rhadamanthys | 277a6ef6b56a8fcd377e0c7f98423fac366690acabb841b7211763dda70d70c9

Analysis

max time kernel
106s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
20/03/2025, 11:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

277a6ef6b56a8fcd377e0c7f98423fac366690acabb841b7211763dda70d70c9.exe
Size

439KB
MD5

9ba72a00c60a200291a778761f740375
SHA1

4084bd5dc99ec2f242ef9fda7f2338cceaed56fe
SHA256

277a6ef6b56a8fcd377e0c7f98423fac366690acabb841b7211763dda70d70c9
SHA512

a077e4c51a8d620c2ae2a2a96767f6ebdfcf7e7391e1b76d9753c6e67ef81ff5ac536e6e9f1e454dc1950e3bfc22eb360360c2ab619de231757e8177c30a5181
SSDEEP

6144:U1Qg7Id01Nc57+61VxXiUfDbNxB/0m1S0cAg/hI7ghe3JfJRoS5T:UB7Id0fcEEJNxB/l/0/hI0Q3bD5T

Score

10^/10

rhadamanthys discovery stealer

Malware Config

Signatures

Detects Rhadamanthys payload 2 IoCs

resource	yara_rule
behavioral1/memory/3324-0-0x0000000000CD0000-0x0000000000D51000-memory.dmp	Rhadamanthys_v8
behavioral1/memory/3324-4-0x0000000000CD0000-0x0000000000D51000-memory.dmp	Rhadamanthys_v8

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Rhadamanthys family
rhadamanthys

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	277a6ef6b56a8fcd377e0c7f98423fac366690acabb841b7211763dda70d70c9.exe

C:\Users\Admin\AppData\Local\Temp\277a6ef6b56a8fcd377e0c7f98423fac366690acabb841b7211763dda70d70c9.exe
"C:\Users\Admin\AppData\Local\Temp\277a6ef6b56a8fcd377e0c7f98423fac366690acabb841b7211763dda70d70c9.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3324-0-0x0000000000CD0000-0x0000000000D51000-memory.dmp

Filesize
516KB

Download
memory/3324-2-0x0000000001090000-0x0000000001490000-memory.dmp

Filesize
4.0MB

Download
memory/3324-1-0x0000000001090000-0x0000000001490000-memory.dmp

Filesize
4.0MB

Download
memory/3324-3-0x0000000001090000-0x0000000001490000-memory.dmp

Filesize
4.0MB

Download
memory/3324-4-0x0000000000CD0000-0x0000000000D51000-memory.dmp

Filesize
516KB

Download