rhadamanthys | 65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636

Resubmissions

25-09-2023 01:49

230925-b8y7qsbc8w 10

25-09-2023 01:38

230925-b2l9lace87 10

Analysis

max time kernel
30s
max time network
36s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
25-09-2023 01:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe
Size

1.9MB
MD5

1b87684768db892932be3f0661c54251
SHA1

e5acdb93f6eb75656c9a8242e21b01bf978dc7cf
SHA256

65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636
SHA512

0fc3cc6ed99e45a3d1ca7cd2dd4d7bfc2f5f11ee7cf0e3d58bfbb4db26f16599cae45b96fc032cd6a050c1ea70bfd02291537088168dd149eee85b38d2527a82
SSDEEP

24576:jx4Ul0rrIOGz9I6U7AeyGvHynlLghECQl4L529dktxtPCv1ri+J/ac//zWOYopmB:mUl0/2kHW8ECQl4wi+snopp2vQ

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Detect rhadamanthys stealer shellcode 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4792-14-0x0000000003060000-0x0000000003460000-memory.dmp	family_rhadamanthys
behavioral2/memory/4792-15-0x0000000003060000-0x0000000003460000-memory.dmp	family_rhadamanthys
behavioral2/memory/4792-16-0x0000000003060000-0x0000000003460000-memory.dmp	family_rhadamanthys
behavioral2/memory/4792-17-0x0000000003060000-0x0000000003460000-memory.dmp	family_rhadamanthys
behavioral2/memory/4792-26-0x0000000003060000-0x0000000003460000-memory.dmp	family_rhadamanthys

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe

description	pid	Process	procid_target
PID 4792 created 3084	4792	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe	56

Suspicious use of SetThreadContext 1 IoCs

Processes:

65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe

description	pid	Process	procid_target
PID 4660 set thread context of 4792	4660	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe	84

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe

pid	Process
4660	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe
4792	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe
4792	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe
4792	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe
4792	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe

description	pid	Process
Token: SeDebugPrivilege	4660	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe

description	pid	Process	procid_target
PID 4660 wrote to memory of 4792	4660	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe	84
PID 4660 wrote to memory of 4792	4660	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe	84
PID 4660 wrote to memory of 4792	4660	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe	84
PID 4660 wrote to memory of 4792	4660	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe	84
PID 4660 wrote to memory of 4792	4660	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe	84
PID 4660 wrote to memory of 4792	4660	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe	84
PID 4660 wrote to memory of 4792	4660	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe	84
PID 4660 wrote to memory of 4792	4660	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe	84
PID 4792 wrote to memory of 700	4792	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe	86
PID 4792 wrote to memory of 700	4792	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe	86
PID 4792 wrote to memory of 700	4792	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe	86
PID 4792 wrote to memory of 700	4792	65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe	86

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3084
- C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe
  "C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4660
- - C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe
    C:\Users\Admin\AppData\Local\Temp\65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636.exe
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4792
- C:\Windows\system32\certreq.exe
  "C:\Windows\system32\certreq.exe"
  2⤵
  PID:700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/700-18-0x000001DA3D7E0000-0x000001DA3D7E3000-memory.dmp

Filesize
12KB

Download
memory/4660-12-0x0000000074D10000-0x00000000754C0000-memory.dmp

Filesize
7.7MB

Download
memory/4660-3-0x0000000005930000-0x0000000005940000-memory.dmp

Filesize
64KB

Download
memory/4660-0-0x0000000000C80000-0x0000000000E66000-memory.dmp

Filesize
1.9MB

Download
memory/4660-4-0x0000000005870000-0x00000000058D8000-memory.dmp

Filesize
416KB

Download
memory/4660-5-0x00000000058E0000-0x000000000592C000-memory.dmp

Filesize
304KB

Download
memory/4660-6-0x0000000005F30000-0x00000000064D4000-memory.dmp

Filesize
5.6MB

Download
memory/4660-1-0x0000000074D10000-0x00000000754C0000-memory.dmp

Filesize
7.7MB

Download
memory/4660-2-0x00000000057F0000-0x0000000005868000-memory.dmp

Filesize
480KB

Download
memory/4792-26-0x0000000003060000-0x0000000003460000-memory.dmp

Filesize
4.0MB

Download
memory/4792-10-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/4792-14-0x0000000003060000-0x0000000003460000-memory.dmp

Filesize
4.0MB

Download
memory/4792-13-0x0000000001340000-0x0000000001347000-memory.dmp

Filesize
28KB

Download
memory/4792-15-0x0000000003060000-0x0000000003460000-memory.dmp

Filesize
4.0MB

Download
memory/4792-16-0x0000000003060000-0x0000000003460000-memory.dmp

Filesize
4.0MB

Download
memory/4792-17-0x0000000003060000-0x0000000003460000-memory.dmp

Filesize
4.0MB

Download
memory/4792-7-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/4792-19-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/4792-20-0x0000000003DF0000-0x0000000003E26000-memory.dmp

Filesize
216KB

Download
memory/4792-11-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download