb1
SSDEEP

98304:jVGSguAD8sdU6W9TxRU0Aud3Lwh68wRebfroRepeaUyPgNxwEV/Vb3ljegRaA1om:jf/M8cwl3Lwh69R0fIFuPwrDd+A1

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

AddInProcess32.exe

description pid process target process

PID 4488 created 2556 4488 AddInProcess32.exe sihost.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

22f47140db34f26f896c3ac4874c17d6acaa4617c8590f25fc475f8a9d2ab462.exe

description pid process target process

PID 3504 set thread context of 4488 3504 22f47140db34f26f896c3ac4874c17d6acaa4617c8590f25fc475f8a9d2ab462.exe AddInProcess32.exe
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4300 4488 WerFault.exe AddInProcess32.exe
868 4488 WerFault.exe AddInProcess32.exe

description	pid	process	target process
PID 4488 created 2556	4488	AddInProcess32.exe	sihost.exe

description	pid	process	target process
PID 3504 set thread context of 4488	3504	22f47140db34f26f896c3ac4874c17d6acaa4617c8590f25fc475f8a9d2ab462.exe	AddInProcess32.exe

pid	pid_target	process	target process
4300	4488	WerFault.exe	AddInProcess32.exe
868	4488	WerFault.exe	AddInProcess32.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

22f47140db34f26f896c3ac4874c17d6acaa4617c8590f25fc475f8a9d2ab462.exeAddInProcess32.exedialer.exe

pid	process
3504	22f47140db34f26f896c3ac4874c17d6acaa4617c8590f25fc475f8a9d2ab462.exe
3504	22f47140db34f26f896c3ac4874c17d6acaa4617c8590f25fc475f8a9d2ab462.exe
3504	22f47140db34f26f896c3ac4874c17d6acaa4617c8590f25fc475f8a9d2ab462.exe
3504	22f47140db34f26f896c3ac4874c17d6acaa4617c8590f25fc475f8a9d2ab462.exe
4488	AddInProcess32.exe
4488	AddInProcess32.exe
884	dialer.exe
884	dialer.exe
884	dialer.exe
884	dialer.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

22f47140db34f26f896c3ac4874c17d6acaa4617c8590f25fc475f8a9d2ab462.exe

description pid process

Token: SeDebugPrivilege 3504 22f47140db34f26f896c3ac4874c17d6acaa4617c8590f25fc475f8a9d2ab462.exe

description	pid	process
Token: SeDebugPrivilege	3504	22f47140db34f26f896c3ac4874c17d6acaa4617c8590f25fc475f8a9d2ab462.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

22f47140db34f26f896c3ac4874c17d6acaa4617c8590f25fc475f8a9d2ab462.exeAddInProcess32.exe

description	pid	process	target process
PID 3504 wrote to memory of 5064	3504	22f47140db34f26f896c3ac4874c17d6acaa4617c8590f25fc475f8a9d2ab462.exe	AddInProcess32.exe
PID 3504 wrote to memory of 5064	3504	22f47140db34f26f896c3ac4874c17d6acaa4617c8590f25fc475f8a9d2ab462.exe	AddInProcess32.exe
PID 3504 wrote to memory of 5064	3504	22f47140db34f26f896c3ac4874c17d6acaa4617c8590f25fc475f8a9d2ab462.exe	AddInProcess32.exe
PID 3504 wrote to memory of 5064	3504	22f47140db34f26f896c3ac4874c17d6acaa4617c8590f25fc475f8a9d2ab462.exe	AddInProcess32.exe
PID 3504 wrote to memory of 5064	3504	22f47140db34f26f896c3ac4874c17d6acaa4617c8590f25fc475f8a9d2ab462.exe	AddInProcess32.exe
PID 3504 wrote to memory of 5064	3504	22f47140db34f26f896c3ac4874c17d6acaa4617c8590f25fc475f8a9d2ab462.exe	AddInProcess32.exe
PID 3504 wrote to memory of 5064	3504	22f47140db34f26f896c3ac4874c17d6acaa4617c8590f25fc475f8a9d2ab462.exe	AddInProcess32.exe
PID 3504 wrote to memory of 5064	3504	22f47140db34f26f896c3ac4874c17d6acaa4617c8590f25fc475f8a9d2ab462.exe	AddInProcess32.exe
PID 3504 wrote to memory of 5064	3504	22f47140db34f26f896c3ac4874c17d6acaa4617c8590f25fc475f8a9d2ab462.exe	AddInProcess32.exe
PID 3504 wrote to memory of 5064	3504	22f47140db34f26f896c3ac4874c17d6acaa4617c8590f25fc475f8a9d2ab462.exe	AddInProcess32.exe
PID 3504 wrote to memory of 4488	3504	22f47140db34f26f896c3ac4874c17d6acaa4617c8590f25fc475f8a9d2ab462.exe	AddInProcess32.exe
PID 3504 wrote to memory of 4488	3504	22f47140db34f26f896c3ac4874c17d6acaa4617c8590f25fc475f8a9d2ab462.exe	AddInProcess32.exe
PID 3504 wrote to memory of 4488	3504	22f47140db34f26f896c3ac4874c17d6acaa4617c8590f25fc475f8a9d2ab462.exe	AddInProcess32.exe
PID 3504 wrote to memory of 4488	3504	22f47140db34f26f896c3ac4874c17d6acaa4617c8590f25fc475f8a9d2ab462.exe	AddInProcess32.exe
PID 3504 wrote to memory of 4488	3504	22f47140db34f26f896c3ac4874c17d6acaa4617c8590f25fc475f8a9d2ab462.exe	AddInProcess32.exe
PID 3504 wrote to memory of 4488	3504	22f47140db34f26f896c3ac4874c17d6acaa4617c8590f25fc475f8a9d2ab462.exe	AddInProcess32.exe
PID 3504 wrote to memory of 4488	3504	22f47140db34f26f896c3ac4874c17d6acaa4617c8590f25fc475f8a9d2ab462.exe	AddInProcess32.exe
PID 3504 wrote to memory of 4488	3504	22f47140db34f26f896c3ac4874c17d6acaa4617c8590f25fc475f8a9d2ab462.exe	AddInProcess32.exe
PID 3504 wrote to memory of 4488	3504	22f47140db34f26f896c3ac4874c17d6acaa4617c8590f25fc475f8a9d2ab462.exe	AddInProcess32.exe
PID 3504 wrote to memory of 4488	3504	22f47140db34f26f896c3ac4874c17d6acaa4617c8590f25fc475f8a9d2ab462.exe	AddInProcess32.exe
PID 4488 wrote to memory of 884	4488	AddInProcess32.exe	dialer.exe
PID 4488 wrote to memory of 884	4488	AddInProcess32.exe	dialer.exe
PID 4488 wrote to memory of 884	4488	AddInProcess32.exe	dialer.exe
PID 4488 wrote to memory of 884	4488	AddInProcess32.exe	dialer.exe
PID 4488 wrote to memory of 884	4488	AddInProcess32.exe	dialer.exe

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2556

C:\Windows\SysWOW64\dialer.exe
"C:\Windows\system32\dialer.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:884

C:\Users\Admin\AppData\Local\Temp\22f47140db34f26f896c3ac4874c17d6acaa4617c8590f25fc475f8a9d2ab462.exe
"C:\Users\Admin\AppData\Local\Temp\22f47140db34f26f896c3ac4874c17d6acaa4617c8590f25fc475f8a9d2ab462.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3504

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
2⤵
PID:5064

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 340
3⤵
- Program crash
PID:868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 336
3⤵
- Program crash
PID:4300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4488 -ip 4488
1⤵
PID:3376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4488 -ip 4488
1⤵
PID:4732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/884-24-0x0000000000D70000-0x0000000000D79000-memory.dmp

Filesize
36KB

Download
memory/884-32-0x0000000002AE0000-0x0000000002EE0000-memory.dmp

Filesize
4.0MB

Download
memory/884-26-0x0000000002AE0000-0x0000000002EE0000-memory.dmp

Filesize
4.0MB

Download
memory/884-27-0x0000000002AE0000-0x0000000002EE0000-memory.dmp

Filesize
4.0MB

Download
memory/884-30-0x0000000002AE0000-0x0000000002EE0000-memory.dmp

Filesize
4.0MB

Download
memory/884-31-0x0000000077230000-0x0000000077445000-memory.dmp

Filesize
2.1MB

Download
memory/884-28-0x00007FFCDD290000-0x00007FFCDD485000-memory.dmp

Filesize
2.0MB

Download
memory/3504-7-0x0000000006AA0000-0x0000000006AAA000-memory.dmp

Filesize
40KB

Download
memory/3504-1-0x0000000000910000-0x0000000000EF0000-memory.dmp

Filesize
5.9MB

Download
memory/3504-9-0x0000000074BCE000-0x0000000074BCF000-memory.dmp

Filesize
4KB

Download
memory/3504-10-0x0000000074BC0000-0x0000000075370000-memory.dmp

Filesize
7.7MB

Download
memory/3504-11-0x0000000007E50000-0x0000000007E6A000-memory.dmp

Filesize
104KB

Download
memory/3504-12-0x0000000007E70000-0x0000000007E76000-memory.dmp

Filesize
24KB

Download
memory/3504-8-0x0000000074BC0000-0x0000000075370000-memory.dmp

Filesize
7.7MB

Download
memory/3504-0-0x0000000074BCE000-0x0000000074BCF000-memory.dmp

Filesize
4KB

Download
memory/3504-16-0x0000000074BC0000-0x0000000075370000-memory.dmp

Filesize
7.7MB

Download
memory/3504-2-0x00000000057E0000-0x000000000587C000-memory.dmp

Filesize
624KB

Download
memory/3504-3-0x0000000005E30000-0x00000000063D4000-memory.dmp

Filesize
5.6MB

Download
memory/3504-4-0x0000000005880000-0x0000000005912000-memory.dmp

Filesize
584KB

Download
memory/3504-5-0x0000000074BC0000-0x0000000075370000-memory.dmp

Filesize
7.7MB

Download
memory/3504-6-0x0000000006A20000-0x0000000006A64000-memory.dmp

Filesize
272KB

Download
memory/4488-13-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4488-22-0x0000000077230000-0x0000000077445000-memory.dmp

Filesize
2.1MB

Download
memory/4488-23-0x0000000003C60000-0x0000000004060000-memory.dmp

Filesize
4.0MB

Download
memory/4488-20-0x00007FFCDD290000-0x00007FFCDD485000-memory.dmp

Filesize
2.0MB

Download
memory/4488-19-0x0000000003C60000-0x0000000004060000-memory.dmp

Filesize
4.0MB

Download
memory/4488-18-0x0000000003C60000-0x0000000004060000-memory.dmp

Filesize
4.0MB

Download
memory/4488-17-0x0000000003C60000-0x0000000004060000-memory.dmp

Filesize
4.0MB

Download
memory/4488-15-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4488-33-0x0000000003C60000-0x0000000004060000-memory.dmp

Filesize
4.0MB

Download