rhadamanthys | 8ea9a4de18ad9ce3e32ac2d3d61810ae136c018012142319f41b1a73261069cd

Analysis

max time kernel
147s
max time network
153s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
18/07/2023, 02:23

Target

811dec9ec1252218598615343fe2e04a62a296e3f156778c4d168b4eec8a0bf0.exe
Size

515KB
MD5

b271a785ffc4e33bd3ffa018b28c26e7
SHA1

7757226b475981467ddac73649175d8e99778d02
SHA256

811dec9ec1252218598615343fe2e04a62a296e3f156778c4d168b4eec8a0bf0
SHA512

0af405c499f89ac1ae3a743c5855bbf476711cd575b4be1b24678dfc8638f6d5fd949fb98732d1c8763a708f68b213417aef30120b0a1b5661711db1fa108606
SSDEEP

6144:6LET/MC/wLma7hvJ8w9cyp4vPfbdqHrRG0qMJSJH8kBDeuzvFG:6ozzpW68cyavPTQrRMISJccDeujF

Score

10^/10

Detect rhadamanthys stealer shellcode 5 IoCs

resource	yara_rule
behavioral1/memory/2428-59-0x0000000002090000-0x0000000002490000-memory.dmp	family_rhadamanthys
behavioral1/memory/2428-61-0x0000000002090000-0x0000000002490000-memory.dmp	family_rhadamanthys
behavioral1/memory/2428-62-0x0000000002090000-0x0000000002490000-memory.dmp	family_rhadamanthys
behavioral1/memory/2428-63-0x0000000002090000-0x0000000002490000-memory.dmp	family_rhadamanthys
behavioral1/memory/2428-73-0x0000000002090000-0x0000000002490000-memory.dmp	family_rhadamanthys

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2428 created 1176	2428	811dec9ec1252218598615343fe2e04a62a296e3f156778c4d168b4eec8a0bf0.exe	21

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 1504	2428	811dec9ec1252218598615343fe2e04a62a296e3f156778c4d168b4eec8a0bf0.exe	29
PID 2428 wrote to memory of 1504	2428	811dec9ec1252218598615343fe2e04a62a296e3f156778c4d168b4eec8a0bf0.exe	29
PID 2428 wrote to memory of 1504	2428	811dec9ec1252218598615343fe2e04a62a296e3f156778c4d168b4eec8a0bf0.exe	29
PID 2428 wrote to memory of 1504	2428	811dec9ec1252218598615343fe2e04a62a296e3f156778c4d168b4eec8a0bf0.exe	29
PID 2428 wrote to memory of 1504	2428	811dec9ec1252218598615343fe2e04a62a296e3f156778c4d168b4eec8a0bf0.exe	29
PID 2428 wrote to memory of 1504	2428	811dec9ec1252218598615343fe2e04a62a296e3f156778c4d168b4eec8a0bf0.exe	29

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1176
- C:\Users\Admin\AppData\Local\Temp\811dec9ec1252218598615343fe2e04a62a296e3f156778c4d168b4eec8a0bf0.exe
  "C:\Users\Admin\AppData\Local\Temp\811dec9ec1252218598615343fe2e04a62a296e3f156778c4d168b4eec8a0bf0.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2428
- C:\Windows\system32\certreq.exe
  "C:\Windows\system32\certreq.exe"
  2⤵
  PID:1504

memory/1504-65-0x0000000000060000-0x0000000000063000-memory.dmp

Filesize
12KB

Download
memory/2428-61-0x0000000002090000-0x0000000002490000-memory.dmp

Filesize
4.0MB

Download
memory/2428-57-0x0000000000400000-0x00000000005CD000-memory.dmp

Filesize
1.8MB

Download
memory/2428-58-0x00000000002C0000-0x00000000002C7000-memory.dmp

Filesize
28KB

Download
memory/2428-59-0x0000000002090000-0x0000000002490000-memory.dmp

Filesize
4.0MB

Download
memory/2428-60-0x0000000000400000-0x00000000005CD000-memory.dmp

Filesize
1.8MB

Download
memory/2428-55-0x0000000000A30000-0x0000000000B30000-memory.dmp

Filesize
1024KB

Download
memory/2428-62-0x0000000002090000-0x0000000002490000-memory.dmp

Filesize
4.0MB

Download
memory/2428-63-0x0000000002090000-0x0000000002490000-memory.dmp

Filesize
4.0MB

Download
memory/2428-64-0x0000000000A30000-0x0000000000B30000-memory.dmp

Filesize
1024KB

Download
memory/2428-56-0x0000000000220000-0x0000000000291000-memory.dmp

Filesize
452KB

Download
memory/2428-66-0x0000000000220000-0x0000000000291000-memory.dmp

Filesize
452KB

Download
memory/2428-67-0x0000000000760000-0x0000000000796000-memory.dmp

Filesize
216KB

Download
memory/2428-73-0x0000000002090000-0x0000000002490000-memory.dmp

Filesize
4.0MB

Download