rhadamanthys | 603dd803082a1d92a46319990eb7fadc16a9ba223a605d1f7c6e31f11c2b03e5

Resubmissions

27-11-2024 10:04

241127-l339lsypcw 10

15-08-2023 02:59

230815-dg72nsgd39 10

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
15-08-2023 02:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

rh_0.4.9.exe
Size

456KB
MD5

101c823784ccb04983205c7e006ac89a
SHA1

4b983830e4c2c8f9dc3081828d936e51fe2fe3a5
SHA256

603dd803082a1d92a46319990eb7fadc16a9ba223a605d1f7c6e31f11c2b03e5
SHA512

c66e4506620285530e034edecf3fe4a56036a2b3bb57fa285c395017bb8687303c8880f637abe16c785801d030a458e80c449f4f61774bc39b5eaf9000f01a5b
SSDEEP

6144:2uWP/BtSnurUylcrGYlnIttxv8HbcLgsd1Gus5psdrvV44dixP+MHDkBYdxtG9+u:2uWP/BZUyoLu8Agsmxwrvejkd2

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Detect rhadamanthys stealer shellcode 5 IoCs

resource	yara_rule
behavioral1/memory/1632-55-0x0000000001DD0000-0x00000000021D0000-memory.dmp	family_rhadamanthys
behavioral1/memory/1632-57-0x0000000001DD0000-0x00000000021D0000-memory.dmp	family_rhadamanthys
behavioral1/memory/1632-56-0x0000000001DD0000-0x00000000021D0000-memory.dmp	family_rhadamanthys
behavioral1/memory/1632-58-0x0000000001DD0000-0x00000000021D0000-memory.dmp	family_rhadamanthys
behavioral1/memory/1632-67-0x0000000001DD0000-0x00000000021D0000-memory.dmp	family_rhadamanthys

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1632 created 1268	1632	rh_0.4.9.exe	11

Deletes itself 1 IoCs

pid	Process
2912	certreq.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1632	rh_0.4.9.exe
1632	rh_0.4.9.exe
1632	rh_0.4.9.exe
1632	rh_0.4.9.exe
2912	certreq.exe
2912	certreq.exe
2912	certreq.exe
2912	certreq.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 2912	1632	rh_0.4.9.exe	31
PID 1632 wrote to memory of 2912	1632	rh_0.4.9.exe	31
PID 1632 wrote to memory of 2912	1632	rh_0.4.9.exe	31
PID 1632 wrote to memory of 2912	1632	rh_0.4.9.exe	31
PID 1632 wrote to memory of 2912	1632	rh_0.4.9.exe	31
PID 1632 wrote to memory of 2912	1632	rh_0.4.9.exe	31

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1268
- C:\Users\Admin\AppData\Local\Temp\rh_0.4.9.exe
  "C:\Users\Admin\AppData\Local\Temp\rh_0.4.9.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1632
- C:\Windows\system32\certreq.exe
  "C:\Windows\system32\certreq.exe"
  2⤵
  - Deletes itself
  - Suspicious behavior: EnumeratesProcesses
  PID:2912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1632-66-0x00000000004C0000-0x00000000004F6000-memory.dmp

Filesize
216KB

Download
memory/1632-55-0x0000000001DD0000-0x00000000021D0000-memory.dmp

Filesize
4.0MB

Download
memory/1632-57-0x0000000001DD0000-0x00000000021D0000-memory.dmp

Filesize
4.0MB

Download
memory/1632-56-0x0000000001DD0000-0x00000000021D0000-memory.dmp

Filesize
4.0MB

Download
memory/1632-58-0x0000000001DD0000-0x00000000021D0000-memory.dmp

Filesize
4.0MB

Download
memory/1632-54-0x0000000000230000-0x0000000000237000-memory.dmp

Filesize
28KB

Download
memory/1632-60-0x00000000004C0000-0x00000000004F6000-memory.dmp

Filesize
216KB

Download
memory/1632-67-0x0000000001DD0000-0x00000000021D0000-memory.dmp

Filesize
4.0MB

Download
memory/2912-70-0x000007FFFFE80000-0x000007FFFFFAD000-memory.dmp

Filesize
1.2MB

Download
memory/2912-78-0x000007FFFFE80000-0x000007FFFFFAD000-memory.dmp

Filesize
1.2MB

Download
memory/2912-69-0x0000000000120000-0x0000000000127000-memory.dmp

Filesize
28KB

Download
memory/2912-71-0x000007FFFFE80000-0x000007FFFFFAD000-memory.dmp

Filesize
1.2MB

Download
memory/2912-59-0x0000000000060000-0x0000000000063000-memory.dmp

Filesize
12KB

Download
memory/2912-72-0x000007FFFFE80000-0x000007FFFFFAD000-memory.dmp

Filesize
1.2MB

Download
memory/2912-73-0x000007FFFFE80000-0x000007FFFFFAD000-memory.dmp

Filesize
1.2MB

Download
memory/2912-75-0x000007FFFFE80000-0x000007FFFFFAD000-memory.dmp

Filesize
1.2MB

Download
memory/2912-77-0x000007FFFFE80000-0x000007FFFFFAD000-memory.dmp

Filesize
1.2MB

Download
memory/2912-68-0x0000000000060000-0x0000000000063000-memory.dmp

Filesize
12KB

Download
memory/2912-79-0x000007FFFFE80000-0x000007FFFFFAD000-memory.dmp

Filesize
1.2MB

Download
memory/2912-80-0x00000000770F0000-0x0000000077299000-memory.dmp

Filesize
1.7MB

Download
memory/2912-81-0x000007FFFFE80000-0x000007FFFFFAD000-memory.dmp

Filesize
1.2MB

Download
memory/2912-82-0x000007FFFFE80000-0x000007FFFFFAD000-memory.dmp

Filesize
1.2MB

Download
memory/2912-83-0x000007FFFFE80000-0x000007FFFFFAD000-memory.dmp

Filesize
1.2MB

Download
memory/2912-84-0x000007FFFFE80000-0x000007FFFFFAD000-memory.dmp

Filesize
1.2MB

Download
memory/2912-85-0x0000000000120000-0x0000000000122000-memory.dmp

Filesize
8KB

Download
memory/2912-86-0x00000000770F0000-0x0000000077299000-memory.dmp

Filesize
1.7MB

Download