rhadamanthys | d014f4a31cd1f2627fb32fcc475524e3e8d21e9ece6da99b6b2390ccbdfffb2a

Resubmissions

27-11-2024 10:03

18-07-2023 09:02

max time kernel
60s
max time network
64s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
18-07-2023 09:02

Target

unpack_rhadamanthys.exe
Size

452KB
MD5

ebb380831920a1bcc24417fe110b68ee
SHA1

ede3b70c25a2607e002085c12690e1b083b836af
SHA256

d014f4a31cd1f2627fb32fcc475524e3e8d21e9ece6da99b6b2390ccbdfffb2a
SHA512

3e5e66e2ac3be257eddb843aae9f7dc868834332aeb9028da024ca88cdc0639fa734a7b4718a381c143feb2489168e0b0098664b04675173f6ab10b5ac1b61af
SSDEEP

6144:qlE8DIpjK28t4sL4glp3z/pSZ+pDKpf9EkQbKxVK+PXItNOapG8RuzRiRh3ZcZ:SEpj7sLTv/cgu4VGn6OaM+ucjo

Score

10^/10

Detect rhadamanthys stealer shellcode 5 IoCs

resource	yara_rule
behavioral1/memory/2180-55-0x0000000001E60000-0x0000000002260000-memory.dmp	family_rhadamanthys
behavioral1/memory/2180-56-0x0000000001E60000-0x0000000002260000-memory.dmp	family_rhadamanthys
behavioral1/memory/2180-57-0x0000000001E60000-0x0000000002260000-memory.dmp	family_rhadamanthys
behavioral1/memory/2180-58-0x0000000001E60000-0x0000000002260000-memory.dmp	family_rhadamanthys
behavioral1/memory/2180-66-0x0000000001E60000-0x0000000002260000-memory.dmp	family_rhadamanthys

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2180 created 1328	2180	unpack_rhadamanthys.exe	16

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2500	2180	unpack_rhadamanthys.exe	29
PID 2180 wrote to memory of 2500	2180	unpack_rhadamanthys.exe	29
PID 2180 wrote to memory of 2500	2180	unpack_rhadamanthys.exe	29
PID 2180 wrote to memory of 2500	2180	unpack_rhadamanthys.exe	29
PID 2180 wrote to memory of 2500	2180	unpack_rhadamanthys.exe	29
PID 2180 wrote to memory of 2500	2180	unpack_rhadamanthys.exe	29

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1328
- C:\Users\Admin\AppData\Local\Temp\unpack_rhadamanthys.exe
  "C:\Users\Admin\AppData\Local\Temp\unpack_rhadamanthys.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2180
- C:\Windows\system32\certreq.exe
  "C:\Windows\system32\certreq.exe"
  2⤵
  PID:2500

memory/2180-55-0x0000000001E60000-0x0000000002260000-memory.dmp

Filesize
4.0MB

Download
memory/2180-56-0x0000000001E60000-0x0000000002260000-memory.dmp

Filesize
4.0MB

Download
memory/2180-54-0x00000000002B0000-0x00000000002B7000-memory.dmp

Filesize
28KB

Download
memory/2180-57-0x0000000001E60000-0x0000000002260000-memory.dmp

Filesize
4.0MB

Download
memory/2180-58-0x0000000001E60000-0x0000000002260000-memory.dmp

Filesize
4.0MB

Download
memory/2180-60-0x0000000001DF0000-0x0000000001E26000-memory.dmp

Filesize
216KB

Download
memory/2180-66-0x0000000001E60000-0x0000000002260000-memory.dmp

Filesize
4.0MB

Download
memory/2500-59-0x00000000000E0000-0x00000000000E3000-memory.dmp

Filesize
12KB

Download