rhadamanthys | 32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e

General

Target

32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe
Size

476KB
MD5

76f37b780edf118a0364fab327167a0c
SHA1

78dbbff57068378e4709afea5ba35561eb157ef5
SHA256

32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e
SHA512

f677065ad4a920fbd819dae3eff010f35b794ac3d2f2031acbad8162fa4cb9d398420ba5d665b4260f0a17832d149e617d097be5c4986ea7a31a33fd3878b7b3
SSDEEP

12288:y5QaO7SIsbbv4/lDv0zMrcoZPPPKW1ICFBCGw:ravv4tDKMrVPKsIkCGw

Score

10^/10

Malware Config

Signatures

Detect rhadamanthys stealer shellcode 5 IoCs

resource	yara_rule
behavioral1/memory/2588-19-0x00000000021E0000-0x00000000025E0000-memory.dmp	family_rhadamanthys
behavioral1/memory/2588-18-0x00000000021E0000-0x00000000025E0000-memory.dmp	family_rhadamanthys
behavioral1/memory/2588-20-0x00000000021E0000-0x00000000025E0000-memory.dmp	family_rhadamanthys
behavioral1/memory/2588-21-0x00000000021E0000-0x00000000025E0000-memory.dmp	family_rhadamanthys
behavioral1/memory/2588-30-0x00000000021E0000-0x00000000025E0000-memory.dmp	family_rhadamanthys

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2588 created 1200	2588	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe	16

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2188 set thread context of 2588	2188	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe	28

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2588	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe
2588	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe
2588	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe
2588	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2188	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2588	2188	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe	28
PID 2188 wrote to memory of 2588	2188	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe	28
PID 2188 wrote to memory of 2588	2188	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe	28
PID 2188 wrote to memory of 2588	2188	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe	28
PID 2188 wrote to memory of 2588	2188	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe	28
PID 2188 wrote to memory of 2588	2188	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe	28
PID 2188 wrote to memory of 2588	2188	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe	28
PID 2188 wrote to memory of 2588	2188	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe	28
PID 2188 wrote to memory of 2588	2188	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe	28
PID 2588 wrote to memory of 2532	2588	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe	30
PID 2588 wrote to memory of 2532	2588	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe	30
PID 2588 wrote to memory of 2532	2588	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe	30
PID 2588 wrote to memory of 2532	2588	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe	30
PID 2588 wrote to memory of 2532	2588	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe	30
PID 2588 wrote to memory of 2532	2588	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe	30

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1200
- C:\Users\Admin\AppData\Local\Temp\32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe
  "C:\Users\Admin\AppData\Local\Temp\32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2188
- - C:\Users\Admin\AppData\Local\Temp\32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe
    C:\Users\Admin\AppData\Local\Temp\32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2588
- C:\Windows\system32\certreq.exe
  "C:\Windows\system32\certreq.exe"
  2⤵
  PID:2532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2188-14-0x0000000074BA0000-0x000000007528E000-memory.dmp

Filesize
6.9MB

Download
memory/2188-1-0x0000000074BA0000-0x000000007528E000-memory.dmp

Filesize
6.9MB

Download
memory/2188-2-0x00000000046B0000-0x0000000004728000-memory.dmp

Filesize
480KB

Download
memory/2188-3-0x00000000047C0000-0x0000000004800000-memory.dmp

Filesize
256KB

Download
memory/2188-4-0x0000000004730000-0x0000000004798000-memory.dmp

Filesize
416KB

Download
memory/2188-5-0x0000000004C20000-0x0000000004C6C000-memory.dmp

Filesize
304KB

Download
memory/2188-0-0x0000000000D60000-0x0000000000DDE000-memory.dmp

Filesize
504KB

Download
memory/2532-22-0x00000000000E0000-0x00000000000E3000-memory.dmp

Filesize
12KB

Download
memory/2588-6-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2588-17-0x0000000000240000-0x0000000000247000-memory.dmp

Filesize
28KB

Download
memory/2588-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2588-12-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2588-8-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2588-15-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2588-16-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2588-9-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2588-19-0x00000000021E0000-0x00000000025E0000-memory.dmp

Filesize
4.0MB

Download
memory/2588-18-0x00000000021E0000-0x00000000025E0000-memory.dmp

Filesize
4.0MB

Download
memory/2588-20-0x00000000021E0000-0x00000000025E0000-memory.dmp

Filesize
4.0MB

Download
memory/2588-21-0x00000000021E0000-0x00000000025E0000-memory.dmp

Filesize
4.0MB

Download
memory/2588-7-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2588-23-0x00000000002B0000-0x00000000002E6000-memory.dmp

Filesize
216KB

Download
memory/2588-29-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2588-30-0x00000000021E0000-0x00000000025E0000-memory.dmp

Filesize
4.0MB

Download

Resubmissions

Analysis

Sharing