rhadamanthys | 1e7bf1aa6b91a6626f5633b5588fc713a2188ba4a1abba445ad531f106a5dabe

Resubmissions

12-02-2025 17:50

250212-wekgps1ndp 8

12-02-2025 17:48

250212-wde6la1nbp 10

12-02-2025 17:45

250212-wbz3zs1qaw 3

Analysis

max time kernel
5s
max time network
8s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
12-02-2025 17:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SoftWare(1).exe
Size

3.1MB
MD5

09776d1e6b458622944c21a37127d945
SHA1

55fe43db0038a411d1302b85cb1d8c61704bf2a4
SHA256

6718e20d2fcaed405be6cb6784e6df72d93e5449fbab18e4d2d1dec5e2efde0a
SHA512

e530a84c2bf855f8ed7ec667f12dd738c0af4a6f63efb861432065634d4d5afb5e8369d28e1c90753efe5ed24bbf384ac5e20819efdc3b73735a31fce7e83d07
SSDEEP

49152:SZQQYNwNfHO8dkHOL+/4n5TlqmjPEY5XlPHXc1jbIEXVQ7IiVVNSrUWTKtOd/o06:SdHSwn5eY5V2bd8b

Score

10^/10

rhadamanthys discovery stealer

Malware Config

Signatures

Detects Rhadamanthys payload 13 IoCs

resource	yara_rule
behavioral1/memory/3080-1-0x0000000000400000-0x0000000000481000-memory.dmp	Rhadamanthys_v8
behavioral1/memory/4184-4-0x0000000000400000-0x0000000000481000-memory.dmp	Rhadamanthys_v8
behavioral1/memory/4184-3-0x0000000000400000-0x0000000000481000-memory.dmp	Rhadamanthys_v8
behavioral1/memory/4184-5-0x0000000000400000-0x0000000000481000-memory.dmp	Rhadamanthys_v8
behavioral1/memory/1200-10-0x0000000000400000-0x0000000000481000-memory.dmp	Rhadamanthys_v8
behavioral1/memory/4888-9-0x0000000000400000-0x0000000000481000-memory.dmp	Rhadamanthys_v8
behavioral1/memory/4888-8-0x0000000000400000-0x0000000000481000-memory.dmp	Rhadamanthys_v8
behavioral1/memory/1200-11-0x0000000000400000-0x0000000000481000-memory.dmp	Rhadamanthys_v8
behavioral1/memory/2436-17-0x0000000000400000-0x0000000000481000-memory.dmp	Rhadamanthys_v8
behavioral1/memory/2436-15-0x0000000000400000-0x0000000000481000-memory.dmp	Rhadamanthys_v8
behavioral1/memory/1200-13-0x0000000000400000-0x0000000000481000-memory.dmp	Rhadamanthys_v8
behavioral1/memory/4888-12-0x0000000000400000-0x0000000000481000-memory.dmp	Rhadamanthys_v8
behavioral1/memory/2436-16-0x0000000000400000-0x0000000000481000-memory.dmp	Rhadamanthys_v8

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Rhadamanthys family
rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs

description	pid	Process	procid_target
PID 4184 created 2680	4184	aspnet_wp.exe	46
PID 2436 created 2680	2436	aspnet_wp.exe	46
PID 4888 created 2680	4888	aspnet_wp.exe	46
PID 1200 created 2680	1200	aspnet_wp.exe	46

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 3116 set thread context of 3080	3116	SoftWare(1).exe	83
PID 3116 set thread context of 4184	3116	SoftWare(1).exe	84
PID 3116 set thread context of 1200	3116	SoftWare(1).exe	87
PID 3116 set thread context of 4888	3116	SoftWare(1).exe	88
PID 3116 set thread context of 2436	3116	SoftWare(1).exe	89

Program crash 4 IoCs

pid	pid_target	Process	procid_target
2704	3080	WerFault.exe	83
1116	4184	WerFault.exe	84
1720	1200	WerFault.exe	87
1088	2436	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_wp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_wp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_wp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_wp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4184	aspnet_wp.exe
4184	aspnet_wp.exe
2436	aspnet_wp.exe
2436	aspnet_wp.exe
4888	aspnet_wp.exe
4888	aspnet_wp.exe
4184	aspnet_wp.exe
4184	aspnet_wp.exe
1200	aspnet_wp.exe
1200	aspnet_wp.exe
2436	aspnet_wp.exe
2436	aspnet_wp.exe
4888	aspnet_wp.exe
4888	aspnet_wp.exe
1200	aspnet_wp.exe
1200	aspnet_wp.exe
416	svchost.exe
416	svchost.exe
416	svchost.exe
416	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 3080	3116	SoftWare(1).exe	83
PID 3116 wrote to memory of 3080	3116	SoftWare(1).exe	83
PID 3116 wrote to memory of 3080	3116	SoftWare(1).exe	83
PID 3116 wrote to memory of 3080	3116	SoftWare(1).exe	83
PID 3116 wrote to memory of 3080	3116	SoftWare(1).exe	83
PID 3116 wrote to memory of 3080	3116	SoftWare(1).exe	83
PID 3116 wrote to memory of 3080	3116	SoftWare(1).exe	83
PID 3116 wrote to memory of 3080	3116	SoftWare(1).exe	83
PID 3116 wrote to memory of 3080	3116	SoftWare(1).exe	83
PID 3116 wrote to memory of 3080	3116	SoftWare(1).exe	83
PID 3116 wrote to memory of 3080	3116	SoftWare(1).exe	83
PID 3116 wrote to memory of 4184	3116	SoftWare(1).exe	84
PID 3116 wrote to memory of 4184	3116	SoftWare(1).exe	84
PID 3116 wrote to memory of 4184	3116	SoftWare(1).exe	84
PID 3116 wrote to memory of 4184	3116	SoftWare(1).exe	84
PID 3116 wrote to memory of 4184	3116	SoftWare(1).exe	84
PID 3116 wrote to memory of 4184	3116	SoftWare(1).exe	84
PID 3116 wrote to memory of 4184	3116	SoftWare(1).exe	84
PID 3116 wrote to memory of 4184	3116	SoftWare(1).exe	84
PID 3116 wrote to memory of 4184	3116	SoftWare(1).exe	84
PID 3116 wrote to memory of 4184	3116	SoftWare(1).exe	84
PID 3116 wrote to memory of 4184	3116	SoftWare(1).exe	84
PID 3116 wrote to memory of 1200	3116	SoftWare(1).exe	87
PID 3116 wrote to memory of 1200	3116	SoftWare(1).exe	87
PID 3116 wrote to memory of 1200	3116	SoftWare(1).exe	87
PID 3116 wrote to memory of 1200	3116	SoftWare(1).exe	87
PID 3116 wrote to memory of 1200	3116	SoftWare(1).exe	87
PID 3116 wrote to memory of 1200	3116	SoftWare(1).exe	87
PID 3116 wrote to memory of 1200	3116	SoftWare(1).exe	87
PID 3116 wrote to memory of 1200	3116	SoftWare(1).exe	87
PID 3116 wrote to memory of 1200	3116	SoftWare(1).exe	87
PID 3116 wrote to memory of 1200	3116	SoftWare(1).exe	87
PID 3116 wrote to memory of 1200	3116	SoftWare(1).exe	87
PID 3116 wrote to memory of 4888	3116	SoftWare(1).exe	88
PID 3116 wrote to memory of 4888	3116	SoftWare(1).exe	88
PID 3116 wrote to memory of 4888	3116	SoftWare(1).exe	88
PID 3116 wrote to memory of 4888	3116	SoftWare(1).exe	88
PID 3116 wrote to memory of 4888	3116	SoftWare(1).exe	88
PID 3116 wrote to memory of 4888	3116	SoftWare(1).exe	88
PID 3116 wrote to memory of 4888	3116	SoftWare(1).exe	88
PID 3116 wrote to memory of 4888	3116	SoftWare(1).exe	88
PID 3116 wrote to memory of 4888	3116	SoftWare(1).exe	88
PID 3116 wrote to memory of 4888	3116	SoftWare(1).exe	88
PID 3116 wrote to memory of 4888	3116	SoftWare(1).exe	88
PID 3116 wrote to memory of 2436	3116	SoftWare(1).exe	89
PID 3116 wrote to memory of 2436	3116	SoftWare(1).exe	89
PID 3116 wrote to memory of 2436	3116	SoftWare(1).exe	89
PID 3116 wrote to memory of 2436	3116	SoftWare(1).exe	89
PID 3116 wrote to memory of 2436	3116	SoftWare(1).exe	89
PID 3116 wrote to memory of 2436	3116	SoftWare(1).exe	89
PID 3116 wrote to memory of 2436	3116	SoftWare(1).exe	89
PID 3116 wrote to memory of 2436	3116	SoftWare(1).exe	89
PID 3116 wrote to memory of 2436	3116	SoftWare(1).exe	89
PID 3116 wrote to memory of 2436	3116	SoftWare(1).exe	89
PID 3116 wrote to memory of 2436	3116	SoftWare(1).exe	89
PID 2436 wrote to memory of 2172	2436	aspnet_wp.exe	92
PID 2436 wrote to memory of 2172	2436	aspnet_wp.exe	92
PID 2436 wrote to memory of 2172	2436	aspnet_wp.exe	92
PID 2436 wrote to memory of 2172	2436	aspnet_wp.exe	92
PID 2436 wrote to memory of 2172	2436	aspnet_wp.exe	92
PID 4184 wrote to memory of 416	4184	aspnet_wp.exe	91
PID 4184 wrote to memory of 416	4184	aspnet_wp.exe	91
PID 4184 wrote to memory of 416	4184	aspnet_wp.exe	91
PID 4184 wrote to memory of 416	4184	aspnet_wp.exe	91

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2680
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:416
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\System32\dllhost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2172
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3580
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1396

C:\Users\Admin\AppData\Local\Temp\SoftWare(1).exe
"C:\Users\Admin\AppData\Local\Temp\SoftWare(1).exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
  2⤵
  PID:3080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 76
    3⤵
    - Program crash
    PID:2704
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4184
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4184 -s 364
    3⤵
    - Program crash
    PID:1116
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1200
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1200 -s 360
    3⤵
    - Program crash
    PID:1720
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4888
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2436
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2436 -s 372
    3⤵
    - Program crash
    PID:1088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3080 -ip 3080
1⤵
PID:4424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2436 -ip 2436
1⤵
PID:1128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4184 -ip 4184
1⤵
PID:240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4888 -ip 4888
1⤵
PID:3420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 1200 -ip 1200
1⤵
PID:116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/416-58-0x0000000077040000-0x000000007727A000-memory.dmp

Filesize
2.2MB

Download
memory/416-56-0x00007FFCB3D30000-0x00007FFCB3F28000-memory.dmp

Filesize
2.0MB

Download
memory/416-54-0x00000000014B0000-0x00000000018B0000-memory.dmp

Filesize
4.0MB

Download
memory/1200-30-0x0000000000D80000-0x0000000001180000-memory.dmp

Filesize
4.0MB

Download
memory/1200-10-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1200-53-0x0000000000D80000-0x0000000001180000-memory.dmp

Filesize
4.0MB

Download
memory/1200-11-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1200-43-0x0000000077040000-0x000000007727A000-memory.dmp

Filesize
2.2MB

Download
memory/1200-31-0x00007FFCB3D30000-0x00007FFCB3F28000-memory.dmp

Filesize
2.0MB

Download
memory/1200-13-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1396-48-0x0000000001690000-0x0000000001A90000-memory.dmp

Filesize
4.0MB

Download
memory/2172-50-0x00000000009E0000-0x0000000000DE0000-memory.dmp

Filesize
4.0MB

Download
memory/2172-35-0x0000000000360000-0x000000000036A000-memory.dmp

Filesize
40KB

Download
memory/2436-15-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2436-52-0x0000000001180000-0x0000000001580000-memory.dmp

Filesize
4.0MB

Download
memory/2436-16-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2436-17-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2436-22-0x0000000001180000-0x0000000001580000-memory.dmp

Filesize
4.0MB

Download
memory/2436-34-0x0000000077040000-0x000000007727A000-memory.dmp

Filesize
2.2MB

Download
memory/2436-25-0x00007FFCB3D30000-0x00007FFCB3F28000-memory.dmp

Filesize
2.0MB

Download
memory/2436-32-0x0000000001180000-0x0000000001580000-memory.dmp

Filesize
4.0MB

Download
memory/3080-1-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/3116-0-0x00007FFC95BC0000-0x00007FFC95F72000-memory.dmp

Filesize
3.7MB

Download
memory/3580-55-0x0000000001680000-0x0000000001A80000-memory.dmp

Filesize
4.0MB

Download
memory/4184-23-0x00007FFCB3D30000-0x00007FFCB3F28000-memory.dmp

Filesize
2.0MB

Download
memory/4184-59-0x0000000001650000-0x0000000001A50000-memory.dmp

Filesize
4.0MB

Download
memory/4184-18-0x0000000001650000-0x0000000001A50000-memory.dmp

Filesize
4.0MB

Download
memory/4184-19-0x0000000001650000-0x0000000001A50000-memory.dmp

Filesize
4.0MB

Download
memory/4184-42-0x0000000001650000-0x0000000001A50000-memory.dmp

Filesize
4.0MB

Download
memory/4184-28-0x0000000077040000-0x000000007727A000-memory.dmp

Filesize
2.2MB

Download
memory/4184-20-0x0000000001650000-0x0000000001A50000-memory.dmp

Filesize
4.0MB

Download
memory/4184-4-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4184-3-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4184-5-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4888-26-0x0000000000720000-0x0000000000B20000-memory.dmp

Filesize
4.0MB

Download
memory/4888-9-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4888-8-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4888-39-0x0000000077040000-0x000000007727A000-memory.dmp

Filesize
2.2MB

Download
memory/4888-46-0x0000000000720000-0x0000000000B20000-memory.dmp

Filesize
4.0MB

Download
memory/4888-37-0x00007FFCB3D30000-0x00007FFCB3F28000-memory.dmp

Filesize
2.0MB

Download
memory/4888-12-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download