rhadamanthys | c492beaf3ab7ee328578736ffa7522f5901d8e61693381ab22ad5b7583896576

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-02-2025 18:31

Target

2025-02-13_f1ec38bc13f44ad9eba7a42230b882ab_cobalt-strike_ryuk.exe
Size

1.4MB
MD5

f1ec38bc13f44ad9eba7a42230b882ab
SHA1

ae4025dde6ffdaaf72379468a268ac0220d15ddc
SHA256

c492beaf3ab7ee328578736ffa7522f5901d8e61693381ab22ad5b7583896576
SHA512

2696512e9a72cee931a69cbebcd57da87b0fd824eede2d5713375d3372bd7d4f029a2a6f5f0a99b4dbcca1c62c907dd6236a1e0ccd88b514ad5cbae6064c84c7
SSDEEP

24576:N5ikOIXxt2e9imxJLgy8008lzUQHYQ2bctQb4QYf3Pj42MdwoSB:PpmExOy8008lBHcb+Qu3PE2IwoSB

Score

10^/10

Detects Rhadamanthys payload 1 IoCs

resource	yara_rule
behavioral1/memory/1548-2-0x0000000000400000-0x0000000000481000-memory.dmp	Rhadamanthys_v8

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Rhadamanthys family
rhadamanthys

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 1548	1648	2025-02-13_f1ec38bc13f44ad9eba7a42230b882ab_cobalt-strike_ryuk.exe	31
PID 1648 wrote to memory of 1548	1648	2025-02-13_f1ec38bc13f44ad9eba7a42230b882ab_cobalt-strike_ryuk.exe	31
PID 1648 wrote to memory of 1548	1648	2025-02-13_f1ec38bc13f44ad9eba7a42230b882ab_cobalt-strike_ryuk.exe	31
PID 1648 wrote to memory of 1548	1648	2025-02-13_f1ec38bc13f44ad9eba7a42230b882ab_cobalt-strike_ryuk.exe	31
PID 1648 wrote to memory of 1548	1648	2025-02-13_f1ec38bc13f44ad9eba7a42230b882ab_cobalt-strike_ryuk.exe	31
PID 1648 wrote to memory of 1548	1648	2025-02-13_f1ec38bc13f44ad9eba7a42230b882ab_cobalt-strike_ryuk.exe	31
PID 1648 wrote to memory of 1548	1648	2025-02-13_f1ec38bc13f44ad9eba7a42230b882ab_cobalt-strike_ryuk.exe	31
PID 1648 wrote to memory of 1548	1648	2025-02-13_f1ec38bc13f44ad9eba7a42230b882ab_cobalt-strike_ryuk.exe	31
PID 1648 wrote to memory of 1548	1648	2025-02-13_f1ec38bc13f44ad9eba7a42230b882ab_cobalt-strike_ryuk.exe	31

C:\Users\Admin\AppData\Local\Temp\2025-02-13_f1ec38bc13f44ad9eba7a42230b882ab_cobalt-strike_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2025-02-13_f1ec38bc13f44ad9eba7a42230b882ab_cobalt-strike_ryuk.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\SysWOW64\rundll32.exe"
  2⤵
  PID:1548

memory/1548-0-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1548-2-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1548-1-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download