rhadamanthys | 2de38fdcc1a866b3c931c3b8965699f558b9eca102695b721c9174cab19d169d

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
01-05-2023 16:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2de38fdcc1a866b3c931c3b8965699f558b9eca102695b721c9174cab19d169d.exe
Size

369KB
MD5

23db03e4b67fa91144106fd64b4fffd2
SHA1

cbb0db5067c366e44278d31f5529684f2c19c5e8
SHA256

2de38fdcc1a866b3c931c3b8965699f558b9eca102695b721c9174cab19d169d
SHA512

12a22a39c104d0e67ac0ab04e5a5f39b66c55751f7860bced28a32a9dc8b8aad86f45ab99e607efa9aafa99ea82aa3549e27b505078a4c6997e18121f909fc84
SSDEEP

6144:dtT9hotZ2hBGKa9JBJz9EDwNNZgKIk1y7BF2+:TTns4PGdXBwMNNZsk1yVR

Score

10^/10

rhadamanthys stealer

Malware Config

Extracted

Family

rhadamanthys

http://179.43.142.201/img/favicon.png

Signatures

Detect rhadamanthys stealer shellcode 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4588-142-0x00000000005D0000-0x00000000005EC000-memory.dmp	family_rhadamanthys
behavioral1/memory/4588-143-0x00000000005D0000-0x00000000005EC000-memory.dmp	family_rhadamanthys
behavioral1/memory/4588-145-0x00000000005D0000-0x00000000005EC000-memory.dmp	family_rhadamanthys
behavioral1/memory/4588-147-0x00000000005D0000-0x00000000005EC000-memory.dmp	family_rhadamanthys

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of SetThreadContext 1 IoCs

Processes:

2de38fdcc1a866b3c931c3b8965699f558b9eca102695b721c9174cab19d169d.exe

description	pid	process	target process
PID 1468 set thread context of 4588	1468	2de38fdcc1a866b3c931c3b8965699f558b9eca102695b721c9174cab19d169d.exe	2de38fdcc1a866b3c931c3b8965699f558b9eca102695b721c9174cab19d169d.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

2de38fdcc1a866b3c931c3b8965699f558b9eca102695b721c9174cab19d169d.exe

description	pid	process	target process
PID 1468 wrote to memory of 4588	1468	2de38fdcc1a866b3c931c3b8965699f558b9eca102695b721c9174cab19d169d.exe	2de38fdcc1a866b3c931c3b8965699f558b9eca102695b721c9174cab19d169d.exe
PID 1468 wrote to memory of 4588	1468	2de38fdcc1a866b3c931c3b8965699f558b9eca102695b721c9174cab19d169d.exe	2de38fdcc1a866b3c931c3b8965699f558b9eca102695b721c9174cab19d169d.exe
PID 1468 wrote to memory of 4588	1468	2de38fdcc1a866b3c931c3b8965699f558b9eca102695b721c9174cab19d169d.exe	2de38fdcc1a866b3c931c3b8965699f558b9eca102695b721c9174cab19d169d.exe
PID 1468 wrote to memory of 4588	1468	2de38fdcc1a866b3c931c3b8965699f558b9eca102695b721c9174cab19d169d.exe	2de38fdcc1a866b3c931c3b8965699f558b9eca102695b721c9174cab19d169d.exe
PID 1468 wrote to memory of 4588	1468	2de38fdcc1a866b3c931c3b8965699f558b9eca102695b721c9174cab19d169d.exe	2de38fdcc1a866b3c931c3b8965699f558b9eca102695b721c9174cab19d169d.exe
PID 1468 wrote to memory of 4588	1468	2de38fdcc1a866b3c931c3b8965699f558b9eca102695b721c9174cab19d169d.exe	2de38fdcc1a866b3c931c3b8965699f558b9eca102695b721c9174cab19d169d.exe
PID 1468 wrote to memory of 4588	1468	2de38fdcc1a866b3c931c3b8965699f558b9eca102695b721c9174cab19d169d.exe	2de38fdcc1a866b3c931c3b8965699f558b9eca102695b721c9174cab19d169d.exe
PID 1468 wrote to memory of 4588	1468	2de38fdcc1a866b3c931c3b8965699f558b9eca102695b721c9174cab19d169d.exe	2de38fdcc1a866b3c931c3b8965699f558b9eca102695b721c9174cab19d169d.exe
PID 1468 wrote to memory of 4588	1468	2de38fdcc1a866b3c931c3b8965699f558b9eca102695b721c9174cab19d169d.exe	2de38fdcc1a866b3c931c3b8965699f558b9eca102695b721c9174cab19d169d.exe

C:\Users\Admin\AppData\Local\Temp\2de38fdcc1a866b3c931c3b8965699f558b9eca102695b721c9174cab19d169d.exe
"C:\Users\Admin\AppData\Local\Temp\2de38fdcc1a866b3c931c3b8965699f558b9eca102695b721c9174cab19d169d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Users\Admin\AppData\Local\Temp\2de38fdcc1a866b3c931c3b8965699f558b9eca102695b721c9174cab19d169d.exe
  "C:\Users\Admin\AppData\Local\Temp\2de38fdcc1a866b3c931c3b8965699f558b9eca102695b721c9174cab19d169d.exe"
  2⤵
  PID:4588

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1468-136-0x00000000021A0000-0x00000000021CF000-memory.dmp

Filesize
188KB

Download
memory/4588-142-0x00000000005D0000-0x00000000005EC000-memory.dmp

Filesize
112KB

Download
memory/4588-135-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4588-137-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4588-138-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4588-139-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4588-134-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4588-143-0x00000000005D0000-0x00000000005EC000-memory.dmp

Filesize
112KB

Download
memory/4588-144-0x00000000005F0000-0x000000000060A000-memory.dmp

Filesize
104KB

Download
memory/4588-145-0x00000000005D0000-0x00000000005EC000-memory.dmp

Filesize
112KB

Download
memory/4588-146-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4588-147-0x00000000005D0000-0x00000000005EC000-memory.dmp

Filesize
112KB

Download
memory/4588-148-0x00000000005F0000-0x000000000060A000-memory.dmp

Filesize
104KB

Download