rhadamanthys | d014f4a31cd1f2627fb32fcc475524e3e8d21e9ece6da99b6b2390ccbdfffb2a

Resubmissions

27/11/2024, 10:03

18/07/2023, 09:02

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
18/07/2023, 09:02

Target

unpack_rhadamanthys.exe
Size

452KB
MD5

ebb380831920a1bcc24417fe110b68ee
SHA1

ede3b70c25a2607e002085c12690e1b083b836af
SHA256

d014f4a31cd1f2627fb32fcc475524e3e8d21e9ece6da99b6b2390ccbdfffb2a
SHA512

3e5e66e2ac3be257eddb843aae9f7dc868834332aeb9028da024ca88cdc0639fa734a7b4718a381c143feb2489168e0b0098664b04675173f6ab10b5ac1b61af
SSDEEP

6144:qlE8DIpjK28t4sL4glp3z/pSZ+pDKpf9EkQbKxVK+PXItNOapG8RuzRiRh3ZcZ:SEpj7sLTv/cgu4VGn6OaM+ucjo

Score

10^/10

Detect rhadamanthys stealer shellcode 5 IoCs

resource	yara_rule
behavioral2/memory/244-134-0x0000000002420000-0x0000000002820000-memory.dmp	family_rhadamanthys
behavioral2/memory/244-135-0x0000000002420000-0x0000000002820000-memory.dmp	family_rhadamanthys
behavioral2/memory/244-136-0x0000000002420000-0x0000000002820000-memory.dmp	family_rhadamanthys
behavioral2/memory/244-137-0x0000000002420000-0x0000000002820000-memory.dmp	family_rhadamanthys
behavioral2/memory/244-145-0x0000000002420000-0x0000000002820000-memory.dmp	family_rhadamanthys

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 244 created 3148	244	unpack_rhadamanthys.exe	29

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 244 wrote to memory of 5096	244	unpack_rhadamanthys.exe	93
PID 244 wrote to memory of 5096	244	unpack_rhadamanthys.exe	93
PID 244 wrote to memory of 5096	244	unpack_rhadamanthys.exe	93
PID 244 wrote to memory of 5096	244	unpack_rhadamanthys.exe	93

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3148
- C:\Users\Admin\AppData\Local\Temp\unpack_rhadamanthys.exe
  "C:\Users\Admin\AppData\Local\Temp\unpack_rhadamanthys.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:244
- C:\Windows\system32\certreq.exe
  "C:\Windows\system32\certreq.exe"
  2⤵
  PID:5096

memory/244-133-0x00000000021E0000-0x00000000021E7000-memory.dmp

Filesize
28KB

Download
memory/244-134-0x0000000002420000-0x0000000002820000-memory.dmp

Filesize
4.0MB

Download
memory/244-135-0x0000000002420000-0x0000000002820000-memory.dmp

Filesize
4.0MB

Download
memory/244-136-0x0000000002420000-0x0000000002820000-memory.dmp

Filesize
4.0MB

Download
memory/244-137-0x0000000002420000-0x0000000002820000-memory.dmp

Filesize
4.0MB

Download
memory/244-139-0x00000000031E0000-0x0000000003216000-memory.dmp

Filesize
216KB

Download
memory/244-145-0x0000000002420000-0x0000000002820000-memory.dmp

Filesize
4.0MB

Download
memory/5096-138-0x0000020E9B740000-0x0000020E9B743000-memory.dmp

Filesize
12KB

Download