rhadamanthys | 9909fc2e4c9d14a05605b57cabe8ab4ba9841141b249cd8d3ac8ff6950870f4e

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2023 01:36

Target

162833c025dda5b2154fc193bc71bc3e375794e13f6392f387839599df9d90e0.exe
Size

1.2MB
MD5

b99290063c63c1449c6d61c62f95528d
SHA1

dc80d751832030dbe05bb34e691a6237e2a224b5
SHA256

162833c025dda5b2154fc193bc71bc3e375794e13f6392f387839599df9d90e0
SHA512

4f6b717d1c18042243f7f62009e2638fa51e2a7139285a8469e3ba2458dc658ef6ccc8401b7c1ade0742c4dd6dd7ab98c487165f0142558191e9a7192c57c19c
SSDEEP

12288:UPqvdlwvVVmpmiUkWnbaczXSisUFhiqNnuJCbM/C3irgP92vjy9jhBvcS5K+xlBW:Uy5iV7bTEyhBVdhPTyITdOqa

Score

10^/10

Detect rhadamanthys stealer shellcode 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4276-141-0x0000000002C00000-0x0000000002C1D000-memory.dmp	family_rhadamanthys
behavioral2/memory/4276-144-0x0000000003170000-0x0000000004170000-memory.dmp	family_rhadamanthys
behavioral2/memory/4276-146-0x0000000002C00000-0x0000000002C1D000-memory.dmp	family_rhadamanthys

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

InstallUtil.exe

pid process

4276 InstallUtil.exe
4276 InstallUtil.exe
4276 InstallUtil.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

162833c025dda5b2154fc193bc71bc3e375794e13f6392f387839599df9d90e0.exe

description	pid	process	target process
PID 4548 set thread context of 4276	4548	162833c025dda5b2154fc193bc71bc3e375794e13f6392f387839599df9d90e0.exe	InstallUtil.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

162833c025dda5b2154fc193bc71bc3e375794e13f6392f387839599df9d90e0.exe

description	pid	process	target process
PID 4548 wrote to memory of 4276	4548	162833c025dda5b2154fc193bc71bc3e375794e13f6392f387839599df9d90e0.exe	InstallUtil.exe
PID 4548 wrote to memory of 4276	4548	162833c025dda5b2154fc193bc71bc3e375794e13f6392f387839599df9d90e0.exe	InstallUtil.exe
PID 4548 wrote to memory of 4276	4548	162833c025dda5b2154fc193bc71bc3e375794e13f6392f387839599df9d90e0.exe	InstallUtil.exe
PID 4548 wrote to memory of 4276	4548	162833c025dda5b2154fc193bc71bc3e375794e13f6392f387839599df9d90e0.exe	InstallUtil.exe
PID 4548 wrote to memory of 4276	4548	162833c025dda5b2154fc193bc71bc3e375794e13f6392f387839599df9d90e0.exe	InstallUtil.exe
PID 4548 wrote to memory of 4276	4548	162833c025dda5b2154fc193bc71bc3e375794e13f6392f387839599df9d90e0.exe	InstallUtil.exe
PID 4548 wrote to memory of 4276	4548	162833c025dda5b2154fc193bc71bc3e375794e13f6392f387839599df9d90e0.exe	InstallUtil.exe
PID 4548 wrote to memory of 4276	4548	162833c025dda5b2154fc193bc71bc3e375794e13f6392f387839599df9d90e0.exe	InstallUtil.exe
PID 4548 wrote to memory of 4276	4548	162833c025dda5b2154fc193bc71bc3e375794e13f6392f387839599df9d90e0.exe	InstallUtil.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4276

memory/4276-135-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4276-138-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4276-139-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4276-141-0x0000000002C00000-0x0000000002C1D000-memory.dmp

Filesize
116KB

Download
memory/4276-143-0x0000000002C20000-0x0000000002C3A000-memory.dmp

Filesize
104KB

Download
memory/4276-144-0x0000000003170000-0x0000000004170000-memory.dmp

Filesize
16.0MB

Download
memory/4276-145-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4276-146-0x0000000002C00000-0x0000000002C1D000-memory.dmp

Filesize
116KB

Download
memory/4276-147-0x0000000002C20000-0x0000000002C3A000-memory.dmp

Filesize
104KB

Download
memory/4276-148-0x0000000003170000-0x0000000004170000-memory.dmp

Filesize
16.0MB

Download
memory/4548-133-0x000001DD443B0000-0x000001DD444E8000-memory.dmp

Filesize
1.2MB

Download
memory/4548-134-0x000001DD460E0000-0x000001DD460F0000-memory.dmp

Filesize
64KB

Download