rhadamanthys | a4f0774f5e78135e7efea0b8c887fcb216d4aae11334aaba707a7a42f7f3173d

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
06-02-2025 20:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ram.ps1
Size

155B
MD5

6a07358a9e4146d50f59090fe0d9ffd6
SHA1

51b5ebe903a261ef6dea38c27817b65d4ff77dcc
SHA256

a4f0774f5e78135e7efea0b8c887fcb216d4aae11334aaba707a7a42f7f3173d
SHA512

6bd54737c4d91905b3955eff3413592da4f9142f1e77da42833449e02301d3882619e8d6708c076b0498919709a1b296648017a27e8b9c015754733188b64eb7

Score

10^/10

rhadamanthys discovery execution stealer

Malware Config

Signatures

Detects Rhadamanthys payload 3 IoCs

resource	yara_rule
behavioral2/memory/2856-79-0x0000000000310000-0x0000000000393000-memory.dmp	Rhadamanthys_v8
behavioral2/memory/2856-81-0x0000000000310000-0x0000000000393000-memory.dmp	Rhadamanthys_v8
behavioral2/memory/2856-92-0x0000000000310000-0x0000000000393000-memory.dmp	Rhadamanthys_v8

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Rhadamanthys family
rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2856 created 960	2856	explorer.exe	50

Blocklisted process makes network request 1 IoCs

flow	pid	Process
7	1656	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
7	1656	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
3480	transport.exe
384	transport.exe
3008	WinX_DVD_Ripper_Platinum.exe
1872	WinX_DVD_Ripper_Platinum.exe

Loads dropped DLL 5 IoCs

pid	Process
384	transport.exe
3008	WinX_DVD_Ripper_Platinum.exe
3008	WinX_DVD_Ripper_Platinum.exe
1872	WinX_DVD_Ripper_Platinum.exe
1872	WinX_DVD_Ripper_Platinum.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1872 set thread context of 2408	1872	WinX_DVD_Ripper_Platinum.exe	104

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1656	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fontdrvhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinX_DVD_Ripper_Platinum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinX_DVD_Ripper_Platinum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
1656	powershell.exe
1656	powershell.exe
3008	WinX_DVD_Ripper_Platinum.exe
1872	WinX_DVD_Ripper_Platinum.exe
1872	WinX_DVD_Ripper_Platinum.exe
2408	cmd.exe
2408	cmd.exe
2856	explorer.exe
2856	explorer.exe
2856	explorer.exe
2856	explorer.exe
5108	fontdrvhost.exe
5108	fontdrvhost.exe
5108	fontdrvhost.exe
5108	fontdrvhost.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1872	WinX_DVD_Ripper_Platinum.exe
2408	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1656	powershell.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 3480	1656	powershell.exe	97
PID 1656 wrote to memory of 3480	1656	powershell.exe	97
PID 3480 wrote to memory of 384	3480	transport.exe	98
PID 3480 wrote to memory of 384	3480	transport.exe	98
PID 384 wrote to memory of 3008	384	transport.exe	99
PID 384 wrote to memory of 3008	384	transport.exe	99
PID 384 wrote to memory of 3008	384	transport.exe	99
PID 3008 wrote to memory of 1872	3008	WinX_DVD_Ripper_Platinum.exe	103
PID 3008 wrote to memory of 1872	3008	WinX_DVD_Ripper_Platinum.exe	103
PID 3008 wrote to memory of 1872	3008	WinX_DVD_Ripper_Platinum.exe	103
PID 1872 wrote to memory of 2408	1872	WinX_DVD_Ripper_Platinum.exe	104
PID 1872 wrote to memory of 2408	1872	WinX_DVD_Ripper_Platinum.exe	104
PID 1872 wrote to memory of 2408	1872	WinX_DVD_Ripper_Platinum.exe	104
PID 1872 wrote to memory of 2408	1872	WinX_DVD_Ripper_Platinum.exe	104
PID 2408 wrote to memory of 2856	2408	cmd.exe	109
PID 2408 wrote to memory of 2856	2408	cmd.exe	109
PID 2408 wrote to memory of 2856	2408	cmd.exe	109
PID 2408 wrote to memory of 2856	2408	cmd.exe	109
PID 2856 wrote to memory of 5108	2856	explorer.exe	111
PID 2856 wrote to memory of 5108	2856	explorer.exe	111
PID 2856 wrote to memory of 5108	2856	explorer.exe	111
PID 2856 wrote to memory of 5108	2856	explorer.exe	111
PID 2856 wrote to memory of 5108	2856	explorer.exe	111

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:960
- C:\Windows\SysWOW64\fontdrvhost.exe
  "C:\Windows\System32\fontdrvhost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5108

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\ram.ps1
1⤵
- Blocklisted process makes network request
- Downloads MZ/PE file
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Users\Admin\AppData\Local\Temp\transport.exe
  "C:\Users\Admin\AppData\Local\Temp\transport.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3480
- - C:\Windows\TEMP\{18ED57AD-239A-4328-B6E9-833C4EC4AD35}\.cr\transport.exe
    "C:\Windows\TEMP\{18ED57AD-239A-4328-B6E9-833C4EC4AD35}\.cr\transport.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\transport.exe" -burn.filehandle.attached=596 -burn.filehandle.self=592
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:384
  - - C:\Windows\TEMP\{331A9E3D-30CE-47E6-BA48-36800395E020}\.ba\WinX_DVD_Ripper_Platinum.exe
      C:\Windows\TEMP\{331A9E3D-30CE-47E6-BA48-36800395E020}\.ba\WinX_DVD_Ripper_Platinum.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3008
    - - C:\Users\Admin\AppData\Roaming\Dn_explore_test\WinX_DVD_Ripper_Platinum.exe
        
        C:\Users\Admin\AppData\Roaming\Dn_explore_test\WinX_DVD_Ripper_Platinum.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:1872
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\SysWOW64\cmd.exe
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:2408
        
        C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        7⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h5ayhg4x.cq5.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\a712d350

Filesize
1.1MB

MD5
4f8c799f046a7b5c228775856d54e79e

SHA1
3c7b114e1f1415a3606e7b42d42c70dcbf08ea45

SHA256
286b65d9ab2c1ffb3c3c8194237aecb7a955905954d72ff3cedbecd62e3105a7

SHA512
f1e9ee4957c31755937a20b98f00bcd5e995e0c38dc3ca3974c6bc6ad40a4a440fe9ed636cd592512727d960fc3bf19d9c01aee15141502f1edb33e96ffa0107

Download Submit
C:\Users\Admin\AppData\Local\Temp\transport.exe

Filesize
6.8MB

MD5
72ec64d0bc0b31f8842c9b5d488c11e7

SHA1
85d81edeac18c67d6c8b73ab628347586a5039ad

SHA256
019e368cdfe9e71959dfc32917463653dfa4c35c129f1feb1fe492187d46a22a

SHA512
e2d42b2f43916cd1191994b9f21b5961b965b23ac0ae87f679bcb13cf97f030e656f4e8eaec493dbcd54b9702e062eac02c761d14557bf20d8e00e02fcb993e0

Download Submit
C:\Windows\TEMP\{331A9E3D-30CE-47E6-BA48-36800395E020}\.ba\restart.msg

Filesize
863KB

MD5
d1f6010adeeeb153fcbf492a2013176d

SHA1
990b47b4948badd2b9499f2ca2bc065a639a6bdd

SHA256
4647a4cbd1b866fa7425682aefdd5236812ce099e37d5f21a973eaea694182da

SHA512
4bc78c048a8a70beeb096bcf7b93410f67752df9cb1029279b689dd119c8feaf40cda0634f5d259b5b7ec3aac4a647451e51de47312a94b200c4d99c4a42d70c

Download Submit
C:\Windows\TEMP\{331A9E3D-30CE-47E6-BA48-36800395E020}\.ba\transform.asp

Filesize
45KB

MD5
63afa5cdf59535a6ee3a44c29972f740

SHA1
90d721394d8c683078a146253f8e903767d6cae3

SHA256
e63d72eb447dba2e5110fe4cae4483f6395272ce26b79638ced29116037facef

SHA512
1d6c895aa0d3b02cf5e11ee50a8b9d57b6ef796a2adca5f092cf7f65a4d7cfe380c573e628d72fb59cbb304c5bf4620b1cb951d27969af3bf98e58034ce7cfd2

Download Submit
C:\Windows\Temp\{18ED57AD-239A-4328-B6E9-833C4EC4AD35}\.cr\transport.exe

Filesize
6.8MB

MD5
93860d60d2df0f9da732e45513e7ba5d

SHA1
ce6acbd9d61da9d988fb86a01daebecd0291d005

SHA256
9366725e71cf2999398b7b257286637b9fcb11d8b49a4afb96649921dfb31b1b

SHA512
e62d5ff6e85e053b22d4f4eb36d3da3336bf38d4bc5c95d8f800f7a81afad8a472075347756d1beb16e523b5a657a65379c01b8ef5b1143025c7a2e57e2288b3

Download Submit
C:\Windows\Temp\{331A9E3D-30CE-47E6-BA48-36800395E020}\.ba\Serum.dll

Filesize
130KB

MD5
20aa36c2ce87d64cb58e7e32f0546fb1

SHA1
d65d8b30c3343c4f22d2765325f7e518ba5cec2e

SHA256
55285f72c479667b7e4c395ec503f81e5ef560d224a0ffc5347dcb44b2bcd394

SHA512
5ab90561dc204402bfb4e7a7931f68bcbe73b2bae3e2999f8421406b0edf4225c1b1cebc8d888b59d0c936c71fbe4da99a3f7366c48196d578dcfe65051a5514

Download Submit
C:\Windows\Temp\{331A9E3D-30CE-47E6-BA48-36800395E020}\.ba\WinX_DVD_Ripper_Platinum.exe

Filesize
15.1MB

MD5
3c64548b4aedbd79411d69029bdae67f

SHA1
c27d42f5984ec27f63db147dfec7828c1c877990

SHA256
1f7a9cf0f11e5d30538e7162aa69c9216839dda3928b25368434f7e6e96ea0fb

SHA512
f61f2de84b61a6f8dfa943435d1ad0230df5c71081a5e642a95c35ce5b0ac7849d903ffc2985ba13cdbd457615150a3ed88d6bde2a9744d938ecb8f80305c842

Download Submit
C:\Windows\Temp\{331A9E3D-30CE-47E6-BA48-36800395E020}\.ba\libeay32.dll

Filesize
1.0MB

MD5
73a8cdc0bb5b95c1ba6deb39d71f0349

SHA1
bef1bb7843d0e424d55203bfa6fa3f40eedc9379

SHA256
639980c48dd692e9ff3144f3d932aa07e501f12197d587ec47eb5ec8f6b7696a

SHA512
7f81a44da7d6849f78d9eb6610831fc1c2aa6a76f986bd6d1f11ac79565189497c16ac76902750d101c97082915c6db267df4260eb48a0de1d88744a75e14722

Download Submit
C:\Windows\Temp\{331A9E3D-30CE-47E6-BA48-36800395E020}\.ba\profile.dll

Filesize
241KB

MD5
a957f7e18d5493a99d151ff504214d09

SHA1
cfdb6cb20382b68888b0efd8e761649d60c0a7b5

SHA256
3cb6f7bbefac6d1fa487ddaec82d4565cf2f564ec5f14eca1cbd5c987735ae9a

SHA512
80d3f142a637545255eefb73a20e278c0fdaf832b5a221e4588c4469ac8177f166d176262c86c7f8c90e5293992c2566b35703a2333507f4f3756f375d620bbe

Download Submit
memory/1656-13-0x00007FFACCD03000-0x00007FFACCD05000-memory.dmp

Filesize
8KB

Download
memory/1656-14-0x00007FFACCD00000-0x00007FFACD7C1000-memory.dmp

Filesize
10.8MB

Download
memory/1656-12-0x00007FFACCD00000-0x00007FFACD7C1000-memory.dmp

Filesize
10.8MB

Download
memory/1656-11-0x00007FFACCD00000-0x00007FFACD7C1000-memory.dmp

Filesize
10.8MB

Download
memory/1656-98-0x00007FFACCD00000-0x00007FFACD7C1000-memory.dmp

Filesize
10.8MB

Download
memory/1656-0-0x00007FFACCD03000-0x00007FFACCD05000-memory.dmp

Filesize
8KB

Download
memory/1656-2-0x000001F0C1EB0000-0x000001F0C1ED2000-memory.dmp

Filesize
136KB

Download
memory/1872-67-0x0000000074D10000-0x0000000074E8B000-memory.dmp

Filesize
1.5MB

Download
memory/1872-68-0x00007FFAEAED0000-0x00007FFAEB0C5000-memory.dmp

Filesize
2.0MB

Download
memory/1872-69-0x0000000000400000-0x0000000001335000-memory.dmp

Filesize
15.2MB

Download
memory/1872-72-0x0000000074D10000-0x0000000074E8B000-memory.dmp

Filesize
1.5MB

Download
memory/2408-76-0x00007FFAEAED0000-0x00007FFAEB0C5000-memory.dmp

Filesize
2.0MB

Download
memory/2408-77-0x0000000074D10000-0x0000000074E8B000-memory.dmp

Filesize
1.5MB

Download
memory/2856-81-0x0000000000310000-0x0000000000393000-memory.dmp

Filesize
524KB

Download
memory/2856-87-0x0000000075670000-0x0000000075885000-memory.dmp

Filesize
2.1MB

Download
memory/2856-79-0x0000000000310000-0x0000000000393000-memory.dmp

Filesize
524KB

Download
memory/2856-80-0x00007FFAEAED0000-0x00007FFAEB0C5000-memory.dmp

Filesize
2.0MB

Download
memory/2856-92-0x0000000000310000-0x0000000000393000-memory.dmp

Filesize
524KB

Download
memory/2856-83-0x0000000003390000-0x0000000003790000-memory.dmp

Filesize
4.0MB

Download
memory/2856-84-0x0000000003390000-0x0000000003790000-memory.dmp

Filesize
4.0MB

Download
memory/3008-50-0x00007FFAEAED0000-0x00007FFAEB0C5000-memory.dmp

Filesize
2.0MB

Download
memory/3008-60-0x0000000000400000-0x0000000001335000-memory.dmp

Filesize
15.2MB

Download
memory/3008-49-0x0000000074D10000-0x0000000074E8B000-memory.dmp

Filesize
1.5MB

Download
memory/5108-88-0x0000000000D50000-0x0000000000D5A000-memory.dmp

Filesize
40KB

Download
memory/5108-90-0x0000000001200000-0x0000000001600000-memory.dmp

Filesize
4.0MB

Download
memory/5108-95-0x0000000075670000-0x0000000075885000-memory.dmp

Filesize
2.1MB

Download
memory/5108-93-0x00007FFAEAED0000-0x00007FFAEB0C5000-memory.dmp

Filesize
2.0MB

Download