rhadamanthys | 8d6c9fdb875cc3e3048b4852b8bc60aff5d071270ba3bf976445534250cd5f09

General

Target

8d6c9fdb875cc3e3048b4852b8bc60aff5d071270ba3bf976445534250cd5f09.exe
Size

579KB
MD5

9f229df785e9c754203604ac4bdd027c
SHA1

0cd6aec7a015467cddcb37fd44a0d986cd95334f
SHA256

8d6c9fdb875cc3e3048b4852b8bc60aff5d071270ba3bf976445534250cd5f09
SHA512

eb33034bab8f5bbe74789522e5c1be82f689234178e229ca6dac46b34e5c50465fdf5892e4a7e6d0c03061333d76a125d784eb644445fce9caf35e03852a18fe
SSDEEP

12288:LqzxxE/84PA9h2b4u7ccF4PksIvrG/XQ6FynsDBO4:Lq1C/8wA9h2k7Puq/XQWwUO

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3684 created 2624	3684	RegAsm.exe	55

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1404 set thread context of 3684	1404	8d6c9fdb875cc3e3048b4852b8bc60aff5d071270ba3bf976445534250cd5f09.exe	89

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5048	3684	WerFault.exe	89

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3684	RegAsm.exe
3684	RegAsm.exe
4484	dialer.exe
4484	dialer.exe
4484	dialer.exe
4484	dialer.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1404	8d6c9fdb875cc3e3048b4852b8bc60aff5d071270ba3bf976445534250cd5f09.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 1936	1404	8d6c9fdb875cc3e3048b4852b8bc60aff5d071270ba3bf976445534250cd5f09.exe	90
PID 1404 wrote to memory of 1936	1404	8d6c9fdb875cc3e3048b4852b8bc60aff5d071270ba3bf976445534250cd5f09.exe	90
PID 1404 wrote to memory of 1936	1404	8d6c9fdb875cc3e3048b4852b8bc60aff5d071270ba3bf976445534250cd5f09.exe	90
PID 1404 wrote to memory of 3684	1404	8d6c9fdb875cc3e3048b4852b8bc60aff5d071270ba3bf976445534250cd5f09.exe	89
PID 1404 wrote to memory of 3684	1404	8d6c9fdb875cc3e3048b4852b8bc60aff5d071270ba3bf976445534250cd5f09.exe	89
PID 1404 wrote to memory of 3684	1404	8d6c9fdb875cc3e3048b4852b8bc60aff5d071270ba3bf976445534250cd5f09.exe	89
PID 1404 wrote to memory of 3684	1404	8d6c9fdb875cc3e3048b4852b8bc60aff5d071270ba3bf976445534250cd5f09.exe	89
PID 1404 wrote to memory of 3684	1404	8d6c9fdb875cc3e3048b4852b8bc60aff5d071270ba3bf976445534250cd5f09.exe	89
PID 1404 wrote to memory of 3684	1404	8d6c9fdb875cc3e3048b4852b8bc60aff5d071270ba3bf976445534250cd5f09.exe	89
PID 1404 wrote to memory of 3684	1404	8d6c9fdb875cc3e3048b4852b8bc60aff5d071270ba3bf976445534250cd5f09.exe	89
PID 1404 wrote to memory of 3684	1404	8d6c9fdb875cc3e3048b4852b8bc60aff5d071270ba3bf976445534250cd5f09.exe	89
PID 1404 wrote to memory of 3684	1404	8d6c9fdb875cc3e3048b4852b8bc60aff5d071270ba3bf976445534250cd5f09.exe	89
PID 1404 wrote to memory of 3684	1404	8d6c9fdb875cc3e3048b4852b8bc60aff5d071270ba3bf976445534250cd5f09.exe	89
PID 1404 wrote to memory of 3684	1404	8d6c9fdb875cc3e3048b4852b8bc60aff5d071270ba3bf976445534250cd5f09.exe	89
PID 3684 wrote to memory of 4484	3684	RegAsm.exe	96
PID 3684 wrote to memory of 4484	3684	RegAsm.exe	96
PID 3684 wrote to memory of 4484	3684	RegAsm.exe	96
PID 3684 wrote to memory of 4484	3684	RegAsm.exe	96
PID 3684 wrote to memory of 4484	3684	RegAsm.exe	96

C:\Users\Admin\AppData\Local\Temp\8d6c9fdb875cc3e3048b4852b8bc60aff5d071270ba3bf976445534250cd5f09.exe
"C:\Users\Admin\AppData\Local\Temp\8d6c9fdb875cc3e3048b4852b8bc60aff5d071270ba3bf976445534250cd5f09.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3684
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3684 -s 612
    3⤵
    - Program crash
    PID:5048
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1936

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2624
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3684 -ip 3684
1⤵
PID:2472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1404-3-0x00000000010F0000-0x00000000010F1000-memory.dmp

Filesize
4KB

Download
memory/1404-1-0x0000000074D30000-0x00000000754E0000-memory.dmp

Filesize
7.7MB

Download
memory/1404-4-0x00000000029B0000-0x00000000029B1000-memory.dmp

Filesize
4KB

Download
memory/1404-6-0x00000000029B0000-0x00000000029B1000-memory.dmp

Filesize
4KB

Download
memory/1404-0-0x0000000000630000-0x00000000006C8000-memory.dmp

Filesize
608KB

Download
memory/1404-12-0x0000000074D30000-0x00000000754E0000-memory.dmp

Filesize
7.7MB

Download
memory/1404-2-0x0000000005080000-0x0000000005090000-memory.dmp

Filesize
64KB

Download
memory/3684-13-0x0000000003BC0000-0x0000000003FC0000-memory.dmp

Filesize
4.0MB

Download
memory/3684-28-0x0000000003BC0000-0x0000000003FC0000-memory.dmp

Filesize
4.0MB

Download
memory/3684-11-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3684-10-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3684-15-0x0000000003BC0000-0x0000000003FC0000-memory.dmp

Filesize
4.0MB

Download
memory/3684-16-0x00007FFE4AD50000-0x00007FFE4AF45000-memory.dmp

Filesize
2.0MB

Download
memory/3684-18-0x0000000003BC0000-0x0000000003FC0000-memory.dmp

Filesize
4.0MB

Download
memory/3684-5-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3684-19-0x0000000076CC0000-0x0000000076ED5000-memory.dmp

Filesize
2.1MB

Download
memory/4484-20-0x0000000000F20000-0x0000000000F29000-memory.dmp

Filesize
36KB

Download
memory/4484-27-0x0000000002CB0000-0x00000000030B0000-memory.dmp

Filesize
4.0MB

Download
memory/4484-23-0x0000000002CB0000-0x00000000030B0000-memory.dmp

Filesize
4.0MB

Download
memory/4484-26-0x0000000076CC0000-0x0000000076ED5000-memory.dmp

Filesize
2.1MB

Download
memory/4484-29-0x0000000002CB0000-0x00000000030B0000-memory.dmp

Filesize
4.0MB

Download
memory/4484-22-0x0000000002CB0000-0x00000000030B0000-memory.dmp

Filesize
4.0MB

Download
memory/4484-24-0x00007FFE4AD50000-0x00007FFE4AF45000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing