rhadamanthys | 32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e

General

Target

32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe
Size

476KB
MD5

76f37b780edf118a0364fab327167a0c
SHA1

78dbbff57068378e4709afea5ba35561eb157ef5
SHA256

32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e
SHA512

f677065ad4a920fbd819dae3eff010f35b794ac3d2f2031acbad8162fa4cb9d398420ba5d665b4260f0a17832d149e617d097be5c4986ea7a31a33fd3878b7b3
SSDEEP

12288:y5QaO7SIsbbv4/lDv0zMrcoZPPPKW1ICFBCGw:ravv4tDKMrVPKsIkCGw

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Detect rhadamanthys stealer shellcode 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2588-19-0x00000000021E0000-0x00000000025E0000-memory.dmp	family_rhadamanthys
behavioral1/memory/2588-18-0x00000000021E0000-0x00000000025E0000-memory.dmp	family_rhadamanthys
behavioral1/memory/2588-20-0x00000000021E0000-0x00000000025E0000-memory.dmp	family_rhadamanthys
behavioral1/memory/2588-21-0x00000000021E0000-0x00000000025E0000-memory.dmp	family_rhadamanthys
behavioral1/memory/2588-30-0x00000000021E0000-0x00000000025E0000-memory.dmp	family_rhadamanthys

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe

description pid process target process

PID 2588 created 1200 2588 32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe Explorer.EXE

description	pid	process	target process
PID 2588 created 1200	2588	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe	Explorer.EXE

Suspicious use of SetThreadContext 1 IoCs

Processes:

32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe

description	pid	process	target process
PID 2188 set thread context of 2588	2188	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe

pid	process
2588	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe
2588	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe
2588	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe
2588	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe

description pid process

Token: SeDebugPrivilege 2188 32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe

description	pid	process
Token: SeDebugPrivilege	2188	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1200

C:\Users\Admin\AppData\Local\Temp\32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe
"C:\Users\Admin\AppData\Local\Temp\32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2188

C:\Users\Admin\AppData\Local\Temp\32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe
C:\Users\Admin\AppData\Local\Temp\32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe
3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2588

C:\Windows\system32\certreq.exe
"C:\Windows\system32\certreq.exe"
2⤵
PID:2532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2188-14-0x0000000074BA0000-0x000000007528E000-memory.dmp

Filesize
6.9MB

Download
memory/2188-1-0x0000000074BA0000-0x000000007528E000-memory.dmp

Filesize
6.9MB

Download
memory/2188-2-0x00000000046B0000-0x0000000004728000-memory.dmp

Filesize
480KB

Download
memory/2188-3-0x00000000047C0000-0x0000000004800000-memory.dmp

Filesize
256KB

Download
memory/2188-4-0x0000000004730000-0x0000000004798000-memory.dmp

Filesize
416KB

Download
memory/2188-5-0x0000000004C20000-0x0000000004C6C000-memory.dmp

Filesize
304KB

Download
memory/2188-0-0x0000000000D60000-0x0000000000DDE000-memory.dmp

Filesize
504KB

Download
memory/2532-22-0x00000000000E0000-0x00000000000E3000-memory.dmp

Filesize
12KB

Download
memory/2588-6-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2588-17-0x0000000000240000-0x0000000000247000-memory.dmp

Filesize
28KB

Download
memory/2588-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2588-12-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2588-8-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2588-15-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2588-16-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2588-9-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2588-19-0x00000000021E0000-0x00000000025E0000-memory.dmp

Filesize
4.0MB

Download
memory/2588-18-0x00000000021E0000-0x00000000025E0000-memory.dmp

Filesize
4.0MB

Download
memory/2588-20-0x00000000021E0000-0x00000000025E0000-memory.dmp

Filesize
4.0MB

Download
memory/2588-21-0x00000000021E0000-0x00000000025E0000-memory.dmp

Filesize
4.0MB

Download
memory/2588-7-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2588-23-0x00000000002B0000-0x00000000002E6000-memory.dmp

Filesize
216KB

Download
memory/2588-29-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2588-30-0x00000000021E0000-0x00000000025E0000-memory.dmp

Filesize
4.0MB

Download

description	pid	process	target process
PID 2188 wrote to memory of 2588	2188	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe
PID 2188 wrote to memory of 2588	2188	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe
PID 2188 wrote to memory of 2588	2188	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe
PID 2188 wrote to memory of 2588	2188	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe
PID 2188 wrote to memory of 2588	2188	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe
PID 2188 wrote to memory of 2588	2188	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe
PID 2188 wrote to memory of 2588	2188	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe
PID 2188 wrote to memory of 2588	2188	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe
PID 2188 wrote to memory of 2588	2188	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe
PID 2588 wrote to memory of 2532	2588	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe	certreq.exe
PID 2588 wrote to memory of 2532	2588	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe	certreq.exe
PID 2588 wrote to memory of 2532	2588	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe	certreq.exe
PID 2588 wrote to memory of 2532	2588	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe	certreq.exe
PID 2588 wrote to memory of 2532	2588	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe	certreq.exe
PID 2588 wrote to memory of 2532	2588	32c9c069c7fe9ffdd9086b957e45c03993863730cd1eed4815e226dc1b7b436e.exe	certreq.exe

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads