rhadamanthys | 536e8b1207df3afebfae5d4d9f19e33948c04967c322ae1c02fae00bc3695346

Analysis

max time kernel
134s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20250207-en
resource tags

arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
submitted
10-02-2025 20:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bootstrapper/ffmpeg.dll
Size

3.8MB
MD5

bf759c99c1f327c821fcf193239bed34
SHA1

e541b6baaa86f9eec7eb296985d367f1d61ff13a
SHA256

183cd7011c36648ee6dffda0e4bb8042d5ad5db69c1c69a016dcd6412be3e8fb
SHA512

f061920dc2ff2c17dfc023e90c88dca45fe76bfdba6d3bea5a7406dd4ee7ba84b9b1ce4c13afc8e344b4f0cfcab62ad5e9980d07f95769a97d169900fbf56650
SSDEEP

49152:sn/DoMHCR/shZ6NecOjg7J8hoREUq3mdNJHKikD+o+1HuhoH5HDDEDMZAYXRfGeo:SCDouex

Score

10^/10

rhadamanthys discovery stealer

Malware Config

Signatures

Detects Rhadamanthys payload 4 IoCs

resource	yara_rule
behavioral7/memory/3004-2-0x0000000000400000-0x0000000000481000-memory.dmp	Rhadamanthys_v8
behavioral7/memory/3004-3-0x0000000000400000-0x0000000000481000-memory.dmp	Rhadamanthys_v8
behavioral7/memory/3004-1-0x0000000000400000-0x0000000000481000-memory.dmp	Rhadamanthys_v8
behavioral7/memory/3004-0-0x0000000000400000-0x0000000000481000-memory.dmp	Rhadamanthys_v8

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Rhadamanthys family
rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3004 created 2896	3004	aspnet_wp.exe	50

Downloads MZ/PE file 1 IoCs

flow	pid	Process
53	1552	Process not Found

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1028 set thread context of 3004	1028	rundll32.exe	86

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2612	3004	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_wp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4100	MicrosoftEdgeUpdate.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3004	aspnet_wp.exe
3004	aspnet_wp.exe
3004	aspnet_wp.exe
3004	aspnet_wp.exe
4360	svchost.exe
4360	svchost.exe
4360	svchost.exe
4360	svchost.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 3004	1028	rundll32.exe	86
PID 1028 wrote to memory of 3004	1028	rundll32.exe	86
PID 1028 wrote to memory of 3004	1028	rundll32.exe	86
PID 1028 wrote to memory of 3004	1028	rundll32.exe	86
PID 1028 wrote to memory of 3004	1028	rundll32.exe	86
PID 1028 wrote to memory of 3004	1028	rundll32.exe	86
PID 1028 wrote to memory of 3004	1028	rundll32.exe	86
PID 1028 wrote to memory of 3004	1028	rundll32.exe	86
PID 1028 wrote to memory of 3004	1028	rundll32.exe	86
PID 1028 wrote to memory of 3004	1028	rundll32.exe	86
PID 1028 wrote to memory of 3004	1028	rundll32.exe	86
PID 3004 wrote to memory of 4360	3004	aspnet_wp.exe	87
PID 3004 wrote to memory of 4360	3004	aspnet_wp.exe	87
PID 3004 wrote to memory of 4360	3004	aspnet_wp.exe	87
PID 3004 wrote to memory of 4360	3004	aspnet_wp.exe	87
PID 3004 wrote to memory of 4360	3004	aspnet_wp.exe	87

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2896
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4360

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bootstrapper\ffmpeg.dll,#1
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3004 -s 324
    3⤵
    - Program crash
    PID:2612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3004 -ip 3004
1⤵
PID:4660

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTUyMjI2MEYtNjYxMC00MzlELThGREYtQTMzNkREQThCNTIzfSIgdXNlcmlkPSJ7MTUzOTRGNDAtNzU0OS00QjM2LThDNDUtMzc5OTVFRDEyOTZFfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7MUQzMDBBN0UtQzVGRS00MjlDLUE5MjYtNjM2ODU3MzIwMDMyfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIzIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDU5MjEiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODE5ODA3NzAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MTg3MTEzNTIyIi8-PC9hcHA-PC9yZXF1ZXN0Pg
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:4100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3004-7-0x00007FFC11250000-0x00007FFC11445000-memory.dmp

Filesize
2.0MB

Download
memory/3004-4-0x0000000001240000-0x0000000001640000-memory.dmp

Filesize
4.0MB

Download
memory/3004-2-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/3004-0-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/3004-10-0x00000000764C0000-0x00000000766D5000-memory.dmp

Filesize
2.1MB

Download
memory/3004-6-0x0000000001240000-0x0000000001640000-memory.dmp

Filesize
4.0MB

Download
memory/3004-5-0x0000000001240000-0x0000000001640000-memory.dmp

Filesize
4.0MB

Download
memory/3004-20-0x0000000001240000-0x0000000001640000-memory.dmp

Filesize
4.0MB

Download
memory/3004-1-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/3004-3-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/3004-8-0x0000000001240000-0x0000000001640000-memory.dmp

Filesize
4.0MB

Download
memory/4360-14-0x0000000001310000-0x0000000001710000-memory.dmp

Filesize
4.0MB

Download
memory/4360-15-0x00007FFC11250000-0x00007FFC11445000-memory.dmp

Filesize
2.0MB

Download
memory/4360-17-0x00000000764C0000-0x00000000766D5000-memory.dmp

Filesize
2.1MB

Download
memory/4360-18-0x0000000001310000-0x0000000001710000-memory.dmp

Filesize
4.0MB

Download
memory/4360-19-0x0000000001310000-0x0000000001710000-memory.dmp

Filesize
4.0MB

Download
memory/4360-11-0x0000000000B60000-0x0000000000B6A000-memory.dmp

Filesize
40KB

Download