File name:

42edc53eec43edfe500967882f8e7f7e787614223466817b25d71565fdf3b49c.exe

Full analysis: https://app.any.run/tasks/af31a8a4-b242-41a5-9ed5-a8e880b400e3
Verdict: Malicious activity
Threats:

Rhadamanthys is a C++ information-stealing malware that extracts sensitive data from infiltrated machines. Its layered operational chain and advanced evasion tactics make it a major risk in cybersecurity landscapes.

Malware Trends Tracker     >>>
Analysis date: December 09, 2024, 09:41:28
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
autoit
autoit-loader
rhadamanthys
shellcode
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

587C64E7FB7634714813D1CB85F56594

SHA1:

D5B67C6084F6FB6CF5DD62767E52C56608A49173

SHA256:

42EDC53EEC43EDFE500967882F8E7F7E787614223466817B25D71565FDF3B49C

SSDEEP:

49152:dSz/svm14GnkjCCyL6ZCWW+g7CKihFGT/Fr05QAZaJ704ZYGWLrpgmipTxJea7j3:dSDGm+KkjCKZCWWohk/p4faJ7oG8pgmO

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • AutoIt loader has been detected (YARA)

      • Portugal.com (PID: 6680)

    • RHADAMANTHYS has been detected (YARA)

      • svchost.exe (PID: 7088)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • 42edc53eec43edfe500967882f8e7f7e787614223466817b25d71565fdf3b49c.exe (PID: 6256)

    • Executing commands from ".cmd" file

      • 42edc53eec43edfe500967882f8e7f7e787614223466817b25d71565fdf3b49c.exe (PID: 6256)

    • Get information on the list of running processes

      • cmd.exe (PID: 6304)

    • Starts CMD.EXE for commands execution

      • 42edc53eec43edfe500967882f8e7f7e787614223466817b25d71565fdf3b49c.exe (PID: 6256)
      • cmd.exe (PID: 6304)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 6304)

    • Application launched itself

      • cmd.exe (PID: 6304)

    • Executable content was dropped or overwritten

      • cmd.exe (PID: 6304)

    • Starts application with an unusual extension

      • cmd.exe (PID: 6304)

    • Starts the AutoIt3 executable file

      • cmd.exe (PID: 6304)

    • The executable file from the user directory is run by the CMD process

      • Portugal.com (PID: 6680)

    • Executes application which crashes

      • Portugal.com (PID: 6680)

    • The process checks if it is being run in the virtual environment

      • svchost.exe (PID: 7088)

    • Connects to unusual port

      • svchost.exe (PID: 7088)

  • INFO

    • Create files in a temporary directory

      • 42edc53eec43edfe500967882f8e7f7e787614223466817b25d71565fdf3b49c.exe (PID: 6256)

    • Checks supported languages

      • 42edc53eec43edfe500967882f8e7f7e787614223466817b25d71565fdf3b49c.exe (PID: 6256)
      • Portugal.com (PID: 6680)

    • Reads the computer name

      • 42edc53eec43edfe500967882f8e7f7e787614223466817b25d71565fdf3b49c.exe (PID: 6256)
      • Portugal.com (PID: 6680)

    • Process checks computer location settings

      • 42edc53eec43edfe500967882f8e7f7e787614223466817b25d71565fdf3b49c.exe (PID: 6256)

    • Creates a new folder

      • cmd.exe (PID: 6604)

    • Reads mouse settings

      • Portugal.com (PID: 6680)

    • Manual execution by a user

      • svchost.exe (PID: 7088)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2012:02:24 19:19:54+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 28160
InitializedDataSize: 487936
UninitializedDataSize: 16896
EntryPoint: 0x3883
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
14
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 42edc53eec43edfe500967882f8e7f7e787614223466817b25d71565fdf3b49c.exe no specs cmd.exe conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs portugal.com choice.exe no specs #RHADAMANTHYS svchost.exe werfault.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1344C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6680 -s 988C:\Windows\SysWOW64\WerFault.exe—Portugal.com
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
6256"C:\Users\admin\Desktop\42edc53eec43edfe500967882f8e7f7e787614223466817b25d71565fdf3b49c.exe" C:\Users\admin\Desktop\42edc53eec43edfe500967882f8e7f7e787614223466817b25d71565fdf3b49c.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\42edc53eec43edfe500967882f8e7f7e787614223466817b25d71565fdf3b49c.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6304"C:\Windows\System32\cmd.exe" /c copy Spokesman Spokesman.cmd & Spokesman.cmdC:\Windows\SysWOW64\cmd.exe
42edc53eec43edfe500967882f8e7f7e787614223466817b25d71565fdf3b49c.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6324\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6384tasklist C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6392findstr /I "wrsa opssvc" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6528tasklist C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6536findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6604cmd /c md 223565C:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6636findstr /V "ADMINISTRATORPAYMENTHOSPITALSUSA" Representatives C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
2 113
Read events
2 112
Write events
1
Delete events
0

Modification events

(PID) Process:(6680) Portugal.comKey:HKEY_CURRENT_USER\SOFTWARE\SibCode
Operation:writeName:sn3
Value:
155FF0EF9989E7EB9D8EE395ADC85EEF8438A1EBEE1873E5A915C4FF45D7414D471F25CDC7EF7D4135BC4A671463293520B7FDE3C5472F70F1ED101D927F6B5A
Executable files
1
Suspicious files
11
Text files
2
Unknown types
1

Dropped files

PID
Process
Filename
Type
625642edc53eec43edfe500967882f8e7f7e787614223466817b25d71565fdf3b49c.exeC:\Users\admin\AppData\Local\Temp\Spokesmantext
MD5:39E10C7BBF74C7075135FD4D1C2ED830
SHA256:7F0C4F4E2A4F6EC9CE0A7B6E8AE0476EBC2010AC8B238CC9FC7C6DAC1D8204F4
625642edc53eec43edfe500967882f8e7f7e787614223466817b25d71565fdf3b49c.exeC:\Users\admin\AppData\Local\Temp\Arnoldbinary
MD5:E2F271C523D55CED3EEE44C4A61934E1
SHA256:8B34872D1B27E7731D02081B2077A73717330834AB9103A2C6D8B38A5CC006D1
625642edc53eec43edfe500967882f8e7f7e787614223466817b25d71565fdf3b49c.exeC:\Users\admin\AppData\Local\Temp\Causedvc
MD5:36EC98E9E8053DB394A0D699A9DAFB97
SHA256:996DA688F404924D9C1FC5F33B85230DD24922B17DEC8280BDDAE66900121875
625642edc53eec43edfe500967882f8e7f7e787614223466817b25d71565fdf3b49c.exeC:\Users\admin\AppData\Local\Temp\Grandebinary
MD5:217BE826387CD81A76346626E38E3255
SHA256:5472B8C6487B249ECE448A2F7B8C61F187C180A932A3FFF370745027D459B3F1
625642edc53eec43edfe500967882f8e7f7e787614223466817b25d71565fdf3b49c.exeC:\Users\admin\AppData\Local\Temp\Lithuaniabinary
MD5:D322C674D7BE417CF99977E01C4867FB
SHA256:D667EBF87A240085F84F66E010B68600080D75E8F9ABFB47F93A965D7F63BD27
625642edc53eec43edfe500967882f8e7f7e787614223466817b25d71565fdf3b49c.exeC:\Users\admin\AppData\Local\Temp\Articlesbinary
MD5:8401111F3136DA44117AA463E82FB642
SHA256:635FE7802297645C2768B653F13D11A202C92B4A8024727486BDCD20410172B2
6304cmd.exeC:\Users\admin\AppData\Local\Temp\Spokesman.cmdtext
MD5:39E10C7BBF74C7075135FD4D1C2ED830
SHA256:7F0C4F4E2A4F6EC9CE0A7B6E8AE0476EBC2010AC8B238CC9FC7C6DAC1D8204F4
6304cmd.exeC:\Users\admin\AppData\Local\Temp\223565\Portugal.comexecutable
MD5:F1161C72B966AC6017F85D7C006C22D2
SHA256:5861D6EF70F9F16CFE62CDBFAC2E0350DB142232096400B2C228A7BEB7B34C4A
625642edc53eec43edfe500967882f8e7f7e787614223466817b25d71565fdf3b49c.exeC:\Users\admin\AppData\Local\Temp\Representativesbinary
MD5:15498A5DE6DA0FE088C312CF0F846355
SHA256:FBEBA36833911A2E732178E86D9440CBCD1EA520BB11014E4C88FB469C4320C1
625642edc53eec43edfe500967882f8e7f7e787614223466817b25d71565fdf3b49c.exeC:\Users\admin\AppData\Local\Temp\Enclosurebinary
MD5:48831B984296D00E1180107D9C6485A4
SHA256:E59B79C21B799F9BBB6BD52B1A900F5D477D34897FE06D215916ABE723DB4CDB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
29
DNS requests
8
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
244
RUXIMICS.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
440
svchost.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
440
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
244
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.16.204.161:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
440
svchost.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
244
RUXIMICS.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
2.16.253.202:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
whitelisted
www.bing.com
  • 2.16.204.161
  • 2.16.204.132
  • 2.16.204.134
  • 2.16.204.136
  • 2.16.204.135
  • 2.16.204.151
  • 2.16.204.153
  • 2.16.204.157
  • 2.16.204.158
whitelisted
google.com
  • 142.250.185.110
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 2.16.253.202
whitelisted
JmWQDiRcKQsMAugieLviPcHLrs.JmWQDiRcKQsMAugieLviPcHLrs
  • —
unknown
self.events.data.microsoft.com
  • 52.182.143.208
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
42edc53eec43edfe500967882f8e7f7e787614223466817b25d71565fdf3b49c.exe