rhadamanthys | 615dd41707af9736ba4eeb08a0797395a0edc6fd605718a965c5029cbafe5818

General

Target

vstdlib_s64.dll
Size

4.9MB
MD5

964a139640199e709b1bfdbec679821d
SHA1

4bba8996b53e9a3fa9f12bcfc9982a7dd9cd704e
SHA256

ed4aa432fb4f138bfb3aa60f3ceae1054a8882295f9ce9ce75290c0fe16b1769
SHA512

d75f95f114780a4005218775785ceb81fe763d4692e375e1461b5e485ecda7d3b5e398d901239fe0da0afdafb0f3d852c7b199fdae48a7ab8e5ec4b0569d51c3
SSDEEP

49152:gccitDWBmZe2NldCkt2ByKAhu25XbizxLrfx7tBDOSpqrOuFM+xLFUVztPgoHRAZ:R5LAmFOztPgoHRAFH

Score

10^/10

Malware Config

Signatures

Detects Rhadamanthys payload 4 IoCs

resource	yara_rule
behavioral12/memory/3964-0-0x0000000000400000-0x0000000000481000-memory.dmp	Rhadamanthys_v8
behavioral12/memory/3964-3-0x0000000000400000-0x0000000000481000-memory.dmp	Rhadamanthys_v8
behavioral12/memory/3964-4-0x0000000000400000-0x0000000000481000-memory.dmp	Rhadamanthys_v8
behavioral12/memory/3964-2-0x0000000000400000-0x0000000000481000-memory.dmp	Rhadamanthys_v8

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Rhadamanthys family
rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3964 created 2836	3964	aspnet_wp.exe	50

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2496 set thread context of 3964	2496	rundll32.exe	86

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5920	3964	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_wp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3964	aspnet_wp.exe
3964	aspnet_wp.exe
3964	aspnet_wp.exe
3964	aspnet_wp.exe
3092	svchost.exe
3092	svchost.exe
3092	svchost.exe
3092	svchost.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 3964	2496	rundll32.exe	86
PID 2496 wrote to memory of 3964	2496	rundll32.exe	86
PID 2496 wrote to memory of 3964	2496	rundll32.exe	86
PID 2496 wrote to memory of 3964	2496	rundll32.exe	86
PID 2496 wrote to memory of 3964	2496	rundll32.exe	86
PID 2496 wrote to memory of 3964	2496	rundll32.exe	86
PID 2496 wrote to memory of 3964	2496	rundll32.exe	86
PID 2496 wrote to memory of 3964	2496	rundll32.exe	86
PID 2496 wrote to memory of 3964	2496	rundll32.exe	86
PID 2496 wrote to memory of 3964	2496	rundll32.exe	86
PID 2496 wrote to memory of 3964	2496	rundll32.exe	86
PID 3964 wrote to memory of 3092	3964	aspnet_wp.exe	89
PID 3964 wrote to memory of 3092	3964	aspnet_wp.exe	89
PID 3964 wrote to memory of 3092	3964	aspnet_wp.exe	89
PID 3964 wrote to memory of 3092	3964	aspnet_wp.exe	89
PID 3964 wrote to memory of 3092	3964	aspnet_wp.exe	89

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2836
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3092

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vstdlib_s64.dll,#1
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3964
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 312
    3⤵
    - Program crash
    PID:5920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3964 -ip 3964
1⤵
PID:2896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2496-1-0x00007FF98CA90000-0x00007FF98CF84000-memory.dmp

Filesize
5.0MB

Download
memory/3092-14-0x0000000000E00000-0x0000000001200000-memory.dmp

Filesize
4.0MB

Download
memory/3092-18-0x0000000075DB0000-0x0000000075FC5000-memory.dmp

Filesize
2.1MB

Download
memory/3092-21-0x0000000000E00000-0x0000000001200000-memory.dmp

Filesize
4.0MB

Download
memory/3092-16-0x00007FF9AA770000-0x00007FF9AA965000-memory.dmp

Filesize
2.0MB

Download
memory/3092-19-0x0000000000E00000-0x0000000001200000-memory.dmp

Filesize
4.0MB

Download
memory/3092-15-0x0000000000E00000-0x0000000001200000-memory.dmp

Filesize
4.0MB

Download
memory/3092-12-0x0000000000810000-0x000000000081A000-memory.dmp

Filesize
40KB

Download
memory/3964-8-0x00007FF9AA770000-0x00007FF9AA965000-memory.dmp

Filesize
2.0MB

Download
memory/3964-4-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/3964-7-0x0000000000ED0000-0x00000000012D0000-memory.dmp

Filesize
4.0MB

Download
memory/3964-11-0x0000000075DB0000-0x0000000075FC5000-memory.dmp

Filesize
2.1MB

Download
memory/3964-0-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/3964-6-0x0000000000ED0000-0x00000000012D0000-memory.dmp

Filesize
4.0MB

Download
memory/3964-9-0x0000000000ED0000-0x00000000012D0000-memory.dmp

Filesize
4.0MB

Download
memory/3964-5-0x0000000000ED0000-0x00000000012D0000-memory.dmp

Filesize
4.0MB

Download
memory/3964-3-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/3964-20-0x0000000000ED0000-0x00000000012D0000-memory.dmp

Filesize
4.0MB

Download
memory/3964-2-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download

Analysis

Sharing