rhadamanthys | c06c42f9a7bbf83e103d46dea05c8f088502c77ea934fab85160696fcd576900

Resubmissions

27-11-2024 10:05

21-09-2023 13:13

max time kernel
138s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
21-09-2023 13:13

Target

c06c42f9a7bbf83e103d46dea05c8f088502c77ea934fab85160696fcd576900.exe
Size

448KB
MD5

9296a36df7cfdc7cd5ce3153c536c4d8
SHA1

547e0fde7d3c9bd1faff25f6c425e4f32903d751
SHA256

c06c42f9a7bbf83e103d46dea05c8f088502c77ea934fab85160696fcd576900
SHA512

af5e62c21df12c2d2ec9f9554c95eed5354c0b83f533e5777b3ed28e072e4befc4bf90c4a9eb45d549f589efadf00529befc0627fed378dc02ebdae0ae707166
SSDEEP

6144:L/E8DIpjK28t4snQRlp3z/pSZ+pDKpf9EkQbKxVK+PXItNOapG8RuzRiRh3Zi:dEpj7snuv/cgu4VGn6OaM+ucj

Score

10^/10

Detect rhadamanthys stealer shellcode 6 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2084-1-0x0000000002490000-0x0000000002890000-memory.dmp	family_rhadamanthys
behavioral2/memory/2084-2-0x0000000002490000-0x0000000002890000-memory.dmp	family_rhadamanthys
behavioral2/memory/2084-3-0x0000000002490000-0x0000000002890000-memory.dmp	family_rhadamanthys
behavioral2/memory/2084-4-0x0000000002490000-0x0000000002890000-memory.dmp	family_rhadamanthys
behavioral2/memory/2084-12-0x0000000002490000-0x0000000002890000-memory.dmp	family_rhadamanthys
behavioral2/memory/2084-14-0x0000000002490000-0x0000000002890000-memory.dmp	family_rhadamanthys

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

c06c42f9a7bbf83e103d46dea05c8f088502c77ea934fab85160696fcd576900.exe

description	pid	Process	procid_target
PID 2084 created 3160	2084	c06c42f9a7bbf83e103d46dea05c8f088502c77ea934fab85160696fcd576900.exe	30

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

c06c42f9a7bbf83e103d46dea05c8f088502c77ea934fab85160696fcd576900.exe

pid	Process
2084	c06c42f9a7bbf83e103d46dea05c8f088502c77ea934fab85160696fcd576900.exe
2084	c06c42f9a7bbf83e103d46dea05c8f088502c77ea934fab85160696fcd576900.exe
2084	c06c42f9a7bbf83e103d46dea05c8f088502c77ea934fab85160696fcd576900.exe
2084	c06c42f9a7bbf83e103d46dea05c8f088502c77ea934fab85160696fcd576900.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c06c42f9a7bbf83e103d46dea05c8f088502c77ea934fab85160696fcd576900.exe

description	pid	Process	procid_target
PID 2084 wrote to memory of 3964	2084	c06c42f9a7bbf83e103d46dea05c8f088502c77ea934fab85160696fcd576900.exe	90
PID 2084 wrote to memory of 3964	2084	c06c42f9a7bbf83e103d46dea05c8f088502c77ea934fab85160696fcd576900.exe	90
PID 2084 wrote to memory of 3964	2084	c06c42f9a7bbf83e103d46dea05c8f088502c77ea934fab85160696fcd576900.exe	90
PID 2084 wrote to memory of 3964	2084	c06c42f9a7bbf83e103d46dea05c8f088502c77ea934fab85160696fcd576900.exe	90

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3160
- C:\Users\Admin\AppData\Local\Temp\c06c42f9a7bbf83e103d46dea05c8f088502c77ea934fab85160696fcd576900.exe
  "C:\Users\Admin\AppData\Local\Temp\c06c42f9a7bbf83e103d46dea05c8f088502c77ea934fab85160696fcd576900.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2084
- C:\Windows\system32\certreq.exe
  "C:\Windows\system32\certreq.exe"
  2⤵
  PID:3964

memory/2084-0-0x0000000000570000-0x0000000000577000-memory.dmp

Filesize
28KB

Download
memory/2084-1-0x0000000002490000-0x0000000002890000-memory.dmp

Filesize
4.0MB

Download
memory/2084-2-0x0000000002490000-0x0000000002890000-memory.dmp

Filesize
4.0MB

Download
memory/2084-3-0x0000000002490000-0x0000000002890000-memory.dmp

Filesize
4.0MB

Download
memory/2084-4-0x0000000002490000-0x0000000002890000-memory.dmp

Filesize
4.0MB

Download
memory/2084-6-0x0000000003220000-0x0000000003256000-memory.dmp

Filesize
216KB

Download
memory/2084-12-0x0000000002490000-0x0000000002890000-memory.dmp

Filesize
4.0MB

Download
memory/2084-14-0x0000000002490000-0x0000000002890000-memory.dmp

Filesize
4.0MB

Download
memory/2084-13-0x0000000003220000-0x0000000003256000-memory.dmp

Filesize
216KB

Download
memory/3964-5-0x000001F6939D0000-0x000001F6939D3000-memory.dmp

Filesize
12KB

Download