rhadamanthys | 391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c

General

Target

391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe
Size

363KB
MD5

e720940033d0a875c83f019ee7418487
SHA1

872728a8b723b37735a5eaeb35516f747b6b4f17
SHA256

391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c
SHA512

bb6aebe4e825c72460ff6cc6b6ac17a23033e0faff0ff7c8d2d0a6781459ef5044ff482410863b46dc5f683512e602f7a04a17528ee9d8292f24fddabbb31cdf
SSDEEP

6144:wORjQKzqpAnLBZzxKnCoPoMiqbk9MKbzZJR7oM79fI7L+ZQe0cczk:7YSnFLKnCoXiqbkusj9jC+QPccY

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3112 created 2592	3112	RegAsm.exe	44

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1536 set thread context of 3112	1536	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	86

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3808	3112	WerFault.exe	86
3780	3112	WerFault.exe	86

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3112	RegAsm.exe
3112	RegAsm.exe
560	dialer.exe
560	dialer.exe
560	dialer.exe
560	dialer.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 3112	1536	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	86
PID 1536 wrote to memory of 3112	1536	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	86
PID 1536 wrote to memory of 3112	1536	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	86
PID 1536 wrote to memory of 3112	1536	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	86
PID 1536 wrote to memory of 3112	1536	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	86
PID 1536 wrote to memory of 3112	1536	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	86
PID 1536 wrote to memory of 3112	1536	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	86
PID 1536 wrote to memory of 3112	1536	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	86
PID 1536 wrote to memory of 3112	1536	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	86
PID 1536 wrote to memory of 3112	1536	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	86
PID 1536 wrote to memory of 3112	1536	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	86
PID 3112 wrote to memory of 560	3112	RegAsm.exe	94
PID 3112 wrote to memory of 560	3112	RegAsm.exe	94
PID 3112 wrote to memory of 560	3112	RegAsm.exe	94
PID 3112 wrote to memory of 560	3112	RegAsm.exe	94
PID 3112 wrote to memory of 560	3112	RegAsm.exe	94

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2592
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:560

C:\Users\Admin\AppData\Local\Temp\391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe
"C:\Users\Admin\AppData\Local\Temp\391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3112
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3112 -s 580
    3⤵
    - Program crash
    PID:3808
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3112 -s 596
    3⤵
    - Program crash
    PID:3780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3112 -ip 3112
1⤵
PID:4300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3112 -ip 3112
1⤵
PID:4688

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/560-19-0x0000000000D50000-0x0000000000D59000-memory.dmp

Filesize
36KB

Download
memory/560-27-0x0000000002B50000-0x0000000002F50000-memory.dmp

Filesize
4.0MB

Download
memory/560-26-0x0000000077300000-0x0000000077515000-memory.dmp

Filesize
2.1MB

Download
memory/560-24-0x0000000002B50000-0x0000000002F50000-memory.dmp

Filesize
4.0MB

Download
memory/560-23-0x00007FFE38850000-0x00007FFE38A45000-memory.dmp

Filesize
2.0MB

Download
memory/560-21-0x0000000002B50000-0x0000000002F50000-memory.dmp

Filesize
4.0MB

Download
memory/560-22-0x0000000002B50000-0x0000000002F50000-memory.dmp

Filesize
4.0MB

Download
memory/1536-1-0x0000000000BA0000-0x0000000000C02000-memory.dmp

Filesize
392KB

Download
memory/1536-6-0x0000000003090000-0x0000000005090000-memory.dmp

Filesize
32.0MB

Download
memory/1536-8-0x0000000074D80000-0x0000000075530000-memory.dmp

Filesize
7.7MB

Download
memory/1536-0-0x0000000074D80000-0x0000000075530000-memory.dmp

Filesize
7.7MB

Download
memory/3112-10-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/3112-18-0x0000000077300000-0x0000000077515000-memory.dmp

Filesize
2.1MB

Download
memory/3112-16-0x0000000003BC0000-0x0000000003FC0000-memory.dmp

Filesize
4.0MB

Download
memory/3112-15-0x00007FFE38850000-0x00007FFE38A45000-memory.dmp

Filesize
2.0MB

Download
memory/3112-14-0x0000000003BC0000-0x0000000003FC0000-memory.dmp

Filesize
4.0MB

Download
memory/3112-13-0x0000000003BC0000-0x0000000003FC0000-memory.dmp

Filesize
4.0MB

Download
memory/3112-12-0x0000000003BC0000-0x0000000003FC0000-memory.dmp

Filesize
4.0MB

Download
memory/3112-11-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/3112-28-0x0000000003BC0000-0x0000000003FC0000-memory.dmp

Filesize
4.0MB

Download
memory/3112-4-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download

Analysis

Sharing