rhadamanthys | 91ae301f30a2e92e923283a89634ad17786762f72437ba460d790cd66e1b0a1e

Resubmissions

27-11-2024 10:04

27-08-2023 19:45

max time kernel
143s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
27-08-2023 19:45

Target

rh_0.4.9.exe
Size

456KB
MD5

5adcfa28ba6d424847d12c246c7b19f8
SHA1

ae451b00d9ef359148f68d8ec0a3dac0ba355f9f
SHA256

91ae301f30a2e92e923283a89634ad17786762f72437ba460d790cd66e1b0a1e
SHA512

add767c03b1fade0970c841d0a785fec202415e21809acfcfb973fbc2269837467ad3eb22a090d0af9a362edc1a1aa3033be58ff7a813e2403501ca01c9d7254
SSDEEP

6144:2uWP/BtSnurUylcrGYlnIttxv8HbcLgsd1Gus5psdrvV44dixP+MHDkBYdxtG9+O:2uWP/BZUyoLu8Agsmxwrvejkd2

Score

10^/10

Detect rhadamanthys stealer shellcode 5 IoCs

resource	yara_rule
behavioral1/memory/1836-1-0x00000000022B0000-0x00000000026B0000-memory.dmp	family_rhadamanthys
behavioral1/memory/1836-2-0x00000000022B0000-0x00000000026B0000-memory.dmp	family_rhadamanthys
behavioral1/memory/1836-3-0x00000000022B0000-0x00000000026B0000-memory.dmp	family_rhadamanthys
behavioral1/memory/1836-4-0x00000000022B0000-0x00000000026B0000-memory.dmp	family_rhadamanthys
behavioral1/memory/1836-12-0x00000000022B0000-0x00000000026B0000-memory.dmp	family_rhadamanthys

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1836 created 780	1836	rh_0.4.9.exe	53

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 3088	1836	rh_0.4.9.exe	91
PID 1836 wrote to memory of 3088	1836	rh_0.4.9.exe	91
PID 1836 wrote to memory of 3088	1836	rh_0.4.9.exe	91
PID 1836 wrote to memory of 3088	1836	rh_0.4.9.exe	91

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:780
- C:\Users\Admin\AppData\Local\Temp\rh_0.4.9.exe
  "C:\Users\Admin\AppData\Local\Temp\rh_0.4.9.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1836
- C:\Windows\system32\certreq.exe
  "C:\Windows\system32\certreq.exe"
  2⤵
  PID:3088

memory/1836-0-0x00000000020A0000-0x00000000020A7000-memory.dmp

Filesize
28KB

Download
memory/1836-1-0x00000000022B0000-0x00000000026B0000-memory.dmp

Filesize
4.0MB

Download
memory/1836-2-0x00000000022B0000-0x00000000026B0000-memory.dmp

Filesize
4.0MB

Download
memory/1836-3-0x00000000022B0000-0x00000000026B0000-memory.dmp

Filesize
4.0MB

Download
memory/1836-4-0x00000000022B0000-0x00000000026B0000-memory.dmp

Filesize
4.0MB

Download
memory/1836-6-0x00000000030F0000-0x0000000003126000-memory.dmp

Filesize
216KB

Download
memory/1836-12-0x00000000022B0000-0x00000000026B0000-memory.dmp

Filesize
4.0MB

Download
memory/3088-5-0x000001FB8A8A0000-0x000001FB8A8A3000-memory.dmp

Filesize
12KB

Download