File name:

B-O-S-T-R-A-P-E-R.exe

Full analysis: https://app.any.run/tasks/34681267-b382-4dc3-8917-4e29c466eead
Verdict: Malicious activity
Threats:

Rhadamanthys is a C++ information-stealing malware that extracts sensitive data from infiltrated machines. Its layered operational chain and advanced evasion tactics make it a major risk in cybersecurity landscapes.

Malware Trends Tracker     >>>
Analysis date: February 06, 2025, 21:33:53
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
autoit
rhadamanthys
stealer
shellcode
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

6B2997FC7396A92DBA36300B22919EB5

SHA1:

668B7686960603F860850FB3B4717BD339557784

SHA256:

B3372FCA3EB452875F5627F99B6C963684102A0F09F1FEFD604F153DE24B6EA7

SSDEEP:

49152:33AKigfcXKriY/pJHSRXJmpeuwLsWUWyHCE7x2FMOIR+I1gqU2mwp0l/RZORTI2K:3ZDfvriqHSR5mFwLxyiE7x2COxImymsy

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • B-O-S-T-R-A-P-E-R.exe (PID: 1876)

    • RHADAMANTHYS mutex has been found

      • svchost.exe (PID: 2600)
      • Insertion.com (PID: 828)

    • RHADAMANTHYS has been detected (YARA)

      • svchost.exe (PID: 2600)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • B-O-S-T-R-A-P-E-R.exe (PID: 1876)

    • Executing commands from ".cmd" file

      • B-O-S-T-R-A-P-E-R.exe (PID: 1876)

    • Starts CMD.EXE for commands execution

      • B-O-S-T-R-A-P-E-R.exe (PID: 1876)
      • cmd.exe (PID: 1140)

    • Get information on the list of running processes

      • cmd.exe (PID: 1140)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 1140)

    • Application launched itself

      • cmd.exe (PID: 1140)

    • The executable file from the user directory is run by the CMD process

      • Insertion.com (PID: 828)

    • Starts the AutoIt3 executable file

      • cmd.exe (PID: 1140)

    • There is functionality for taking screenshot (YARA)

      • B-O-S-T-R-A-P-E-R.exe (PID: 1876)
      • Insertion.com (PID: 828)

    • The process checks if it is being run in the virtual environment

      • svchost.exe (PID: 2600)

    • Executes application which crashes

      • Insertion.com (PID: 828)

    • Starts application with an unusual extension

      • cmd.exe (PID: 1140)

    • Connects to unusual port

      • svchost.exe (PID: 2600)

  • INFO

    • Reads the computer name

      • B-O-S-T-R-A-P-E-R.exe (PID: 1876)
      • extrac32.exe (PID: 3992)
      • Insertion.com (PID: 828)

    • Process checks computer location settings

      • B-O-S-T-R-A-P-E-R.exe (PID: 1876)

    • Checks supported languages

      • B-O-S-T-R-A-P-E-R.exe (PID: 1876)
      • extrac32.exe (PID: 3992)
      • Insertion.com (PID: 828)

    • Create files in a temporary directory

      • B-O-S-T-R-A-P-E-R.exe (PID: 1876)
      • extrac32.exe (PID: 3992)

    • Creates a new folder

      • cmd.exe (PID: 4592)

    • Manual execution by a user

      • svchost.exe (PID: 2600)

    • Reads mouse settings

      • Insertion.com (PID: 828)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2011:09:26 13:21:28+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 28160
InitializedDataSize: 445952
UninitializedDataSize: 16896
EntryPoint: 0x3883
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
135
Monitored processes
16
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start b-o-s-t-r-a-p-e-r.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs extrac32.exe no specs findstr.exe no specs cmd.exe no specs cmd.exe no specs #RHADAMANTHYS insertion.com choice.exe no specs #RHADAMANTHYS svchost.exe werfault.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
828Insertion.com i C:\Users\admin\AppData\Local\Temp\114908\Insertion.com
cmd.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script (Beta)
Exit code:
3221225477
Version:
3, 3, 15, 5
Modules
Images
c:\users\admin\appdata\local\temp\114908\insertion.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
1064C:\WINDOWS\SysWOW64\WerFault.exe -u -p 828 -s 956C:\Windows\SysWOW64\WerFault.exe—Insertion.com
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
1140"C:\Windows\System32\cmd.exe" /c copy Allow.flv Allow.flv.cmd & Allow.flv.cmdC:\Windows\SysWOW64\cmd.exe—B-O-S-T-R-A-P-E-R.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1544cmd /c copy /b 114908\Insertion.com + Accepting + Organize + Horizontal + Curriculum + Enclosure + Mn + Lauderdale + Podcast + Drop 114908\Insertion.comC:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1876"C:\Users\admin\Desktop\B-O-S-T-R-A-P-E-R.exe" C:\Users\admin\Desktop\B-O-S-T-R-A-P-E-R.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\b-o-s-t-r-a-p-e-r.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2220choice /d y /t 5C:\Windows\SysWOW64\choice.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Offers the user a choice
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\choice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2600"C:\Windows\System32\svchost.exe"C:\Windows\SysWOW64\svchost.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\sechost.dll
3992extrac32 /Y /E Regression.flvC:\Windows\SysWOW64\extrac32.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® CAB File Extract Utility
Exit code:
0
Version:
5.00 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\extrac32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4392cmd /c copy /b ..\Arrow.flv + ..\Approximately.flv + ..\Xi.flv + ..\Webcams.flv + ..\Whore.flv + ..\Strange.flv + ..\Margin.flv + ..\Truck.flv + ..\Bidding.flv + ..\Universal.flv i C:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4544\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
1 607
Read events
1 606
Write events
1
Delete events
0

Modification events

(PID) Process:(828) Insertion.comKey:HKEY_CURRENT_USER\SOFTWARE\SibCode
Operation:writeName:sn3
Value:
3D9C09A518559C5590D783F3A2EF2C5E1E7E7C433A5355C1BF365DC1A35C30B4E0331209D56B2845B8D4756C133FCEB16B573323A4112AF67D046BB680C5796D
Executable files
1
Suspicious files
21
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
1876B-O-S-T-R-A-P-E-R.exeC:\Users\admin\AppData\Local\Temp\Xi.flvbinary
MD5:987B07E1D456F004B7A35E88FF791984
SHA256:A0929566B8C62A41699796E16EA821005AC80A840D122AAD0935897A4686E32F
1876B-O-S-T-R-A-P-E-R.exeC:\Users\admin\AppData\Local\Temp\Allow.flvtext
MD5:1B10CEFA3784BD9CAC99084510034109
SHA256:CAB267C22A7E1B8F4DF5114CDE08C6760A6646298673E47D93600D24BF9FF990
1876B-O-S-T-R-A-P-E-R.exeC:\Users\admin\AppData\Local\Temp\Approximately.flvbinary
MD5:458D31C8A822287564ABD321126CC4C5
SHA256:860A0E3AC28C4B28C39E8D4964DAD0357BC573C43550554D35D65E08CC04F963
1876B-O-S-T-R-A-P-E-R.exeC:\Users\admin\AppData\Local\Temp\Truck.flvbinary
MD5:68C160F7B8A884038FD7242C4D1DED93
SHA256:15EA235F322593D7B3870B71EF57301FC5F757C52ECD96DDB184366A46FCDD3C
1876B-O-S-T-R-A-P-E-R.exeC:\Users\admin\AppData\Local\Temp\Universal.flvtext
MD5:1EF476C38ED819EF26F93A0B2C18420C
SHA256:B8DFB1E9890E598A486616EDA3780DCF34F55AD44F226155FEC3224B91DC8552
1876B-O-S-T-R-A-P-E-R.exeC:\Users\admin\AppData\Local\Temp\Whore.flvbinary
MD5:5D2CCD9B70D4DEEFD08FC908675386EC
SHA256:960707C62BE5A22D21FFE504419A9D86482FBD53666E89DC8ECDF473FC877FF2
1876B-O-S-T-R-A-P-E-R.exeC:\Users\admin\AppData\Local\Temp\Bidding.flvbinary
MD5:7570E7DD9EC2E31753E3A390ED0D63E9
SHA256:E075F183ADD2BD6C90D125CCE5E9F0ACEA0126786EFA11DCB1F3F2DA32FD0E94
1876B-O-S-T-R-A-P-E-R.exeC:\Users\admin\AppData\Local\Temp\Strange.flvbinary
MD5:78616300E951FCC6B6FD8095800864C9
SHA256:EC5E3B6116F6ED603DA490E262F8F3EE0E3542D7959B85746108B920E0B34AE5
1876B-O-S-T-R-A-P-E-R.exeC:\Users\admin\AppData\Local\Temp\Webcams.flvbinary
MD5:B767C911CABA5726F440DE19F7CC4975
SHA256:D48DDE6F01AFF65D0DE56B61DEB5BCA0AF3C65D79B64A10E7B6D69D0C27225D3
3992extrac32.exeC:\Users\admin\AppData\Local\Temp\Greetingbinary
MD5:72508266E8E0D7A42378EC3A84568B14
SHA256:416A6CD59BFC713E8930596DE269EB8DD5DE2061ED840A2DAA5AE649093F3381
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
28
DNS requests
7
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3040
svchost.exe
GET
200
23.48.23.9:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.9:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
3040
svchost.exe
GET
200
23.218.209.163:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.218.209.163:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3040
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3040
svchost.exe
23.48.23.9:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.9:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3040
svchost.exe
23.218.209.163:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3040
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
23.218.209.163:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.206.78
whitelisted
crl.microsoft.com
  • 23.48.23.9
  • 23.48.23.18
  • 23.48.23.58
  • 23.48.23.31
  • 23.48.23.11
  • 23.48.23.32
  • 23.48.23.30
  • 23.48.23.37
  • 23.48.23.50
whitelisted
www.microsoft.com
  • 23.218.209.163
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
whitelisted
pvvJwntRmxBsAlBBmixTL.pvvJwntRmxBsAlBBmixTL
  • —
unknown
self.events.data.microsoft.com
  • 20.189.173.9
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
B-O-S-T-R-A-P-E-R.exe