rhadamanthys | 019e368cdfe9e71959dfc32917463653dfa4c35c129f1feb1fe492187d46a22a

General

Target

ram.exe
Size

6.8MB
MD5

72ec64d0bc0b31f8842c9b5d488c11e7
SHA1

85d81edeac18c67d6c8b73ab628347586a5039ad
SHA256

019e368cdfe9e71959dfc32917463653dfa4c35c129f1feb1fe492187d46a22a
SHA512

e2d42b2f43916cd1191994b9f21b5961b965b23ac0ae87f679bcb13cf97f030e656f4e8eaec493dbcd54b9702e062eac02c761d14557bf20d8e00e02fcb993e0
SSDEEP

196608:v/urAt9I7l4UXW4AzZS4NQdQtmAbGRHjoec:v7Ea/4AkAQdsmA88ec

Score

10^/10

Malware Config

Signatures

Detects Rhadamanthys payload 3 IoCs

resource	yara_rule
behavioral2/memory/3768-53-0x0000000000570000-0x00000000005F3000-memory.dmp	Rhadamanthys_v8
behavioral2/memory/3768-55-0x0000000000570000-0x00000000005F3000-memory.dmp	Rhadamanthys_v8
behavioral2/memory/3768-69-0x0000000000570000-0x00000000005F3000-memory.dmp	Rhadamanthys_v8

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Rhadamanthys family
rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3768 created 2572	3768	explorer.exe	50

Executes dropped EXE 3 IoCs

pid	Process
4672	ram.exe
4904	WinX_DVD_Ripper_Platinum.exe
628	WinX_DVD_Ripper_Platinum.exe

Loads dropped DLL 5 IoCs

pid	Process
4672	ram.exe
4904	WinX_DVD_Ripper_Platinum.exe
4904	WinX_DVD_Ripper_Platinum.exe
628	WinX_DVD_Ripper_Platinum.exe
628	WinX_DVD_Ripper_Platinum.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 628 set thread context of 4528	628	WinX_DVD_Ripper_Platinum.exe	93

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinX_DVD_Ripper_Platinum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinX_DVD_Ripper_Platinum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4904	WinX_DVD_Ripper_Platinum.exe
628	WinX_DVD_Ripper_Platinum.exe
628	WinX_DVD_Ripper_Platinum.exe
4528	cmd.exe
4528	cmd.exe
3768	explorer.exe
3768	explorer.exe
3768	explorer.exe
3768	explorer.exe
384	svchost.exe
384	svchost.exe
384	svchost.exe
384	svchost.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
628	WinX_DVD_Ripper_Platinum.exe
4528	cmd.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 4672	1224	ram.exe	85
PID 1224 wrote to memory of 4672	1224	ram.exe	85
PID 4672 wrote to memory of 4904	4672	ram.exe	87
PID 4672 wrote to memory of 4904	4672	ram.exe	87
PID 4672 wrote to memory of 4904	4672	ram.exe	87
PID 4904 wrote to memory of 628	4904	WinX_DVD_Ripper_Platinum.exe	92
PID 4904 wrote to memory of 628	4904	WinX_DVD_Ripper_Platinum.exe	92
PID 4904 wrote to memory of 628	4904	WinX_DVD_Ripper_Platinum.exe	92
PID 628 wrote to memory of 4528	628	WinX_DVD_Ripper_Platinum.exe	93
PID 628 wrote to memory of 4528	628	WinX_DVD_Ripper_Platinum.exe	93
PID 628 wrote to memory of 4528	628	WinX_DVD_Ripper_Platinum.exe	93
PID 628 wrote to memory of 4528	628	WinX_DVD_Ripper_Platinum.exe	93
PID 4528 wrote to memory of 3768	4528	cmd.exe	114
PID 4528 wrote to memory of 3768	4528	cmd.exe	114
PID 4528 wrote to memory of 3768	4528	cmd.exe	114
PID 4528 wrote to memory of 3768	4528	cmd.exe	114
PID 3768 wrote to memory of 384	3768	explorer.exe	115
PID 3768 wrote to memory of 384	3768	explorer.exe	115
PID 3768 wrote to memory of 384	3768	explorer.exe	115
PID 3768 wrote to memory of 384	3768	explorer.exe	115
PID 3768 wrote to memory of 384	3768	explorer.exe	115

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2572
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:384

C:\Users\Admin\AppData\Local\Temp\ram.exe
"C:\Users\Admin\AppData\Local\Temp\ram.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\TEMP\{244A81A3-1D8B-4D8D-857E-6DD86383CB94}\.cr\ram.exe
  "C:\Windows\TEMP\{244A81A3-1D8B-4D8D-857E-6DD86383CB94}\.cr\ram.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\ram.exe" -burn.filehandle.attached=592 -burn.filehandle.self=596
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4672
- - C:\Windows\TEMP\{0837AF39-6964-4A24-A564-DB1B026671CD}\.ba\WinX_DVD_Ripper_Platinum.exe
    C:\Windows\TEMP\{0837AF39-6964-4A24-A564-DB1B026671CD}\.ba\WinX_DVD_Ripper_Platinum.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4904
  - - C:\Users\Admin\AppData\Roaming\Dn_explore_test\WinX_DVD_Ripper_Platinum.exe
      C:\Users\Admin\AppData\Roaming\Dn_explore_test\WinX_DVD_Ripper_Platinum.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:628
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\SysWOW64\cmd.exe
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:4528
      - C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\153212ca

Filesize
1.1MB

MD5
2c6b31a28dcdf8186462238539b41ee9

SHA1
acfe17f2d821ff9161914125b3e2bbd956e1e63f

SHA256
13c1a7a76566802a46cf0fb91f51c04c5daf10ee19e905046e7a39f8fe3553b1

SHA512
a81b078d2c1e9cdff9a134e6d789f6bd8867c33372fbdd16cd08a08d04264abbd158f664560105c4ce7b3aadc73e40d7b54802499db2e07023d070e0b997defd

Download Submit
C:\Windows\TEMP\{0837AF39-6964-4A24-A564-DB1B026671CD}\.ba\LIBEAY32.DLL

Filesize
1.0MB

MD5
73a8cdc0bb5b95c1ba6deb39d71f0349

SHA1
bef1bb7843d0e424d55203bfa6fa3f40eedc9379

SHA256
639980c48dd692e9ff3144f3d932aa07e501f12197d587ec47eb5ec8f6b7696a

SHA512
7f81a44da7d6849f78d9eb6610831fc1c2aa6a76f986bd6d1f11ac79565189497c16ac76902750d101c97082915c6db267df4260eb48a0de1d88744a75e14722

Download Submit
C:\Windows\TEMP\{0837AF39-6964-4A24-A564-DB1B026671CD}\.ba\restart.msg

Filesize
863KB

MD5
d1f6010adeeeb153fcbf492a2013176d

SHA1
990b47b4948badd2b9499f2ca2bc065a639a6bdd

SHA256
4647a4cbd1b866fa7425682aefdd5236812ce099e37d5f21a973eaea694182da

SHA512
4bc78c048a8a70beeb096bcf7b93410f67752df9cb1029279b689dd119c8feaf40cda0634f5d259b5b7ec3aac4a647451e51de47312a94b200c4d99c4a42d70c

Download Submit
C:\Windows\TEMP\{0837AF39-6964-4A24-A564-DB1B026671CD}\.ba\transform.asp

Filesize
45KB

MD5
63afa5cdf59535a6ee3a44c29972f740

SHA1
90d721394d8c683078a146253f8e903767d6cae3

SHA256
e63d72eb447dba2e5110fe4cae4483f6395272ce26b79638ced29116037facef

SHA512
1d6c895aa0d3b02cf5e11ee50a8b9d57b6ef796a2adca5f092cf7f65a4d7cfe380c573e628d72fb59cbb304c5bf4620b1cb951d27969af3bf98e58034ce7cfd2

Download Submit
C:\Windows\Temp\{0837AF39-6964-4A24-A564-DB1B026671CD}\.ba\Serum.dll

Filesize
130KB

MD5
20aa36c2ce87d64cb58e7e32f0546fb1

SHA1
d65d8b30c3343c4f22d2765325f7e518ba5cec2e

SHA256
55285f72c479667b7e4c395ec503f81e5ef560d224a0ffc5347dcb44b2bcd394

SHA512
5ab90561dc204402bfb4e7a7931f68bcbe73b2bae3e2999f8421406b0edf4225c1b1cebc8d888b59d0c936c71fbe4da99a3f7366c48196d578dcfe65051a5514

Download Submit
C:\Windows\Temp\{0837AF39-6964-4A24-A564-DB1B026671CD}\.ba\WinX_DVD_Ripper_Platinum.exe

Filesize
15.1MB

MD5
3c64548b4aedbd79411d69029bdae67f

SHA1
c27d42f5984ec27f63db147dfec7828c1c877990

SHA256
1f7a9cf0f11e5d30538e7162aa69c9216839dda3928b25368434f7e6e96ea0fb

SHA512
f61f2de84b61a6f8dfa943435d1ad0230df5c71081a5e642a95c35ce5b0ac7849d903ffc2985ba13cdbd457615150a3ed88d6bde2a9744d938ecb8f80305c842

Download Submit
C:\Windows\Temp\{0837AF39-6964-4A24-A564-DB1B026671CD}\.ba\profile.dll

Filesize
241KB

MD5
a957f7e18d5493a99d151ff504214d09

SHA1
cfdb6cb20382b68888b0efd8e761649d60c0a7b5

SHA256
3cb6f7bbefac6d1fa487ddaec82d4565cf2f564ec5f14eca1cbd5c987735ae9a

SHA512
80d3f142a637545255eefb73a20e278c0fdaf832b5a221e4588c4469ac8177f166d176262c86c7f8c90e5293992c2566b35703a2333507f4f3756f375d620bbe

Download Submit
C:\Windows\Temp\{244A81A3-1D8B-4D8D-857E-6DD86383CB94}\.cr\ram.exe

Filesize
6.8MB

MD5
93860d60d2df0f9da732e45513e7ba5d

SHA1
ce6acbd9d61da9d988fb86a01daebecd0291d005

SHA256
9366725e71cf2999398b7b257286637b9fcb11d8b49a4afb96649921dfb31b1b

SHA512
e62d5ff6e85e053b22d4f4eb36d3da3336bf38d4bc5c95d8f800f7a81afad8a472075347756d1beb16e523b5a657a65379c01b8ef5b1143025c7a2e57e2288b3

Download Submit
memory/384-67-0x0000000077750000-0x0000000077965000-memory.dmp

Filesize
2.1MB

Download
memory/384-65-0x00007FFE97030000-0x00007FFE97225000-memory.dmp

Filesize
2.0MB

Download
memory/384-64-0x0000000001350000-0x0000000001750000-memory.dmp

Filesize
4.0MB

Download
memory/384-62-0x0000000000BB0000-0x0000000000BBA000-memory.dmp

Filesize
40KB

Download
memory/628-40-0x0000000075250000-0x00000000753CB000-memory.dmp

Filesize
1.5MB

Download
memory/628-41-0x00007FFE97030000-0x00007FFE97225000-memory.dmp

Filesize
2.0MB

Download
memory/628-43-0x0000000000400000-0x0000000001335000-memory.dmp

Filesize
15.2MB

Download
memory/628-46-0x0000000075250000-0x00000000753CB000-memory.dmp

Filesize
1.5MB

Download
memory/3768-58-0x0000000003510000-0x0000000003910000-memory.dmp

Filesize
4.0MB

Download
memory/3768-53-0x0000000000570000-0x00000000005F3000-memory.dmp

Filesize
524KB

Download
memory/3768-54-0x00007FFE97030000-0x00007FFE97225000-memory.dmp

Filesize
2.0MB

Download
memory/3768-55-0x0000000000570000-0x00000000005F3000-memory.dmp

Filesize
524KB

Download
memory/3768-57-0x0000000003510000-0x0000000003910000-memory.dmp

Filesize
4.0MB

Download
memory/3768-61-0x0000000077750000-0x0000000077965000-memory.dmp

Filesize
2.1MB

Download
memory/3768-69-0x0000000000570000-0x00000000005F3000-memory.dmp

Filesize
524KB

Download
memory/4528-51-0x0000000075250000-0x00000000753CB000-memory.dmp

Filesize
1.5MB

Download
memory/4528-50-0x00007FFE97030000-0x00007FFE97225000-memory.dmp

Filesize
2.0MB

Download
memory/4904-33-0x0000000000400000-0x0000000001335000-memory.dmp

Filesize
15.2MB

Download
memory/4904-24-0x00007FFE97030000-0x00007FFE97225000-memory.dmp

Filesize
2.0MB

Download
memory/4904-23-0x0000000075250000-0x00000000753CB000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing