rhadamanthys | 6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb

General

Target

6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb.exe
Size

833KB
MD5

17688f03f125bb494dc7f304b8936221
SHA1

7fadc66ba11a5b3c4582f4d9b5b245801ccf918a
SHA256

6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb
SHA512

1636d32e5a59c5c3577d0dc5ecf7dbccc22cc0ce2087889974903257d500e694d2cee4218c17ddba747c4b59ea4f811889837883b40cd009c1463cdc21f65a06
SSDEEP

12288:Ib/bL1cEYZpFQOT4KpMT+msoH985+3wAFn6DQnbu7L3SpiQXYIOnUfvDrD8FEsim:WzLmQsI85mn6DQDYpmv8FEyuOGLU

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Detect rhadamanthys stealer shellcode 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3068-19-0x0000000001F80000-0x0000000002380000-memory.dmp	family_rhadamanthys
behavioral1/memory/3068-21-0x0000000001F80000-0x0000000002380000-memory.dmp	family_rhadamanthys
behavioral1/memory/3068-20-0x0000000001F80000-0x0000000002380000-memory.dmp	family_rhadamanthys
behavioral1/memory/3068-22-0x0000000001F80000-0x0000000002380000-memory.dmp	family_rhadamanthys
behavioral1/memory/3068-31-0x0000000001F80000-0x0000000002380000-memory.dmp	family_rhadamanthys

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb.exe

description pid process target process

PID 3068 created 1248 3068 6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb.exe Explorer.EXE

description	pid	process	target process
PID 3068 created 1248	3068	6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb.exe	Explorer.EXE

Suspicious use of SetThreadContext 1 IoCs

Processes:

6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb.exe

description	pid	process	target process
PID 1704 set thread context of 3068	1704	6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb.exe	6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb.exe6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb.exe

pid	process
1704	6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb.exe
3068	6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb.exe
3068	6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb.exe
3068	6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb.exe
3068	6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb.exe

description pid process

Token: SeDebugPrivilege 1704 6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb.exe

description	pid	process
Token: SeDebugPrivilege	1704	6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb.exe6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb.exe

C:\Users\Admin\AppData\Local\Temp\6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb.exe
"C:\Users\Admin\AppData\Local\Temp\6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1704

C:\Users\Admin\AppData\Local\Temp\6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb.exe
C:\Users\Admin\AppData\Local\Temp\6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb.exe
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3068

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1248

C:\Windows\system32\certreq.exe
"C:\Windows\system32\certreq.exe"
2⤵
PID:2764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1704-0-0x0000000000AA0000-0x0000000000B76000-memory.dmp

Filesize
856KB

Download
memory/1704-1-0x0000000073EF0000-0x00000000745DE000-memory.dmp

Filesize
6.9MB

Download
memory/1704-2-0x0000000002230000-0x00000000022A8000-memory.dmp

Filesize
480KB

Download
memory/1704-3-0x0000000000750000-0x0000000000790000-memory.dmp

Filesize
256KB

Download
memory/1704-4-0x0000000004780000-0x00000000047E8000-memory.dmp

Filesize
416KB

Download
memory/1704-5-0x0000000000790000-0x00000000007DC000-memory.dmp

Filesize
304KB

Download
memory/1704-16-0x0000000073EF0000-0x00000000745DE000-memory.dmp

Filesize
6.9MB

Download
memory/2764-24-0x0000000000060000-0x0000000000063000-memory.dmp

Filesize
12KB

Download
memory/2764-23-0x0000000000060000-0x0000000000063000-memory.dmp

Filesize
12KB

Download
memory/3068-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3068-21-0x0000000001F80000-0x0000000002380000-memory.dmp

Filesize
4.0MB

Download
memory/3068-14-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/3068-8-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/3068-17-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/3068-18-0x0000000000150000-0x0000000000157000-memory.dmp

Filesize
28KB

Download
memory/3068-19-0x0000000001F80000-0x0000000002380000-memory.dmp

Filesize
4.0MB

Download
memory/3068-10-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/3068-20-0x0000000001F80000-0x0000000002380000-memory.dmp

Filesize
4.0MB

Download
memory/3068-22-0x0000000001F80000-0x0000000002380000-memory.dmp

Filesize
4.0MB

Download
memory/3068-7-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/3068-6-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/3068-25-0x0000000000310000-0x0000000000346000-memory.dmp

Filesize
216KB

Download
memory/3068-31-0x0000000001F80000-0x0000000002380000-memory.dmp

Filesize
4.0MB

Download

description	pid	process	target process
PID 1704 wrote to memory of 3068	1704	6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb.exe	6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb.exe
PID 1704 wrote to memory of 3068	1704	6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb.exe	6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb.exe
PID 1704 wrote to memory of 3068	1704	6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb.exe	6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb.exe
PID 1704 wrote to memory of 3068	1704	6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb.exe	6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb.exe
PID 1704 wrote to memory of 3068	1704	6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb.exe	6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb.exe
PID 1704 wrote to memory of 3068	1704	6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb.exe	6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb.exe
PID 1704 wrote to memory of 3068	1704	6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb.exe	6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb.exe
PID 1704 wrote to memory of 3068	1704	6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb.exe	6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb.exe
PID 1704 wrote to memory of 3068	1704	6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb.exe	6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb.exe
PID 3068 wrote to memory of 2764	3068	6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb.exe	certreq.exe
PID 3068 wrote to memory of 2764	3068	6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb.exe	certreq.exe
PID 3068 wrote to memory of 2764	3068	6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb.exe	certreq.exe
PID 3068 wrote to memory of 2764	3068	6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb.exe	certreq.exe
PID 3068 wrote to memory of 2764	3068	6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb.exe	certreq.exe
PID 3068 wrote to memory of 2764	3068	6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb.exe	certreq.exe

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads