rhadamanthys | 57939197bad88b1f26555826a1de37b5527483a5583745cd614aff349cb41ea4

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
02-10-2023 13:51

Target

rh_0.4.9rc1.exe
Size

456KB
MD5

c5c64755f463c91c92f516b3214c5b37
SHA1

04b2137cf45cf32ad141c52ac66f67687bc7f35c
SHA256

57939197bad88b1f26555826a1de37b5527483a5583745cd614aff349cb41ea4
SHA512

9435b7d5d14de252e75335c80091ae3670bdf3be2cf02116b52ae7c1852e00085d8a601b19440af4034ce42da716972943bf9368bcde77870f9981f5f779cdd0
SSDEEP

6144:2uWP/BtSnurUylcrGYlnIttxv8HbcLgsd1Gus5psdrvV44dixP+MHDkBYdxtG9+g:2uWP/BZUyoLu8Agsmxwrvejkd2

Score

10^/10

Detect rhadamanthys stealer shellcode 5 IoCs

resource	yara_rule
behavioral1/memory/1008-1-0x00000000020A0000-0x00000000024A0000-memory.dmp	family_rhadamanthys
behavioral1/memory/1008-3-0x00000000020A0000-0x00000000024A0000-memory.dmp	family_rhadamanthys
behavioral1/memory/1008-2-0x00000000020A0000-0x00000000024A0000-memory.dmp	family_rhadamanthys
behavioral1/memory/1008-4-0x00000000020A0000-0x00000000024A0000-memory.dmp	family_rhadamanthys
behavioral1/memory/1008-12-0x00000000020A0000-0x00000000024A0000-memory.dmp	family_rhadamanthys

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1008 created 1192	1008	rh_0.4.9rc1.exe	13

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 2612	1008	rh_0.4.9rc1.exe	30
PID 1008 wrote to memory of 2612	1008	rh_0.4.9rc1.exe	30
PID 1008 wrote to memory of 2612	1008	rh_0.4.9rc1.exe	30
PID 1008 wrote to memory of 2612	1008	rh_0.4.9rc1.exe	30
PID 1008 wrote to memory of 2612	1008	rh_0.4.9rc1.exe	30
PID 1008 wrote to memory of 2612	1008	rh_0.4.9rc1.exe	30

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1192
- C:\Users\Admin\AppData\Local\Temp\rh_0.4.9rc1.exe
  "C:\Users\Admin\AppData\Local\Temp\rh_0.4.9rc1.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1008
- C:\Windows\system32\certreq.exe
  "C:\Windows\system32\certreq.exe"
  2⤵
  PID:2612

memory/1008-0-0x0000000000240000-0x0000000000247000-memory.dmp

Filesize
28KB

Download
memory/1008-1-0x00000000020A0000-0x00000000024A0000-memory.dmp

Filesize
4.0MB

Download
memory/1008-3-0x00000000020A0000-0x00000000024A0000-memory.dmp

Filesize
4.0MB

Download
memory/1008-2-0x00000000020A0000-0x00000000024A0000-memory.dmp

Filesize
4.0MB

Download
memory/1008-4-0x00000000020A0000-0x00000000024A0000-memory.dmp

Filesize
4.0MB

Download
memory/1008-6-0x0000000000510000-0x0000000000546000-memory.dmp

Filesize
216KB

Download
memory/1008-12-0x00000000020A0000-0x00000000024A0000-memory.dmp

Filesize
4.0MB

Download
memory/2612-5-0x0000000000060000-0x0000000000063000-memory.dmp

Filesize
12KB

Download