rhadamanthys | 65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636

General

Target

65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe
Size

1.9MB
MD5

1b87684768db892932be3f0661c54251
SHA1

e5acdb93f6eb75656c9a8242e21b01bf978dc7cf
SHA256

65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636
SHA512

0fc3cc6ed99e45a3d1ca7cd2dd4d7bfc2f5f11ee7cf0e3d58bfbb4db26f16599cae45b96fc032cd6a050c1ea70bfd02291537088168dd149eee85b38d2527a82
SSDEEP

24576:jx4Ul0rrIOGz9I6U7AeyGvHynlLghECQl4L529dktxtPCv1ri+J/ac//zWOYopmB:mUl0/2kHW8ECQl4wi+snopp2vQ

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Detect rhadamanthys stealer shellcode 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/940-21-0x0000000000B60000-0x0000000000F60000-memory.dmp	family_rhadamanthys
behavioral1/memory/940-22-0x0000000000B60000-0x0000000000F60000-memory.dmp	family_rhadamanthys
behavioral1/memory/940-23-0x0000000000B60000-0x0000000000F60000-memory.dmp	family_rhadamanthys
behavioral1/memory/940-24-0x0000000000B60000-0x0000000000F60000-memory.dmp	family_rhadamanthys
behavioral1/memory/940-34-0x0000000000B60000-0x0000000000F60000-memory.dmp	family_rhadamanthys

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe

description	pid	Process	procid_target
PID 940 created 1392	940	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe	15

Suspicious use of SetThreadContext 1 IoCs

Processes:

65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe

description	pid	Process	procid_target
PID 1980 set thread context of 940	1980	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe	28

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe

pid	Process
1980	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe
940	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe
940	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe
940	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe
940	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe

description	pid	Process
Token: SeDebugPrivilege	1980	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe

description	pid	Process	procid_target
PID 1980 wrote to memory of 940	1980	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe	28
PID 1980 wrote to memory of 940	1980	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe	28
PID 1980 wrote to memory of 940	1980	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe	28
PID 1980 wrote to memory of 940	1980	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe	28
PID 1980 wrote to memory of 940	1980	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe	28
PID 1980 wrote to memory of 940	1980	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe	28
PID 1980 wrote to memory of 940	1980	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe	28
PID 1980 wrote to memory of 940	1980	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe	28
PID 1980 wrote to memory of 940	1980	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe	28
PID 940 wrote to memory of 2796	940	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe	30
PID 940 wrote to memory of 2796	940	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe	30
PID 940 wrote to memory of 2796	940	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe	30
PID 940 wrote to memory of 2796	940	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe	30
PID 940 wrote to memory of 2796	940	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe	30
PID 940 wrote to memory of 2796	940	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe	30

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1392
- C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe
  "C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1980
- - C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe
    C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:940
- C:\Windows\system32\certreq.exe
  "C:\Windows\system32\certreq.exe"
  2⤵
  PID:2796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/940-24-0x0000000000B60000-0x0000000000F60000-memory.dmp

Filesize
4.0MB

Download
memory/940-27-0x00000000002B0000-0x00000000002E6000-memory.dmp

Filesize
216KB

Download
memory/940-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/940-32-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/940-16-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/940-23-0x0000000000B60000-0x0000000000F60000-memory.dmp

Filesize
4.0MB

Download
memory/940-6-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/940-8-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/940-10-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/940-12-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/940-34-0x0000000000B60000-0x0000000000F60000-memory.dmp

Filesize
4.0MB

Download
memory/940-22-0x0000000000B60000-0x0000000000F60000-memory.dmp

Filesize
4.0MB

Download
memory/940-20-0x0000000000100000-0x0000000000107000-memory.dmp

Filesize
28KB

Download
memory/940-19-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/940-21-0x0000000000B60000-0x0000000000F60000-memory.dmp

Filesize
4.0MB

Download
memory/1980-18-0x0000000074930000-0x000000007501E000-memory.dmp

Filesize
6.9MB

Download
memory/1980-1-0x00000000010F0000-0x00000000012D6000-memory.dmp

Filesize
1.9MB

Download
memory/1980-5-0x0000000004CA0000-0x0000000004CEC000-memory.dmp

Filesize
304KB

Download
memory/1980-0-0x0000000074930000-0x000000007501E000-memory.dmp

Filesize
6.9MB

Download
memory/1980-4-0x00000000046E0000-0x0000000004748000-memory.dmp

Filesize
416KB

Download
memory/1980-3-0x0000000004760000-0x00000000047A0000-memory.dmp

Filesize
256KB

Download
memory/1980-2-0x0000000000630000-0x00000000006A8000-memory.dmp

Filesize
480KB

Download
memory/2796-25-0x00000000000E0000-0x00000000000E3000-memory.dmp

Filesize
12KB

Download
memory/2796-26-0x00000000000E0000-0x00000000000E3000-memory.dmp

Filesize
12KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads