rhadamanthys | 7a39caf04d025428d5d9e5098fef74e22f59eee2c3686f676e235ae954b18b6d

Resubmissions

10-02-2025 02:06

250210-cjg3laykgq 10

10-02-2025 02:04

250210-chg17syrby 10

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
10-02-2025 02:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SoftWare(1).exe
Size

3.1MB
MD5

09776d1e6b458622944c21a37127d945
SHA1

55fe43db0038a411d1302b85cb1d8c61704bf2a4
SHA256

6718e20d2fcaed405be6cb6784e6df72d93e5449fbab18e4d2d1dec5e2efde0a
SHA512

e530a84c2bf855f8ed7ec667f12dd738c0af4a6f63efb861432065634d4d5afb5e8369d28e1c90753efe5ed24bbf384ac5e20819efdc3b73735a31fce7e83d07
SSDEEP

49152:SZQQYNwNfHO8dkHOL+/4n5TlqmjPEY5XlPHXc1jbIEXVQ7IiVVNSrUWTKtOd/o06:SdHSwn5eY5V2bd8b

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Detects Rhadamanthys payload 1 IoCs

resource	yara_rule
behavioral1/memory/368-3-0x0000000000400000-0x0000000000481000-memory.dmp	Rhadamanthys_v8

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Rhadamanthys family
rhadamanthys
Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Runs regedit.exe 5 IoCs

pid	Process
1664	regedit.exe
3028	regedit.exe
2688	regedit.exe
3024	regedit.exe
2296	regedit.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 368	2460	SoftWare(1).exe	29
PID 2460 wrote to memory of 368	2460	SoftWare(1).exe	29
PID 2460 wrote to memory of 368	2460	SoftWare(1).exe	29
PID 2460 wrote to memory of 368	2460	SoftWare(1).exe	29
PID 2460 wrote to memory of 368	2460	SoftWare(1).exe	29
PID 2460 wrote to memory of 368	2460	SoftWare(1).exe	29
PID 2460 wrote to memory of 2872	2460	SoftWare(1).exe	30
PID 2460 wrote to memory of 2872	2460	SoftWare(1).exe	30
PID 2460 wrote to memory of 2872	2460	SoftWare(1).exe	30
PID 2460 wrote to memory of 2872	2460	SoftWare(1).exe	30
PID 2460 wrote to memory of 2860	2460	SoftWare(1).exe	31
PID 2460 wrote to memory of 2860	2460	SoftWare(1).exe	31
PID 2460 wrote to memory of 2860	2460	SoftWare(1).exe	31
PID 2460 wrote to memory of 2860	2460	SoftWare(1).exe	31
PID 2460 wrote to memory of 2940	2460	SoftWare(1).exe	32
PID 2460 wrote to memory of 2940	2460	SoftWare(1).exe	32
PID 2460 wrote to memory of 2940	2460	SoftWare(1).exe	32
PID 2460 wrote to memory of 2940	2460	SoftWare(1).exe	32
PID 2460 wrote to memory of 2956	2460	SoftWare(1).exe	33
PID 2460 wrote to memory of 2956	2460	SoftWare(1).exe	33
PID 2460 wrote to memory of 2956	2460	SoftWare(1).exe	33
PID 2460 wrote to memory of 2956	2460	SoftWare(1).exe	33
PID 2460 wrote to memory of 2956	2460	SoftWare(1).exe	33
PID 2460 wrote to memory of 2956	2460	SoftWare(1).exe	33
PID 2460 wrote to memory of 2968	2460	SoftWare(1).exe	34
PID 2460 wrote to memory of 2968	2460	SoftWare(1).exe	34
PID 2460 wrote to memory of 2968	2460	SoftWare(1).exe	34
PID 2460 wrote to memory of 2968	2460	SoftWare(1).exe	34
PID 2460 wrote to memory of 2968	2460	SoftWare(1).exe	34
PID 2460 wrote to memory of 2888	2460	SoftWare(1).exe	35
PID 2460 wrote to memory of 2888	2460	SoftWare(1).exe	35
PID 2460 wrote to memory of 2888	2460	SoftWare(1).exe	35
PID 2460 wrote to memory of 2888	2460	SoftWare(1).exe	35
PID 2460 wrote to memory of 2888	2460	SoftWare(1).exe	35
PID 2460 wrote to memory of 2976	2460	SoftWare(1).exe	36
PID 2460 wrote to memory of 2976	2460	SoftWare(1).exe	36
PID 2460 wrote to memory of 2976	2460	SoftWare(1).exe	36
PID 2460 wrote to memory of 2976	2460	SoftWare(1).exe	36
PID 2460 wrote to memory of 2976	2460	SoftWare(1).exe	36
PID 2460 wrote to memory of 2132	2460	SoftWare(1).exe	37
PID 2460 wrote to memory of 2132	2460	SoftWare(1).exe	37
PID 2460 wrote to memory of 2132	2460	SoftWare(1).exe	37
PID 2460 wrote to memory of 2132	2460	SoftWare(1).exe	37
PID 2460 wrote to memory of 2132	2460	SoftWare(1).exe	37
PID 2460 wrote to memory of 2892	2460	SoftWare(1).exe	38
PID 2460 wrote to memory of 2892	2460	SoftWare(1).exe	38
PID 2460 wrote to memory of 2892	2460	SoftWare(1).exe	38
PID 2460 wrote to memory of 2892	2460	SoftWare(1).exe	38
PID 2460 wrote to memory of 2892	2460	SoftWare(1).exe	38
PID 2460 wrote to memory of 2892	2460	SoftWare(1).exe	38
PID 2460 wrote to memory of 2912	2460	SoftWare(1).exe	39
PID 2460 wrote to memory of 2912	2460	SoftWare(1).exe	39
PID 2460 wrote to memory of 2912	2460	SoftWare(1).exe	39
PID 2460 wrote to memory of 2912	2460	SoftWare(1).exe	39
PID 2460 wrote to memory of 2912	2460	SoftWare(1).exe	39
PID 2460 wrote to memory of 2912	2460	SoftWare(1).exe	39
PID 2460 wrote to memory of 3028	2460	SoftWare(1).exe	40
PID 2460 wrote to memory of 3028	2460	SoftWare(1).exe	40
PID 2460 wrote to memory of 3028	2460	SoftWare(1).exe	40
PID 2460 wrote to memory of 3028	2460	SoftWare(1).exe	40
PID 2460 wrote to memory of 3028	2460	SoftWare(1).exe	40
PID 2460 wrote to memory of 2868	2460	SoftWare(1).exe	41
PID 2460 wrote to memory of 2868	2460	SoftWare(1).exe	41
PID 2460 wrote to memory of 2868	2460	SoftWare(1).exe	41

C:\Users\Admin\AppData\Local\Temp\SoftWare(1).exe
"C:\Users\Admin\AppData\Local\Temp\SoftWare(1).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
  2⤵
  PID:368
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  PID:2872
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
  2⤵
  PID:2860
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:2940
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  PID:2956
- C:\Windows\System32\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:2968
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  PID:2888
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:2976
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:2132
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
  2⤵
  PID:2892
- C:\Program Files (x86)\Windows Mail\wab.exe
  "C:\Program Files (x86)\Windows Mail\wab.exe"
  2⤵
  PID:2912
- C:\Windows\regedit.exe
  "C:\Windows\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:3028
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
  2⤵
  PID:2868
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
  2⤵
  PID:2900
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  PID:2844
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
  2⤵
  PID:2936
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:2736
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  PID:2764
- C:\Windows\System32\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:1804
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  PID:2776
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:2120
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:1016
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
  2⤵
  PID:2128
- C:\Program Files (x86)\Windows Mail\wab.exe
  "C:\Program Files (x86)\Windows Mail\wab.exe"
  2⤵
  PID:1612
- C:\Windows\regedit.exe
  "C:\Windows\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:2688
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
  2⤵
  PID:2312
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
  2⤵
  PID:2088
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  PID:2124
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
  2⤵
  PID:2308
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:1764
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  PID:2552
- C:\Windows\System32\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:984
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  PID:1532
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:1500
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:952
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
  2⤵
  PID:2720
- C:\Program Files (x86)\Windows Mail\wab.exe
  "C:\Program Files (x86)\Windows Mail\wab.exe"
  2⤵
  PID:2908
- C:\Windows\regedit.exe
  "C:\Windows\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:3024
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
  2⤵
  PID:2928
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
  2⤵
  PID:1528
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  PID:3068
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
  2⤵
  PID:1056
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:1244
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  PID:2444
- C:\Windows\System32\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:2280
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  PID:2196
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:1052
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:1748
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
  2⤵
  PID:2256
- C:\Program Files (x86)\Windows Mail\wab.exe
  "C:\Program Files (x86)\Windows Mail\wab.exe"
  2⤵
  PID:1040
- C:\Windows\regedit.exe
  "C:\Windows\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:2296
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
  2⤵
  PID:316
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
  2⤵
  PID:1096
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  PID:1284
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
  2⤵
  PID:756
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:1256
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  PID:2156
- C:\Windows\System32\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:236
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  PID:1584
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:1304
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:2400
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
  2⤵
  PID:2148
- C:\Program Files (x86)\Windows Mail\wab.exe
  "C:\Program Files (x86)\Windows Mail\wab.exe"
  2⤵
  PID:1524
- C:\Windows\regedit.exe
  "C:\Windows\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:1664
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
  2⤵
  PID:1156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/368-1-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/368-3-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/368-2-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2460-0-0x000007FEF60A0000-0x000007FEF6452000-memory.dmp

Filesize
3.7MB

Download