rhadamanthys | 3f57344f1e9e5cbd8af2a623c444cbc6b5bc3d94bbe56ddaf22f0068acb13ec9

Analysis

max time kernel
140s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
07/10/2023, 07:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c14293904116ecf16d85fc0656fa9ec2.exe
Size 1.6MB
Sample231007-jbs88acb28
SHA256 3f57344f1e9e5cbd8af2a623c444cbc6b5bc3d94bbe56ddaf22f0068acb13ec9
MD5 c14293904116ecf16d85fc0656fa9ec2
SHA1 ab3ea5eb854351ac1a465849582b2d925f360718
SHA512 345a989033abdd45b8d6b7b14d573fa0c15112650ef668556c0a53cb7f5547bbe858e9bfd1c78b20bd426ce447f4b84bcf9a8d098a83ee4ba8b75e23b7123ee9
SSDEEP 24576:wH4G8P8VYPjxxT6qrkVFUrFrg+tsaBS/wRPtNZ/pqhi7fR3YM8LRMz50lw:vG8P8VYrmzaBS/wRpxfRz8LRMmlw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Detect rhadamanthys stealer shellcode 4 IoCs

resource	yara_rule
behavioral2/memory/3580-27-0x0000000002B90000-0x0000000002F90000-memory.dmp	family_rhadamanthys
behavioral2/memory/3580-28-0x0000000002B90000-0x0000000002F90000-memory.dmp	family_rhadamanthys
behavioral2/memory/3580-29-0x0000000002B90000-0x0000000002F90000-memory.dmp	family_rhadamanthys
behavioral2/memory/3580-30-0x0000000002B90000-0x0000000002F90000-memory.dmp	family_rhadamanthys

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Loads dropped DLL 1 IoCs

pid	Process
3580	channelFirefox.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4368 set thread context of 312	4368	c14293904116ecf16d85fc0656fa9ec2.exe	82
PID 312 set thread context of 3580	312	cmd.exe	94

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4368	c14293904116ecf16d85fc0656fa9ec2.exe
4368	c14293904116ecf16d85fc0656fa9ec2.exe
312	cmd.exe
312	cmd.exe
3580	channelFirefox.exe
3580	channelFirefox.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
4368	c14293904116ecf16d85fc0656fa9ec2.exe
312	cmd.exe
312	cmd.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 312	4368	c14293904116ecf16d85fc0656fa9ec2.exe	82
PID 4368 wrote to memory of 312	4368	c14293904116ecf16d85fc0656fa9ec2.exe	82
PID 4368 wrote to memory of 312	4368	c14293904116ecf16d85fc0656fa9ec2.exe	82
PID 4368 wrote to memory of 312	4368	c14293904116ecf16d85fc0656fa9ec2.exe	82
PID 312 wrote to memory of 3580	312	cmd.exe	94
PID 312 wrote to memory of 3580	312	cmd.exe	94
PID 312 wrote to memory of 3580	312	cmd.exe	94
PID 312 wrote to memory of 3580	312	cmd.exe	94
PID 312 wrote to memory of 3580	312	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\c14293904116ecf16d85fc0656fa9ec2.exe
"C:\Users\Admin\AppData\Local\Temp\c14293904116ecf16d85fc0656fa9ec2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:312
- - C:\Users\Admin\AppData\Local\Temp\channelFirefox.exe
    C:\Users\Admin\AppData\Local\Temp\channelFirefox.exe
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:3580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

22a1dad8

Path C:\Users\Admin\AppData\Local\Temp\22a1dad8
Size 1.0MB
SHA256 fe4d2f6aad23018578725c100f02fb554cfa45a9474d259bd2f926e9823df107
MD5 386c574fa0eac30a79e83f5f3f5c61c6
SHA1 a6c1c178bff2dc9d845985b91ddafec4a9455709
SHA512 3cee66315af1a2e077f81731c4e80725ab1766dc42a0f1805548ee37012bd4367831a53e171b5dd4ce399677e97df26ca7f256a01d5e1781d8b4a25c6e764031
SSDEEP 24576:1GNOWz5TrVwbX1n+1FwkFGSKB8y/LZuGrVifN2OKD:INTdTro3X/9UKD
MD5 SHA1 SHA512 SSDEEP

Submit Download

channelFirefox.exe

Path C:\Users\Admin\AppData\Local\Temp\channelFirefox.exe
Size 301KB
SHA256 c50bffbef786eb689358c63fc0585792d174c5e281499f12035afa1ce2ce19c8
MD5 68cefdfbd2e1a35e8c4f144e37d77a76
SHA1 0a6637d5eb3c958a0136358d0290514c7309af73
SHA512 88d79115a6a0c487bd39a00a202f2467f4e05991da780f29f33cfc1ca53d2c6489104d5fbbe7e70167eb20c958b0322690454aec9ab1776d265ab8c558e971f6
SSDEEP 6144:SemIWncUsq/i4vo6cRwtf/STC47MSzISIJTc6TDRb8:3jccjai4vo6cRb+4QScSI7Bb8
MD5 SHA1 SHA512 SSDEEP

Submit Download

channelFirefox.exe

Path C:\Users\Admin\AppData\Local\Temp\channelFirefox.exe
Size 301KB
SHA256 c50bffbef786eb689358c63fc0585792d174c5e281499f12035afa1ce2ce19c8
MD5 68cefdfbd2e1a35e8c4f144e37d77a76
SHA1 0a6637d5eb3c958a0136358d0290514c7309af73
SHA512 88d79115a6a0c487bd39a00a202f2467f4e05991da780f29f33cfc1ca53d2c6489104d5fbbe7e70167eb20c958b0322690454aec9ab1776d265ab8c558e971f6
SSDEEP 6144:SemIWncUsq/i4vo6cRwtf/STC47MSzISIJTc6TDRb8:3jccjai4vo6cRb+4QScSI7Bb8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/312-6-0x00007FFA142D0000-0x00007FFA144C5000-memory.dmp

Download

memory/312-10-0x0000000075820000-0x000000007599B000-memory.dmp

Download

memory/312-13-0x0000000075820000-0x000000007599B000-memory.dmp

Download

memory/312-9-0x0000000075820000-0x000000007599B000-memory.dmp

Download

memory/3580-19-0x00007FFA142D0000-0x00007FFA144C5000-memory.dmp

Download

memory/3580-28-0x0000000002B90000-0x0000000002F90000-memory.dmp

Download

memory/3580-14-0x0000000074520000-0x0000000075774000-memory.dmp

Download

memory/3580-31-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3580-30-0x0000000002B90000-0x0000000002F90000-memory.dmp

Download

memory/3580-29-0x0000000002B90000-0x0000000002F90000-memory.dmp

Download

memory/3580-20-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3580-25-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3580-26-0x0000000000600000-0x0000000000607000-memory.dmp

Download

memory/3580-27-0x0000000002B90000-0x0000000002F90000-memory.dmp

Download

memory/4368-0-0x0000000140000000-0x00000001401AE000-memory.dmp

Download

memory/4368-3-0x00007FFA054E0000-0x00007FFA05652000-memory.dmp

Download

memory/4368-1-0x00007FFA054E0000-0x00007FFA05652000-memory.dmp

Download

memory/4368-2-0x00007FFA054E0000-0x00007FFA05652000-memory.dmp

Download