rhadamanthys | 7a39caf04d025428d5d9e5098fef74e22f59eee2c3686f676e235ae954b18b6d

Resubmissions

10/02/2025, 02:06

250210-cjg3laykgq 10

10/02/2025, 02:04

250210-chg17syrby 10

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/02/2025, 02:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SoftWare(1).exe
Size

3.1MB
MD5

09776d1e6b458622944c21a37127d945
SHA1

55fe43db0038a411d1302b85cb1d8c61704bf2a4
SHA256

6718e20d2fcaed405be6cb6784e6df72d93e5449fbab18e4d2d1dec5e2efde0a
SHA512

e530a84c2bf855f8ed7ec667f12dd738c0af4a6f63efb861432065634d4d5afb5e8369d28e1c90753efe5ed24bbf384ac5e20819efdc3b73735a31fce7e83d07
SSDEEP

49152:SZQQYNwNfHO8dkHOL+/4n5TlqmjPEY5XlPHXc1jbIEXVQ7IiVVNSrUWTKtOd/o06:SdHSwn5eY5V2bd8b

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Detects Rhadamanthys payload 1 IoCs

resource	yara_rule
behavioral1/memory/2788-5-0x0000000000400000-0x0000000000481000-memory.dmp	Rhadamanthys_v8

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Rhadamanthys family
rhadamanthys
Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Runs regedit.exe 5 IoCs

pid	Process
1924	regedit.exe
2856	regedit.exe
940	regedit.exe
1776	regedit.exe
2628	regedit.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 2788	2744	SoftWare(1).exe	30
PID 2744 wrote to memory of 2788	2744	SoftWare(1).exe	30
PID 2744 wrote to memory of 2788	2744	SoftWare(1).exe	30
PID 2744 wrote to memory of 2788	2744	SoftWare(1).exe	30
PID 2744 wrote to memory of 2788	2744	SoftWare(1).exe	30
PID 2744 wrote to memory of 2788	2744	SoftWare(1).exe	30
PID 2744 wrote to memory of 2664	2744	SoftWare(1).exe	31
PID 2744 wrote to memory of 2664	2744	SoftWare(1).exe	31
PID 2744 wrote to memory of 2664	2744	SoftWare(1).exe	31
PID 2744 wrote to memory of 2664	2744	SoftWare(1).exe	31
PID 2744 wrote to memory of 2812	2744	SoftWare(1).exe	32
PID 2744 wrote to memory of 2812	2744	SoftWare(1).exe	32
PID 2744 wrote to memory of 2812	2744	SoftWare(1).exe	32
PID 2744 wrote to memory of 2812	2744	SoftWare(1).exe	32
PID 2744 wrote to memory of 2820	2744	SoftWare(1).exe	33
PID 2744 wrote to memory of 2820	2744	SoftWare(1).exe	33
PID 2744 wrote to memory of 2820	2744	SoftWare(1).exe	33
PID 2744 wrote to memory of 2820	2744	SoftWare(1).exe	33
PID 2744 wrote to memory of 2692	2744	SoftWare(1).exe	34
PID 2744 wrote to memory of 2692	2744	SoftWare(1).exe	34
PID 2744 wrote to memory of 2692	2744	SoftWare(1).exe	34
PID 2744 wrote to memory of 2692	2744	SoftWare(1).exe	34
PID 2744 wrote to memory of 2692	2744	SoftWare(1).exe	34
PID 2744 wrote to memory of 2692	2744	SoftWare(1).exe	34
PID 2744 wrote to memory of 2720	2744	SoftWare(1).exe	35
PID 2744 wrote to memory of 2720	2744	SoftWare(1).exe	35
PID 2744 wrote to memory of 2720	2744	SoftWare(1).exe	35
PID 2744 wrote to memory of 2720	2744	SoftWare(1).exe	35
PID 2744 wrote to memory of 2720	2744	SoftWare(1).exe	35
PID 2744 wrote to memory of 2580	2744	SoftWare(1).exe	36
PID 2744 wrote to memory of 2580	2744	SoftWare(1).exe	36
PID 2744 wrote to memory of 2580	2744	SoftWare(1).exe	36
PID 2744 wrote to memory of 2580	2744	SoftWare(1).exe	36
PID 2744 wrote to memory of 2580	2744	SoftWare(1).exe	36
PID 2744 wrote to memory of 2724	2744	SoftWare(1).exe	37
PID 2744 wrote to memory of 2724	2744	SoftWare(1).exe	37
PID 2744 wrote to memory of 2724	2744	SoftWare(1).exe	37
PID 2744 wrote to memory of 2724	2744	SoftWare(1).exe	37
PID 2744 wrote to memory of 2724	2744	SoftWare(1).exe	37
PID 2744 wrote to memory of 2552	2744	SoftWare(1).exe	38
PID 2744 wrote to memory of 2552	2744	SoftWare(1).exe	38
PID 2744 wrote to memory of 2552	2744	SoftWare(1).exe	38
PID 2744 wrote to memory of 2552	2744	SoftWare(1).exe	38
PID 2744 wrote to memory of 2552	2744	SoftWare(1).exe	38
PID 2744 wrote to memory of 2632	2744	SoftWare(1).exe	39
PID 2744 wrote to memory of 2632	2744	SoftWare(1).exe	39
PID 2744 wrote to memory of 2632	2744	SoftWare(1).exe	39
PID 2744 wrote to memory of 2632	2744	SoftWare(1).exe	39
PID 2744 wrote to memory of 2632	2744	SoftWare(1).exe	39
PID 2744 wrote to memory of 2632	2744	SoftWare(1).exe	39
PID 2744 wrote to memory of 2816	2744	SoftWare(1).exe	40
PID 2744 wrote to memory of 2816	2744	SoftWare(1).exe	40
PID 2744 wrote to memory of 2816	2744	SoftWare(1).exe	40
PID 2744 wrote to memory of 2816	2744	SoftWare(1).exe	40
PID 2744 wrote to memory of 2816	2744	SoftWare(1).exe	40
PID 2744 wrote to memory of 2816	2744	SoftWare(1).exe	40
PID 2744 wrote to memory of 1924	2744	SoftWare(1).exe	41
PID 2744 wrote to memory of 1924	2744	SoftWare(1).exe	41
PID 2744 wrote to memory of 1924	2744	SoftWare(1).exe	41
PID 2744 wrote to memory of 1924	2744	SoftWare(1).exe	41
PID 2744 wrote to memory of 1924	2744	SoftWare(1).exe	41
PID 2744 wrote to memory of 792	2744	SoftWare(1).exe	42
PID 2744 wrote to memory of 792	2744	SoftWare(1).exe	42
PID 2744 wrote to memory of 792	2744	SoftWare(1).exe	42

C:\Users\Admin\AppData\Local\Temp\SoftWare(1).exe
"C:\Users\Admin\AppData\Local\Temp\SoftWare(1).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
  2⤵
  PID:2788
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  PID:2664
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
  2⤵
  PID:2812
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:2820
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  PID:2692
- C:\Windows\System32\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:2720
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  PID:2580
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:2724
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:2552
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
  2⤵
  PID:2632
- C:\Program Files (x86)\Windows Mail\wab.exe
  "C:\Program Files (x86)\Windows Mail\wab.exe"
  2⤵
  PID:2816
- C:\Windows\regedit.exe
  "C:\Windows\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:1924
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
  2⤵
  PID:792
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
  2⤵
  PID:1020
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  PID:2096
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
  2⤵
  PID:2236
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:2252
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  PID:2652
- C:\Windows\System32\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:1804
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  PID:2392
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:2876
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:1844
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
  2⤵
  PID:1980
- C:\Program Files (x86)\Windows Mail\wab.exe
  "C:\Program Files (x86)\Windows Mail\wab.exe"
  2⤵
  PID:1236
- C:\Windows\regedit.exe
  "C:\Windows\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:2856
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
  2⤵
  PID:1984
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
  2⤵
  PID:2644
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  PID:2596
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
  2⤵
  PID:376
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:856
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  PID:1132
- C:\Windows\System32\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:1452
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  PID:1760
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:2952
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:2040
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
  2⤵
  PID:2444
- C:\Program Files (x86)\Windows Mail\wab.exe
  "C:\Program Files (x86)\Windows Mail\wab.exe"
  2⤵
  PID:2136
- C:\Windows\regedit.exe
  "C:\Windows\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:1776
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
  2⤵
  PID:2268
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
  2⤵
  PID:1672
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  PID:1204
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
  2⤵
  PID:1092
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:636
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  PID:2924
- C:\Windows\System32\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:1052
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  PID:2024
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:2448
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:772
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
  2⤵
  PID:492
- C:\Program Files (x86)\Windows Mail\wab.exe
  "C:\Program Files (x86)\Windows Mail\wab.exe"
  2⤵
  PID:1680
- C:\Windows\regedit.exe
  "C:\Windows\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:940
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
  2⤵
  PID:2352
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
  2⤵
  PID:3032
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  PID:1000
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
  2⤵
  PID:1084
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:1560
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  PID:764
- C:\Windows\System32\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:2088
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  PID:2124
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:2464
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:2684
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
  2⤵
  PID:2928
- C:\Program Files (x86)\Windows Mail\wab.exe
  "C:\Program Files (x86)\Windows Mail\wab.exe"
  2⤵
  PID:1652
- C:\Windows\regedit.exe
  "C:\Windows\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:2628
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
  2⤵
  PID:2672

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2744-0-0x000007FEF5F10000-0x000007FEF62C2000-memory.dmp

Filesize
3.7MB

Download
memory/2788-1-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2788-5-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2788-3-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download