rhadamanthys | c06c42f9a7bbf83e103d46dea05c8f088502c77ea934fab85160696fcd576900

Resubmissions

27-11-2024 10:05

21-09-2023 13:13

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
21-09-2023 13:13

Target

c06c42f9a7bbf83e103d46dea05c8f088502c77ea934fab85160696fcd576900.exe
Size

448KB
MD5

9296a36df7cfdc7cd5ce3153c536c4d8
SHA1

547e0fde7d3c9bd1faff25f6c425e4f32903d751
SHA256

c06c42f9a7bbf83e103d46dea05c8f088502c77ea934fab85160696fcd576900
SHA512

af5e62c21df12c2d2ec9f9554c95eed5354c0b83f533e5777b3ed28e072e4befc4bf90c4a9eb45d549f589efadf00529befc0627fed378dc02ebdae0ae707166
SSDEEP

6144:L/E8DIpjK28t4snQRlp3z/pSZ+pDKpf9EkQbKxVK+PXItNOapG8RuzRiRh3Zi:dEpj7snuv/cgu4VGn6OaM+ucj

Score

10^/10

Detect rhadamanthys stealer shellcode 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1996-1-0x0000000001D30000-0x0000000002130000-memory.dmp	family_rhadamanthys
behavioral1/memory/1996-2-0x0000000001D30000-0x0000000002130000-memory.dmp	family_rhadamanthys
behavioral1/memory/1996-3-0x0000000001D30000-0x0000000002130000-memory.dmp	family_rhadamanthys
behavioral1/memory/1996-4-0x0000000001D30000-0x0000000002130000-memory.dmp	family_rhadamanthys
behavioral1/memory/1996-12-0x0000000001D30000-0x0000000002130000-memory.dmp	family_rhadamanthys
behavioral1/memory/1996-14-0x0000000001D30000-0x0000000002130000-memory.dmp	family_rhadamanthys

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

c06c42f9a7bbf83e103d46dea05c8f088502c77ea934fab85160696fcd576900.exe

description	pid	Process	procid_target
PID 1996 created 1260	1996	c06c42f9a7bbf83e103d46dea05c8f088502c77ea934fab85160696fcd576900.exe	14

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

c06c42f9a7bbf83e103d46dea05c8f088502c77ea934fab85160696fcd576900.exe

pid	Process
1996	c06c42f9a7bbf83e103d46dea05c8f088502c77ea934fab85160696fcd576900.exe
1996	c06c42f9a7bbf83e103d46dea05c8f088502c77ea934fab85160696fcd576900.exe
1996	c06c42f9a7bbf83e103d46dea05c8f088502c77ea934fab85160696fcd576900.exe
1996	c06c42f9a7bbf83e103d46dea05c8f088502c77ea934fab85160696fcd576900.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

c06c42f9a7bbf83e103d46dea05c8f088502c77ea934fab85160696fcd576900.exe

description	pid	Process	procid_target
PID 1996 wrote to memory of 2656	1996	c06c42f9a7bbf83e103d46dea05c8f088502c77ea934fab85160696fcd576900.exe	29
PID 1996 wrote to memory of 2656	1996	c06c42f9a7bbf83e103d46dea05c8f088502c77ea934fab85160696fcd576900.exe	29
PID 1996 wrote to memory of 2656	1996	c06c42f9a7bbf83e103d46dea05c8f088502c77ea934fab85160696fcd576900.exe	29
PID 1996 wrote to memory of 2656	1996	c06c42f9a7bbf83e103d46dea05c8f088502c77ea934fab85160696fcd576900.exe	29
PID 1996 wrote to memory of 2656	1996	c06c42f9a7bbf83e103d46dea05c8f088502c77ea934fab85160696fcd576900.exe	29
PID 1996 wrote to memory of 2656	1996	c06c42f9a7bbf83e103d46dea05c8f088502c77ea934fab85160696fcd576900.exe	29

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1260
- C:\Users\Admin\AppData\Local\Temp\c06c42f9a7bbf83e103d46dea05c8f088502c77ea934fab85160696fcd576900.exe
  "C:\Users\Admin\AppData\Local\Temp\c06c42f9a7bbf83e103d46dea05c8f088502c77ea934fab85160696fcd576900.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1996
- C:\Windows\system32\certreq.exe
  "C:\Windows\system32\certreq.exe"
  2⤵
  PID:2656

memory/1996-0-0x00000000003A0000-0x00000000003A7000-memory.dmp

Filesize
28KB

Download
memory/1996-1-0x0000000001D30000-0x0000000002130000-memory.dmp

Filesize
4.0MB

Download
memory/1996-2-0x0000000001D30000-0x0000000002130000-memory.dmp

Filesize
4.0MB

Download
memory/1996-3-0x0000000001D30000-0x0000000002130000-memory.dmp

Filesize
4.0MB

Download
memory/1996-4-0x0000000001D30000-0x0000000002130000-memory.dmp

Filesize
4.0MB

Download
memory/1996-6-0x0000000002810000-0x0000000002846000-memory.dmp

Filesize
216KB

Download
memory/1996-12-0x0000000001D30000-0x0000000002130000-memory.dmp

Filesize
4.0MB

Download
memory/1996-14-0x0000000001D30000-0x0000000002130000-memory.dmp

Filesize
4.0MB

Download
memory/1996-13-0x0000000002810000-0x0000000002846000-memory.dmp

Filesize
216KB

Download
memory/2656-5-0x0000000000060000-0x0000000000063000-memory.dmp

Filesize
12KB

Download