rhadamanthys | 7b77d58834007e2b1baf6fca2ab6ff31350228b364e199d9648e87651fd84ba8

General

Target

ORDER_INQUIRY.exe
Size

1.0MB
MD5

bd50ff8b04307c3c37d4fac6973024e1
SHA1

3bc49fee10ba4955c32c4dbea816b2214304d0e7
SHA256

f052ced97704edefaff8aaa74736ef693e7bde53eaba2957eda941aea2a8afd2
SHA512

4d174c2df9b2bd0230af9ed315e2e628434dfa187886f84ae7045c4721bd900bce15631b11dca8f99549d03c0680720de7a990a4784fe0ed620cdf9e5664df17
SSDEEP

12288:wHMEa3XGYAG4wSeRMZup8r8KDdWKLvuRHYiGNwyGGs+TrvdMyVopoxL:fEYAveRY2O82WKLvutYiG5GS2yVe

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

ORDER_INQUIRY.exe

description pid process target process

PID 2964 created 1260 2964 ORDER_INQUIRY.exe Explorer.EXE
Deletes itself 1 IoCs

Processes:

dialer.exe

pid process

2552 dialer.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

ORDER_INQUIRY.exe

description pid process target process

PID 2220 set thread context of 2964 2220 ORDER_INQUIRY.exe ORDER_INQUIRY.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

ORDER_INQUIRY.exedialer.exe

pid process

2964 ORDER_INQUIRY.exe
2964 ORDER_INQUIRY.exe
2552 dialer.exe
2552 dialer.exe
2552 dialer.exe
2552 dialer.exe

description	pid	process	target process
PID 2964 created 1260	2964	ORDER_INQUIRY.exe	Explorer.EXE

pid	process
2552	dialer.exe

description	pid	process	target process
PID 2220 set thread context of 2964	2220	ORDER_INQUIRY.exe	ORDER_INQUIRY.exe

pid	process
2964	ORDER_INQUIRY.exe
2964	ORDER_INQUIRY.exe
2552	dialer.exe
2552	dialer.exe
2552	dialer.exe
2552	dialer.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

ORDER_INQUIRY.exeORDER_INQUIRY.exe

description	pid	process	target process
PID 2220 wrote to memory of 2964	2220	ORDER_INQUIRY.exe	ORDER_INQUIRY.exe
PID 2220 wrote to memory of 2964	2220	ORDER_INQUIRY.exe	ORDER_INQUIRY.exe
PID 2220 wrote to memory of 2964	2220	ORDER_INQUIRY.exe	ORDER_INQUIRY.exe
PID 2220 wrote to memory of 2964	2220	ORDER_INQUIRY.exe	ORDER_INQUIRY.exe
PID 2220 wrote to memory of 2964	2220	ORDER_INQUIRY.exe	ORDER_INQUIRY.exe
PID 2220 wrote to memory of 2964	2220	ORDER_INQUIRY.exe	ORDER_INQUIRY.exe
PID 2220 wrote to memory of 2964	2220	ORDER_INQUIRY.exe	ORDER_INQUIRY.exe
PID 2220 wrote to memory of 2964	2220	ORDER_INQUIRY.exe	ORDER_INQUIRY.exe
PID 2220 wrote to memory of 2964	2220	ORDER_INQUIRY.exe	ORDER_INQUIRY.exe
PID 2220 wrote to memory of 2964	2220	ORDER_INQUIRY.exe	ORDER_INQUIRY.exe
PID 2220 wrote to memory of 2964	2220	ORDER_INQUIRY.exe	ORDER_INQUIRY.exe
PID 2964 wrote to memory of 2552	2964	ORDER_INQUIRY.exe	dialer.exe
PID 2964 wrote to memory of 2552	2964	ORDER_INQUIRY.exe	dialer.exe
PID 2964 wrote to memory of 2552	2964	ORDER_INQUIRY.exe	dialer.exe
PID 2964 wrote to memory of 2552	2964	ORDER_INQUIRY.exe	dialer.exe
PID 2964 wrote to memory of 2552	2964	ORDER_INQUIRY.exe	dialer.exe
PID 2964 wrote to memory of 2552	2964	ORDER_INQUIRY.exe	dialer.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1260

C:\Users\Admin\AppData\Local\Temp\ORDER_INQUIRY.exe
"C:\Users\Admin\AppData\Local\Temp\ORDER_INQUIRY.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2220

C:\Users\Admin\AppData\Local\Temp\ORDER_INQUIRY.exe
"C:\Users\Admin\AppData\Local\Temp\ORDER_INQUIRY.exe"
3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2964

C:\Windows\SysWOW64\dialer.exe
"C:\Windows\system32\dialer.exe"
2⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
PID:2552

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2220-0-0x00000000012E0000-0x00000000013E8000-memory.dmp

Filesize
1.0MB

Download
memory/2220-4-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download
memory/2220-2-0x0000000004D70000-0x0000000004DB0000-memory.dmp

Filesize
256KB

Download
memory/2220-3-0x0000000000550000-0x0000000000568000-memory.dmp

Filesize
96KB

Download
memory/2220-18-0x0000000074D70000-0x000000007545E000-memory.dmp

Filesize
6.9MB

Download
memory/2220-5-0x0000000000570000-0x000000000057A000-memory.dmp

Filesize
40KB

Download
memory/2220-1-0x0000000074D70000-0x000000007545E000-memory.dmp

Filesize
6.9MB

Download
memory/2220-6-0x000000000D1F0000-0x000000000D2A0000-memory.dmp

Filesize
704KB

Download
memory/2552-27-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/2552-37-0x0000000077B70000-0x0000000077D19000-memory.dmp

Filesize
1.7MB

Download
memory/2552-35-0x0000000001E10000-0x0000000002210000-memory.dmp

Filesize
4.0MB

Download
memory/2552-32-0x0000000077B70000-0x0000000077D19000-memory.dmp

Filesize
1.7MB

Download
memory/2552-34-0x0000000075820000-0x0000000075867000-memory.dmp

Filesize
284KB

Download
memory/2552-31-0x0000000001E10000-0x0000000002210000-memory.dmp

Filesize
4.0MB

Download
memory/2552-30-0x0000000001E10000-0x0000000002210000-memory.dmp

Filesize
4.0MB

Download
memory/2552-36-0x0000000001E10000-0x0000000002210000-memory.dmp

Filesize
4.0MB

Download
memory/2964-8-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/2964-29-0x0000000000910000-0x0000000000D10000-memory.dmp

Filesize
4.0MB

Download
memory/2964-20-0x0000000000910000-0x0000000000D10000-memory.dmp

Filesize
4.0MB

Download
memory/2964-21-0x0000000000910000-0x0000000000D10000-memory.dmp

Filesize
4.0MB

Download
memory/2964-22-0x0000000000910000-0x0000000000D10000-memory.dmp

Filesize
4.0MB

Download
memory/2964-23-0x0000000000910000-0x0000000000D10000-memory.dmp

Filesize
4.0MB

Download
memory/2964-24-0x0000000077B70000-0x0000000077D19000-memory.dmp

Filesize
1.7MB

Download
memory/2964-26-0x0000000075820000-0x0000000075867000-memory.dmp

Filesize
284KB

Download
memory/2964-17-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/2964-19-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/2964-15-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/2964-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2964-12-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/2964-11-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/2964-10-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/2964-9-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/2964-7-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads