rhadamanthys | 60289bfd6a3a67726074cccced70f113419fea3b76c00855fb7dc5fa332d3f7a

General

Target

file.exe
Size

2.8MB
MD5

0da8ff86305920cfdb0ab123d45ffa9d
SHA1

aa31cd0743a25e2f7b4f4f0a217553afdb8e2678
SHA256

60289bfd6a3a67726074cccced70f113419fea3b76c00855fb7dc5fa332d3f7a
SHA512

8a851417a8abe971d682cc8a4bd20640998c552b28abea8d03b21735b126d62622ccb7457aa9e725aa5959f0f1b5f2da2edd51fe559983a916f8ec03251eddb4
SSDEEP

24576:cY1WguK2pXcwC2BTPDLk4U1sFq1v1ZsCgz/Ktu1Dze6HDpLCbJzl7PELTs5KzC9a:QeQC2BT7UeFqZsCgLTLOXfNMd2u6G

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Detect rhadamanthys stealer shellcode 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2044-78-0x00000000003C0000-0x00000000003DC000-memory.dmp	family_rhadamanthys
behavioral1/memory/2044-80-0x00000000003C0000-0x00000000003DC000-memory.dmp	family_rhadamanthys
behavioral1/memory/2044-82-0x00000000003C0000-0x00000000003DC000-memory.dmp	family_rhadamanthys
behavioral1/memory/2044-84-0x00000000003C0000-0x00000000003DC000-memory.dmp	family_rhadamanthys

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

file.exe

pid process

2044 file.exe
2044 file.exe
2044 file.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

file.exe

description pid process target process

PID 920 set thread context of 2044 920 file.exe file.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exefile.exe

pid process

1132 powershell.exe
2044 file.exe
2044 file.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exefile.exe

description pid process

Token: SeDebugPrivilege 1132 powershell.exe
Token: SeDebugPrivilege 920 file.exe

pid	process
2044	file.exe
2044	file.exe
2044	file.exe

description	pid	process	target process
PID 920 set thread context of 2044	920	file.exe	file.exe

pid	process
1132	powershell.exe
2044	file.exe
2044	file.exe

description	pid	process
Token: SeDebugPrivilege	1132	powershell.exe
Token: SeDebugPrivilege	920	file.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

file.exefile.exe

description	pid	process	target process
PID 920 wrote to memory of 1132	920	file.exe	powershell.exe
PID 920 wrote to memory of 1132	920	file.exe	powershell.exe
PID 920 wrote to memory of 1132	920	file.exe	powershell.exe
PID 920 wrote to memory of 1132	920	file.exe	powershell.exe
PID 920 wrote to memory of 2044	920	file.exe	file.exe
PID 920 wrote to memory of 2044	920	file.exe	file.exe
PID 920 wrote to memory of 2044	920	file.exe	file.exe
PID 920 wrote to memory of 2044	920	file.exe	file.exe
PID 920 wrote to memory of 2044	920	file.exe	file.exe
PID 920 wrote to memory of 2044	920	file.exe	file.exe
PID 920 wrote to memory of 2044	920	file.exe	file.exe
PID 920 wrote to memory of 2044	920	file.exe	file.exe
PID 920 wrote to memory of 2044	920	file.exe	file.exe
PID 920 wrote to memory of 2044	920	file.exe	file.exe
PID 2044 wrote to memory of 1832	2044	file.exe	dllhost.exe
PID 2044 wrote to memory of 1832	2044	file.exe	dllhost.exe
PID 2044 wrote to memory of 1832	2044	file.exe	dllhost.exe
PID 2044 wrote to memory of 1832	2044	file.exe	dllhost.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:920

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1132

C:\Users\Admin\AppData\Local\Temp\file.exe
C:\Users\Admin\AppData\Local\Temp\file.exe
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2044

C:\Windows\system32\dllhost.exe
"C:\Windows\system32\dllhost.exe"
3⤵
PID:1832

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/920-54-0x00000000000F0000-0x00000000003C0000-memory.dmp

Filesize
2.8MB

Download
memory/920-55-0x0000000004C60000-0x0000000004DBE000-memory.dmp

Filesize
1.4MB

Download
memory/920-56-0x00000000043D0000-0x0000000004462000-memory.dmp

Filesize
584KB

Download
memory/920-57-0x00000000044B0000-0x00000000044F0000-memory.dmp

Filesize
256KB

Download
memory/920-62-0x00000000044B0000-0x00000000044F0000-memory.dmp

Filesize
256KB

Download
memory/1132-61-0x00000000023A0000-0x00000000023E0000-memory.dmp

Filesize
256KB

Download
memory/1132-60-0x00000000023A0000-0x00000000023E0000-memory.dmp

Filesize
256KB

Download
memory/1132-64-0x00000000023A0000-0x00000000023E0000-memory.dmp

Filesize
256KB

Download
memory/1132-63-0x00000000023A0000-0x00000000023E0000-memory.dmp

Filesize
256KB

Download
memory/1132-65-0x00000000023A0000-0x00000000023E0000-memory.dmp

Filesize
256KB

Download
memory/2044-68-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2044-74-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2044-66-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2044-69-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2044-70-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2044-71-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2044-72-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2044-67-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2044-75-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2044-77-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2044-78-0x00000000003C0000-0x00000000003DC000-memory.dmp

Filesize
112KB

Download
memory/2044-80-0x00000000003C0000-0x00000000003DC000-memory.dmp

Filesize
112KB

Download
memory/2044-81-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2044-82-0x00000000003C0000-0x00000000003DC000-memory.dmp

Filesize
112KB

Download
memory/2044-83-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2044-84-0x00000000003C0000-0x00000000003DC000-memory.dmp

Filesize
112KB

Download

Analysis

Sharing