rhadamanthys | 57939197bad88b1f26555826a1de37b5527483a5583745cd614aff349cb41ea4

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2023, 13:51

Target

rh_0.4.9rc1.exe
Size

456KB
MD5

c5c64755f463c91c92f516b3214c5b37
SHA1

04b2137cf45cf32ad141c52ac66f67687bc7f35c
SHA256

57939197bad88b1f26555826a1de37b5527483a5583745cd614aff349cb41ea4
SHA512

9435b7d5d14de252e75335c80091ae3670bdf3be2cf02116b52ae7c1852e00085d8a601b19440af4034ce42da716972943bf9368bcde77870f9981f5f779cdd0
SSDEEP

6144:2uWP/BtSnurUylcrGYlnIttxv8HbcLgsd1Gus5psdrvV44dixP+MHDkBYdxtG9+g:2uWP/BZUyoLu8Agsmxwrvejkd2

Score

10^/10

Detect rhadamanthys stealer shellcode 5 IoCs

resource	yara_rule
behavioral2/memory/4044-1-0x0000000002420000-0x0000000002820000-memory.dmp	family_rhadamanthys
behavioral2/memory/4044-2-0x0000000002420000-0x0000000002820000-memory.dmp	family_rhadamanthys
behavioral2/memory/4044-3-0x0000000002420000-0x0000000002820000-memory.dmp	family_rhadamanthys
behavioral2/memory/4044-4-0x0000000002420000-0x0000000002820000-memory.dmp	family_rhadamanthys
behavioral2/memory/4044-12-0x0000000002420000-0x0000000002820000-memory.dmp	family_rhadamanthys

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4044 created 3100	4044	rh_0.4.9rc1.exe	58

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4044 wrote to memory of 3560	4044	rh_0.4.9rc1.exe	92
PID 4044 wrote to memory of 3560	4044	rh_0.4.9rc1.exe	92
PID 4044 wrote to memory of 3560	4044	rh_0.4.9rc1.exe	92
PID 4044 wrote to memory of 3560	4044	rh_0.4.9rc1.exe	92

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3100
- C:\Users\Admin\AppData\Local\Temp\rh_0.4.9rc1.exe
  "C:\Users\Admin\AppData\Local\Temp\rh_0.4.9rc1.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4044
- C:\Windows\system32\certreq.exe
  "C:\Windows\system32\certreq.exe"
  2⤵
  PID:3560

memory/3560-5-0x0000019A7A9D0000-0x0000019A7A9D3000-memory.dmp

Filesize
12KB

Download
memory/4044-0-0x0000000000570000-0x0000000000577000-memory.dmp

Filesize
28KB

Download
memory/4044-1-0x0000000002420000-0x0000000002820000-memory.dmp

Filesize
4.0MB

Download
memory/4044-2-0x0000000002420000-0x0000000002820000-memory.dmp

Filesize
4.0MB

Download
memory/4044-3-0x0000000002420000-0x0000000002820000-memory.dmp

Filesize
4.0MB

Download
memory/4044-4-0x0000000002420000-0x0000000002820000-memory.dmp

Filesize
4.0MB

Download
memory/4044-6-0x00000000031E0000-0x0000000003216000-memory.dmp

Filesize
216KB

Download
memory/4044-12-0x0000000002420000-0x0000000002820000-memory.dmp

Filesize
4.0MB

Download