rhadamanthys

Sharing

Copy URL Twitter E-mail

General

Target
DropCheats.exe
Size 4.0MB
Sample250901-v2b86scn5v
SHA256 a653b19403d6a9f814130e4ca97194b9eade03575239d07bf00a225c9d012961
MD5 3fcc3658d2cd519f7d7e9486e52b7af9
SHA1 4e6ad559d3608876d01e75068dc1ddfdda5453c8
SHA512 f49ff8324dd9cc5d4029377e506daf446f03447bcb1090175683c13f3ee08a2a42492e43328af30e9fc7f1859068757678283720c26fbb1a846d49f413f8e8b3
SSDEEP 49152:8XJbaBxfTZRbwxW44XPhFPNnh4nq94HrelyriCLO:85baBhTX1XPhFPNMquHrely2J
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  DropCheats.exe
- Size 4.0MB
- SHA256 a653b19403d6a9f814130e4ca97194b9eade03575239d07bf00a225c9d012961
- MD5 3fcc3658d2cd519f7d7e9486e52b7af9
- SHA1 4e6ad559d3608876d01e75068dc1ddfdda5453c8
- SHA512 f49ff8324dd9cc5d4029377e506daf446f03447bcb1090175683c13f3ee08a2a42492e43328af30e9fc7f1859068757678283720c26fbb1a846d49f413f8e8b3
- SSDEEP 49152:8XJbaBxfTZRbwxW44XPhFPNnh4nq94HrelyriCLO:85baBhTX1XPhFPNMquHrely2J
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery rhadamanthys stealer
- Detects Rhadamanthys Payload
- Rhadamanthys
  Rhadamanthys is an info stealer written in C++ first seen in August 2022.
  stealer rhadamanthys
- Rhadamanthys family
  rhadamanthys
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Loads dropped DLL
- Enumerates processes with tasklist
  discovery
behavioral1
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
- MD5 08e9796ca20c5fc5076e3ac05fb5709a
- SHA1 07971d52dcbaa1054060073571ced046347177f7
- SHA512 02618317d6ab0302324aae4d3c5fca56b21e68c899e211cfa9412cf73820a1f931e56753c904fd7e510c638b4463aedbfe9536790279e096ea0387b67013e0c4
- SSDEEP 96:/Uspq2y5jOEEQrhySvUgfj74/vvrTBzfYZA4YF3Telac1nIq/2:/erjOELhySv5f2vvBjiAflaB1nIq
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral2
- Target
  $TEMP/Bang.xlsm
- Size 240KB
- SHA256 2e13faec24da6de0ba50984693c211b39175e63e1189501531631ae62a64f160
- MD5 c17484f3e06bc968e5f16dd94aa3aa8a
- SHA1 45d82e614e78a85ccb09f76f6a224f0d2e998b35
- SHA512 ded46b0c5cf65d0b99005ca5c595f6078bd284246acadd4a27208953ae173c9d101e8a7bb45e7cb30de30231cd098a106d2fa0df37997a7fc7a095ae9796c1df
- SSDEEP 6144:vbi8mdoLfHZJ2MvyFayRzg5/PdfKWj2VPcbu6:vnmdexYVFag091j22bu6
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral3
- Target
  $TEMP/Cases.xlsm
- Size 18KB
- SHA256 8c589d00de97a4cb8836e08f15ef91f9f867dc5ff770e792c84b37e4197a6047
- MD5 f406257f72df431207c67d36c3281437
- SHA1 09d18bcd940b579a0bf6f57770b04ae80e1eea8c
- SHA512 d29505ddf9aee18bdb227d01a0a03df4e28dcfc18619325837dcbd5efcc65649657df66c8c746e6516f59bd508f2f384ee48ebef3ced8f9ca0eabcb13f11576c
- SSDEEP 384:vmYgensHwWi2b8PPnbOt1NEzIP3Zxp9ZzJHIrU6Uqo56trR:v1niwNnENr33fBFurR
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral4
- Target
  $TEMP/Enterprises.xlsm
- Size 25KB
- SHA256 bd88f2abf13c1fd0cd8442c257ec508636fef9dd250095ee181ebd699720285d
- MD5 cc69bd6499f6331870247082d581da45
- SHA1 1fb3f01e91420fcc7f63181793c58db3ea5008f0
- SHA512 981329280108a13ae51eaef25c124565b6f8db1522085f6c6f7567fe2d6ef4d8b85f66512d02e1aba7a89be742966867f67d0942a1c15ce22e6cc4a3f1429fd0
- SSDEEP 768:nPQ6CwOVFJ5+RMVuDnM0Aw8KWgac5JMRvK:4n+RMWd5SRi
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5
- Target
  $TEMP/Interpretation.xlsm
- Size 102KB
- SHA256 cc7a7de26518028ec13d0febe0da31d9ac5f0949cc3cc69f05e3252f459c3f0a
- MD5 36e641ebe82968f61f6155437904fdff
- SHA1 68e931d94d02fd801b9f0efbb2964acafafd4bc9
- SHA512 712a097ec4b8a2367f0c166c51ebac008420c18afc442bb29f3f85043de634c9d5ee585e8fdb487ac35d23dc589e423b63cdb9282b6ba035760efa49f862a8f7
- SSDEEP 3072:NErMeJZ/CE8DHviDRz8qOBFNgwhyVrxvFLjaquT:NE1jCE8S8rPNTErxJedT
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral6
- Target
  $TEMP/Levitra.xlsm
- Size 124KB
- SHA256 ac78d6751853b8a65ac40365424b354e38696c1d96e0a012107cc15e14dfe979
- MD5 422fac5febad83246cdd5e92c1edd3f1
- SHA1 ad5b9dfcc23d1c961825034d260fb8caf0be50f3
- SHA512 cdcf6e8a9f96e8281cdf4cf8e61bae62846f1fd963608333a0ae416c7b25767394d5e84af3ef005214cef8f2dd346e207de1683d1502842091f112c2023a6549
- SSDEEP 3072:bjRaSLf2dKARMJ7nePC2mZX66NsgW10+HeG9b58J27UWO3sZ:nRaSLedKAMMmQr0+HZ8JIZ
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7
- Target
  $TEMP/Separated.xlsm
- Size 120KB
- SHA256 f0c6cf1d54ff26347e61746dc0b3c532da9d4d128af85055c98c15cc38bb2b72
- MD5 37b7e6d24ea18915e73e03cb915a3d93
- SHA1 7955e002ac9796aee0e35a105e30d7575f27a60c
- SHA512 c07ef245fb7051a0ae00aeb5bc4b4625ad2609eb06f2d7b957009dd1892cac07bd0c6aee36ff60251723b6fa31c18ac864b30523f9ad078c0eaea01fb3bd108b
- SSDEEP 3072:rF+G7nIB9hKUv53eubG2s+nkQI/IDbk1z2dyFD1IHUII:rF+GyXuui25T6IDya8TIHUL
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral8
- Target
  $TEMP/Violation.xlsm
- Size 233KB
- SHA256 568b717326e3166f5c4518927d06a305aef7cb87ebf558caf7735248110e176b
- MD5 3e916f9ddc0ba7916b574e6f40859f0d
- SHA1 e7c3f5dc794aec699e3219a93bcf01a09ae04b31
- SHA512 78720aa2a1409a3a25526bb2556c365da0fecc6d45eeb3225186d882dc29fa954adf6441ee004e2948d8dc34c7268cb01aadc557681c42be6beb9e69ed7379e5
- SSDEEP 6144:LI1m2d52rGHQdCsRxqZM38MoB7H6FYx2k83xd:Lid52rG2CK8M3OZ/wxd
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral9
- Target
  $TEMP/Worked.xlsm
- Size 131KB
- SHA256 d0abc02420fde74ce209fd501a2df42560b8e74b1a3981380bf84348ec4101ce
- MD5 3a3c8743b47ac2d330ede499bbdfedd4
- SHA1 0b771623bb6aebd8fe734962ac1860892ab2125a
- SHA512 88f06ed07a47056d200f51ca006841eb0ce3c43479f26e66e96afab348870e56b261c1f82136b29a8880e4e30cd7964f0081535f45cb3df98ec814bcdc242786
- SSDEEP 3072:3PfYEQhH/jFShvomHMoMobcXAowSZMMCrlvafpatI9:fe95ShvopxwolM5LG9
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects Rhadamanthys Payload

Rhadamanthys family

Suspicious use of NtCreateUserProcessOtherParentProcess

Executes dropped EXE

Loads dropped DLL

Enumerates processes with tasklist

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10