rhadamanthys | cade479a0b203af759b0f82c80d4b95ca46abe3a4f665f365953eb5e25fe9284

Analysis

max time kernel
449s
max time network
450s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
27-03-2024 23:04

Target

rh_0.6.0.exe
Size

355KB
MD5

464ea1bd9930cd4ecae392d7214c3905
SHA1

525be920ce25cf340d8e47a0f3fd993a908449fc
SHA256

cade479a0b203af759b0f82c80d4b95ca46abe3a4f665f365953eb5e25fe9284
SHA512

73bcb3c6119a73ccd34d8300cf4e4fc3b4abf4f7cdbba49d9ad341931785e36dc98258b0e759fe999c31b56320533f228bee8755838cb7850797ef5f14ad3aa3
SSDEEP

6144:g2qezd2ab1/RuHk+M3k8M3W7XomjOJCqshrOlumY6DMIewgxQfqrsb:gf2R/EEkCQFYDwRqw

Score

10^/10

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

rh_0.6.0.exe

description pid process target process

PID 3944 created 2548 3944 rh_0.6.0.exe sihost.exe
Deletes itself 1 IoCs

Processes:

dialer.exe

pid process

4796 dialer.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

rh_0.6.0.exedialer.exe

pid process

3944 rh_0.6.0.exe
3944 rh_0.6.0.exe
4796 dialer.exe
4796 dialer.exe
4796 dialer.exe
4796 dialer.exe

description	pid	process	target process
PID 3944 created 2548	3944	rh_0.6.0.exe	sihost.exe

pid	process
4796	dialer.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

rh_0.6.0.exe

description	pid	process	target process
PID 3944 wrote to memory of 4796	3944	rh_0.6.0.exe	dialer.exe
PID 3944 wrote to memory of 4796	3944	rh_0.6.0.exe	dialer.exe
PID 3944 wrote to memory of 4796	3944	rh_0.6.0.exe	dialer.exe
PID 3944 wrote to memory of 4796	3944	rh_0.6.0.exe	dialer.exe
PID 3944 wrote to memory of 4796	3944	rh_0.6.0.exe	dialer.exe

memory/3944-7-0x0000000075C90000-0x0000000075EA5000-memory.dmp

Filesize
2.1MB

Download
memory/3944-9-0x00000000000B0000-0x000000000011D000-memory.dmp

Filesize
436KB

Download
memory/3944-2-0x0000000003FE0000-0x00000000043E0000-memory.dmp

Filesize
4.0MB

Download
memory/3944-3-0x0000000003FE0000-0x00000000043E0000-memory.dmp

Filesize
4.0MB

Download
memory/3944-4-0x00007FFF89F10000-0x00007FFF8A105000-memory.dmp

Filesize
2.0MB

Download
memory/3944-5-0x0000000003FE0000-0x00000000043E0000-memory.dmp

Filesize
4.0MB

Download
memory/3944-1-0x0000000003FE0000-0x00000000043E0000-memory.dmp

Filesize
4.0MB

Download
memory/3944-0-0x00000000000B0000-0x000000000011D000-memory.dmp

Filesize
436KB

Download
memory/4796-8-0x0000000000770000-0x0000000000779000-memory.dmp

Filesize
36KB

Download
memory/4796-11-0x0000000002500000-0x0000000002900000-memory.dmp

Filesize
4.0MB

Download
memory/4796-12-0x0000000002500000-0x0000000002900000-memory.dmp

Filesize
4.0MB

Download
memory/4796-14-0x0000000002500000-0x0000000002900000-memory.dmp

Filesize
4.0MB

Download
memory/4796-13-0x00007FFF89F10000-0x00007FFF8A105000-memory.dmp

Filesize
2.0MB

Download
memory/4796-16-0x0000000075C90000-0x0000000075EA5000-memory.dmp

Filesize
2.1MB

Download
memory/4796-17-0x0000000002500000-0x0000000002900000-memory.dmp

Filesize
4.0MB

Download