rhadamanthys | 603dd803082a1d92a46319990eb7fadc16a9ba223a605d1f7c6e31f11c2b03e5

Resubmissions

27-11-2024 10:04

241127-l339lsypcw 10

15-08-2023 02:59

230815-dg72nsgd39 10

Analysis

max time kernel
142s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
15-08-2023 02:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

rh_0.4.9.exe
Size

456KB
MD5

101c823784ccb04983205c7e006ac89a
SHA1

4b983830e4c2c8f9dc3081828d936e51fe2fe3a5
SHA256

603dd803082a1d92a46319990eb7fadc16a9ba223a605d1f7c6e31f11c2b03e5
SHA512

c66e4506620285530e034edecf3fe4a56036a2b3bb57fa285c395017bb8687303c8880f637abe16c785801d030a458e80c449f4f61774bc39b5eaf9000f01a5b
SSDEEP

6144:2uWP/BtSnurUylcrGYlnIttxv8HbcLgsd1Gus5psdrvV44dixP+MHDkBYdxtG9+u:2uWP/BZUyoLu8Agsmxwrvejkd2

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Detect rhadamanthys stealer shellcode 5 IoCs

resource	yara_rule
behavioral2/memory/4128-134-0x0000000002350000-0x0000000002750000-memory.dmp	family_rhadamanthys
behavioral2/memory/4128-135-0x0000000002350000-0x0000000002750000-memory.dmp	family_rhadamanthys
behavioral2/memory/4128-136-0x0000000002350000-0x0000000002750000-memory.dmp	family_rhadamanthys
behavioral2/memory/4128-137-0x0000000002350000-0x0000000002750000-memory.dmp	family_rhadamanthys
behavioral2/memory/4128-146-0x0000000002350000-0x0000000002750000-memory.dmp	family_rhadamanthys

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4128 created 1256	4128	rh_0.4.9.exe	64

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4128	rh_0.4.9.exe
4128	rh_0.4.9.exe
4128	rh_0.4.9.exe
4128	rh_0.4.9.exe
4004	certreq.exe
4004	certreq.exe
4004	certreq.exe
4004	certreq.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 4004	4128	rh_0.4.9.exe	89
PID 4128 wrote to memory of 4004	4128	rh_0.4.9.exe	89
PID 4128 wrote to memory of 4004	4128	rh_0.4.9.exe	89
PID 4128 wrote to memory of 4004	4128	rh_0.4.9.exe	89

C:\Users\Admin\AppData\Local\Temp\rh_0.4.9.exe
"C:\Users\Admin\AppData\Local\Temp\rh_0.4.9.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4128

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1256
- C:\Windows\system32\certreq.exe
  "C:\Windows\system32\certreq.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4004-160-0x00007FF4D6430000-0x00007FF4D655D000-memory.dmp

Filesize
1.2MB

Download
memory/4004-158-0x00007FF4D6430000-0x00007FF4D655D000-memory.dmp

Filesize
1.2MB

Download
memory/4004-149-0x00007FF4D6430000-0x00007FF4D655D000-memory.dmp

Filesize
1.2MB

Download
memory/4004-165-0x0000026E07BE0000-0x0000026E07BE5000-memory.dmp

Filesize
20KB

Download
memory/4004-152-0x00007FF4D6430000-0x00007FF4D655D000-memory.dmp

Filesize
1.2MB

Download
memory/4004-138-0x0000026E07A80000-0x0000026E07A83000-memory.dmp

Filesize
12KB

Download
memory/4004-163-0x00007FF4D6430000-0x00007FF4D655D000-memory.dmp

Filesize
1.2MB

Download
memory/4004-162-0x00007FF4D6430000-0x00007FF4D655D000-memory.dmp

Filesize
1.2MB

Download
memory/4004-161-0x00007FF4D6430000-0x00007FF4D655D000-memory.dmp

Filesize
1.2MB

Download
memory/4004-147-0x0000026E07A80000-0x0000026E07A83000-memory.dmp

Filesize
12KB

Download
memory/4004-148-0x0000026E07BE0000-0x0000026E07BE7000-memory.dmp

Filesize
28KB

Download
memory/4004-150-0x00007FF4D6430000-0x00007FF4D655D000-memory.dmp

Filesize
1.2MB

Download
memory/4004-166-0x00007FF9329F0000-0x00007FF932BE5000-memory.dmp

Filesize
2.0MB

Download
memory/4004-164-0x00007FF4D6430000-0x00007FF4D655D000-memory.dmp

Filesize
1.2MB

Download
memory/4004-157-0x00007FF4D6430000-0x00007FF4D655D000-memory.dmp

Filesize
1.2MB

Download
memory/4004-153-0x00007FF4D6430000-0x00007FF4D655D000-memory.dmp

Filesize
1.2MB

Download
memory/4004-154-0x00007FF4D6430000-0x00007FF4D655D000-memory.dmp

Filesize
1.2MB

Download
memory/4004-156-0x00007FF4D6430000-0x00007FF4D655D000-memory.dmp

Filesize
1.2MB

Download
memory/4004-151-0x00007FF4D6430000-0x00007FF4D655D000-memory.dmp

Filesize
1.2MB

Download
memory/4004-159-0x00007FF9329F0000-0x00007FF932BE5000-memory.dmp

Filesize
2.0MB

Download
memory/4128-134-0x0000000002350000-0x0000000002750000-memory.dmp

Filesize
4.0MB

Download
memory/4128-133-0x0000000000740000-0x0000000000747000-memory.dmp

Filesize
28KB

Download
memory/4128-146-0x0000000002350000-0x0000000002750000-memory.dmp

Filesize
4.0MB

Download
memory/4128-145-0x0000000000660000-0x0000000000696000-memory.dmp

Filesize
216KB

Download
memory/4128-139-0x0000000000660000-0x0000000000696000-memory.dmp

Filesize
216KB

Download
memory/4128-137-0x0000000002350000-0x0000000002750000-memory.dmp

Filesize
4.0MB

Download
memory/4128-136-0x0000000002350000-0x0000000002750000-memory.dmp

Filesize
4.0MB

Download
memory/4128-135-0x0000000002350000-0x0000000002750000-memory.dmp

Filesize
4.0MB

Download