rhadamanthys | e313cf05660e5631a53dcd2223438433e6df1c5526c8d2582c72a9a3b3fb4ea6

General

Target

1d50e028116d5df70e1315bddf283d6f2ced3754c497d18c5a31c1dbaf618195.exe
Size

378.5MB
MD5

42b344af30bb2cc4ec897a8896e08ac6
SHA1

76c844e2c65c3b9556f837175d04c11985add9f5
SHA256

1d50e028116d5df70e1315bddf283d6f2ced3754c497d18c5a31c1dbaf618195
SHA512

c7a59d5eccac1285f60a66373dd8f175a48af109283413476f1d1ff6b7afa6b189a0919c77f3b6d62911dc362b52391699628869777d70002a2d7c54289ebca0
SSDEEP

49152:lOO26ZtuoHjBw65ivfPxFY/Wc8Mjy+4vDF:lOO1nGRMW9MjEp

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2536 created 1212	2536	kat90BB.tmp	21

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2972 set thread context of 2536	2972	1d50e028116d5df70e1315bddf283d6f2ced3754c497d18c5a31c1dbaf618195.exe	30

Executes dropped EXE 1 IoCs

pid	Process
2536	kat90BB.tmp

Loads dropped DLL 2 IoCs

pid	Process
2972	1d50e028116d5df70e1315bddf283d6f2ced3754c497d18c5a31c1dbaf618195.exe
2972	1d50e028116d5df70e1315bddf283d6f2ced3754c497d18c5a31c1dbaf618195.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2536	kat90BB.tmp
2536	kat90BB.tmp
2904	dialer.exe
2904	dialer.exe
2904	dialer.exe
2904	dialer.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2536	2972	1d50e028116d5df70e1315bddf283d6f2ced3754c497d18c5a31c1dbaf618195.exe	30
PID 2972 wrote to memory of 2536	2972	1d50e028116d5df70e1315bddf283d6f2ced3754c497d18c5a31c1dbaf618195.exe	30
PID 2972 wrote to memory of 2536	2972	1d50e028116d5df70e1315bddf283d6f2ced3754c497d18c5a31c1dbaf618195.exe	30
PID 2972 wrote to memory of 2536	2972	1d50e028116d5df70e1315bddf283d6f2ced3754c497d18c5a31c1dbaf618195.exe	30
PID 2972 wrote to memory of 2536	2972	1d50e028116d5df70e1315bddf283d6f2ced3754c497d18c5a31c1dbaf618195.exe	30
PID 2972 wrote to memory of 2536	2972	1d50e028116d5df70e1315bddf283d6f2ced3754c497d18c5a31c1dbaf618195.exe	30
PID 2972 wrote to memory of 2536	2972	1d50e028116d5df70e1315bddf283d6f2ced3754c497d18c5a31c1dbaf618195.exe	30
PID 2972 wrote to memory of 2536	2972	1d50e028116d5df70e1315bddf283d6f2ced3754c497d18c5a31c1dbaf618195.exe	30
PID 2972 wrote to memory of 2536	2972	1d50e028116d5df70e1315bddf283d6f2ced3754c497d18c5a31c1dbaf618195.exe	30
PID 2972 wrote to memory of 2536	2972	1d50e028116d5df70e1315bddf283d6f2ced3754c497d18c5a31c1dbaf618195.exe	30
PID 2536 wrote to memory of 2904	2536	kat90BB.tmp	31
PID 2536 wrote to memory of 2904	2536	kat90BB.tmp	31
PID 2536 wrote to memory of 2904	2536	kat90BB.tmp	31
PID 2536 wrote to memory of 2904	2536	kat90BB.tmp	31
PID 2536 wrote to memory of 2904	2536	kat90BB.tmp	31
PID 2536 wrote to memory of 2904	2536	kat90BB.tmp	31

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1212
- C:\Users\Admin\AppData\Local\Temp\1d50e028116d5df70e1315bddf283d6f2ced3754c497d18c5a31c1dbaf618195.exe
  "C:\Users\Admin\AppData\Local\Temp\1d50e028116d5df70e1315bddf283d6f2ced3754c497d18c5a31c1dbaf618195.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2972
- - C:\Users\Admin\AppData\Local\Temp\kat90BB.tmp
    C:\Users\Admin\AppData\Local\Temp\kat90BB.tmp
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2536
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\kat90BB.tmp

Filesize
861KB

MD5
66064dbdb70a5eb15ebf3bf65aba254b

SHA1
0284fd320f99f62aca800fb1251eff4c31ec4ed7

SHA256
6a94dbda2dd1edcff2331061d65e1baf09d4861cc7ba590c5ec754f3ac96a795

SHA512
b05c6c09ae7372c381fba591c3cb13a69a2451b9d38da1a95aac89413d7438083475d06796acb5440cd6ec65b030c9fa6cbdaa0d2fe91a926bae6499c360f17f

Download Submit
memory/2536-20-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2536-26-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2536-14-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2536-12-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2536-10-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2536-9-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2536-18-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2536-32-0x0000000076550000-0x0000000076597000-memory.dmp

Filesize
284KB

Download
memory/2536-29-0x0000000002DF0000-0x00000000031F0000-memory.dmp

Filesize
4.0MB

Download
memory/2536-24-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2536-28-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2536-30-0x0000000077490000-0x0000000077639000-memory.dmp

Filesize
1.7MB

Download
memory/2536-16-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2536-27-0x0000000002DF0000-0x00000000031F0000-memory.dmp

Filesize
4.0MB

Download
memory/2904-38-0x0000000077490000-0x0000000077639000-memory.dmp

Filesize
1.7MB

Download
memory/2904-35-0x0000000001ED0000-0x00000000022D0000-memory.dmp

Filesize
4.0MB

Download
memory/2904-33-0x00000000000C0000-0x00000000000C9000-memory.dmp

Filesize
36KB

Download
memory/2904-42-0x0000000077491000-0x0000000077592000-memory.dmp

Filesize
1.0MB

Download
memory/2904-41-0x0000000001ED0000-0x00000000022D0000-memory.dmp

Filesize
4.0MB

Download
memory/2904-40-0x0000000076550000-0x0000000076597000-memory.dmp

Filesize
284KB

Download
memory/2904-36-0x0000000001ED0000-0x00000000022D0000-memory.dmp

Filesize
4.0MB

Download
memory/2904-43-0x0000000001ED0000-0x00000000022D0000-memory.dmp

Filesize
4.0MB

Download
memory/2972-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2972-22-0x0000000003400000-0x0000000003613000-memory.dmp

Filesize
2.1MB

Download
memory/2972-25-0x0000000000400000-0x000000000068C000-memory.dmp

Filesize
2.5MB

Download
memory/2972-44-0x0000000003400000-0x0000000003613000-memory.dmp

Filesize
2.1MB

Download

Analysis

Sharing