rhadamanthys | 5aff502c1a5ea267fed2a8f8ae63d512bc3a7eeedd7f36c94da93e6e6405b956

Analysis

max time kernel
90s
max time network
157s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250619-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250619-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
19/09/2025, 18:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
𝗦𝗘𝗧𝗨𝗣.exe
Size 96KB
Sample250919-xmpbasfl4y
SHA256 221e280026b6a95cb4e412c6b49d40369ad919f7c63d5431318d6252340b0352
MD5 2bc3674252e7014ff9a5da08c22de409
SHA1 4a382242a0b2b6319999817af2e172a4d4ffbab1
SHA512 f2a2aadf08327456536d9deadc4e5a714b9d4764695f3ae0f572199b5bad2f5fc0b38d680e742cc8bd96ef1762409be870f84fe2dd1cb6e861806f4a7da17671
SSDEEP 1536:Ov6uDgYlW777zK1rd6/+FXfMUXYg5z2wNeV1GtiFKrqsk/:5ukYMsrgAE1eNeV1GUFKrqsk/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery rhadamanthys stealer

Malware Config

Signatures

Detects Rhadamanthys Payload 1 IoCs

resource	yara_rule
behavioral2/memory/2148-35-0x00000000039D0000-0x0000000003DD0000-memory.dmp	family_rhadamanthys_payload

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Rhadamanthys family
rhadamanthys

Loads dropped DLL 2 IoCs

pid	Process
2148	PulseVa.exe
4828	Chime.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2200 set thread context of 2148	2200	𝗦𝗘𝗧𝗨𝗣.exe	88
PID 2200 set thread context of 4828	2200	𝗦𝗘𝗧𝗨𝗣.exe	90

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chime.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	𝗦𝗘𝗧𝗨𝗣.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PulseVa.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2200	𝗦𝗘𝗧𝗨𝗣.exe
2200	𝗦𝗘𝗧𝗨𝗣.exe
2200	𝗦𝗘𝗧𝗨𝗣.exe
2200	𝗦𝗘𝗧𝗨𝗣.exe
2148	PulseVa.exe
2148	PulseVa.exe
2148	PulseVa.exe
2148	PulseVa.exe
4828	Chime.exe
4828	Chime.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2200	𝗦𝗘𝗧𝗨𝗣.exe
2200	𝗦𝗘𝗧𝗨𝗣.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2148	2200	𝗦𝗘𝗧𝗨𝗣.exe	88
PID 2200 wrote to memory of 2148	2200	𝗦𝗘𝗧𝗨𝗣.exe	88
PID 2200 wrote to memory of 2148	2200	𝗦𝗘𝗧𝗨𝗣.exe	88
PID 2200 wrote to memory of 2148	2200	𝗦𝗘𝗧𝗨𝗣.exe	88
PID 2200 wrote to memory of 2148	2200	𝗦𝗘𝗧𝗨𝗣.exe	88
PID 2200 wrote to memory of 4828	2200	𝗦𝗘𝗧𝗨𝗣.exe	90
PID 2200 wrote to memory of 4828	2200	𝗦𝗘𝗧𝗨𝗣.exe	90
PID 2200 wrote to memory of 4828	2200	𝗦𝗘𝗧𝗨𝗣.exe	90
PID 2200 wrote to memory of 4828	2200	𝗦𝗘𝗧𝗨𝗣.exe	90

C:\Users\Admin\AppData\Local\Temp\𝗦𝗘𝗧𝗨𝗣.exe
"C:\Users\Admin\AppData\Local\Temp\𝗦𝗘𝗧𝗨𝗣.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Users\Admin\AppData\Local\PulseVa.exe
  C:\Users\Admin\AppData\Local\PulseVa.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2148
- C:\Users\Admin\AppData\Roaming\GEV_Validate\Chime.exe
  C:\Users\Admin\AppData\Roaming\GEV_Validate\Chime.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PulseVa.exe

Path C:\Users\Admin\AppData\Local\PulseVa.exe
Size 2.6MB
SHA256 54ee56421a67088a76359c6fab0ff64a5d105666b8e226b0fe2b8759bfbdde10
MD5 74585993ad66f985febcc9bfe0cf699d
SHA1 bf6739a1d3ca31d3c84ff37b78ec26473881c66c
SHA512 5f8ee722948e08f69ca7c4080df8da1aa40c30a2a03834883a4f2dea0bb9092499007acf81cfed543cbf3dcd6ad935cb1df93bf80a6a100eb55494700ce365af
SSDEEP 49152:9/Qp+T+WQLh5tA5pD5mgQUQFqNNHUhhyHiz55Q/FT/pgMXm:9/Qp+TEN5o5QUm2Uqiz5qpM
MD5 SHA1 SHA512 SSDEEP

Submit Download

1F09B09.tmp

Path C:\Users\Admin\AppData\Local\Temp\1F09B09.tmp
Size 40B
SHA256 7cfc81d712f238d64992a10b21065aed24ce287b80c72c23a7197b607b2cf5d1
MD5 e49604c1fb51f703ca82b092db5bc92f
SHA1 3143c716f0b85f79b36d0822855907a288207534
SHA512 2b7fb8ff95a92e71d971fc4a12fd08d7e8eb1b3fdaae6665aa4a97ddb795a697d87e27806d9db5f9c78be14b99bbfd933aa778985a4f7ccc5d6e18e5e49241e3
MD5 SHA1 SHA512

Submit Download

E4774A3.tmp

Path C:\Users\Admin\AppData\Local\Temp\E4774A3.tmp
Size 4.0MB
SHA256 49e0c228656d81aaf795b1e9329bcbdfbae11ef5060c96db38440e15d5d8ab1a
MD5 9f16854892335fbe5e433c945447e3ee
SHA1 ddc36658157fdfd5e8429e3aac2a59a8cfc3b39d
SHA512 2b23e5e38d1b5c771a2ddf2e43a65af94d5bb9194670ac14ba0c7c42e0329474078b725b55ac443ca82a0d890e1bdc561a7217bcc6bc8da305a1ee7627f8c0b0
SSDEEP 98304:12oDcdbmQFU6SY84mqAQbmjhGHca796li1gQnwhhFzX2/cl5qj4/mN:0a+qQKbYL2oCGHza8wh73l5qjcmN
MD5 SHA1 SHA512 SSDEEP

Submit Download

E4774A3.tmp

Path C:\Users\Admin\AppData\Local\Temp\E4774A3.tmp
Size 4.0MB
SHA256 305fedb028345bd5619c2af2efccbb0b21fe4d8c47938cbb069926d7c8ab05ce
MD5 67733e83b6bb2100afe3db34f8bb54a0
SHA1 d2937524d8832e1241a2fad347ba79d54e919f1a
SHA512 74f4bd701f5c310e6a249578a4f1d81dce8673d0a2edb4df17abb953a042996f627034e1662e363de05496e82259944560de17b2e7f5fbd1f77f04c1e2545d93
SSDEEP 98304:N2o6cdbmQFU6SY84mqAQbmjhGHca796li1gQnwhhFzX2/cl5qj4/mN:M7+qQKbYL2oCGHza8wh73l5qjcmN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Chime.exe

Path C:\Users\Admin\AppData\Roaming\GEV_Validate\Chime.exe
Size 619KB
SHA256 adb8347dfa1b1df1ca2211fe4d7e82f27ced939f1bf3d52548e52bc9e23fc52c
MD5 dd65b976d1865ba6c2368fcf9c9eb223
SHA1 db933b1ff0dc73c2e4f230aa3bd47646632d5714
SHA512 5ff91cc29744416a32789f277f2494bbe60bd1f2eb53ea48e538075e8d735420c0256b7798e8f99b9286bf8c3b0dcf5f1a1539b8f2792991fb7d5754ec6fa0df
SSDEEP 6144:+Zzvhs2Z4n1E7g34XtVYAOfTdH8zjQSYoLdnU4q:+J+2Z4nShVY5CjQxoLdnU4q
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2148-30-0x0000000001100000-0x00000000011A0000-memory.dmp

Download

memory/2148-24-0x0000000001100000-0x00000000011A0000-memory.dmp

Download

memory/2148-40-0x0000000001100000-0x00000000011A0000-memory.dmp

Download

memory/2148-39-0x00000000754F0000-0x000000007572A000-memory.dmp

Download

memory/2148-36-0x00000000039D0000-0x0000000003DD0000-memory.dmp

Download

memory/2148-35-0x00000000039D0000-0x0000000003DD0000-memory.dmp

Download

memory/2148-28-0x00007FFC9F350000-0x00007FFC9F548000-memory.dmp

Download

memory/2148-22-0x0000000001100000-0x00000000011A0000-memory.dmp

Download

memory/2200-20-0x0000000073510000-0x000000007368B000-memory.dmp

Download

memory/2200-10-0x0000000073510000-0x000000007368B000-memory.dmp

Download

memory/2200-6-0x0000000002800000-0x0000000003664000-memory.dmp

Download

memory/2200-8-0x0000000003810000-0x0000000003A1E000-memory.dmp

Download

memory/2200-11-0x00007FFC9F350000-0x00007FFC9F548000-memory.dmp

Download

memory/2200-4-0x0000000000DB0000-0x0000000000E14000-memory.dmp

Download

memory/2200-0-0x0000000000D90000-0x0000000000DB0000-memory.dmp

Download

memory/2200-2-0x0000000000E20000-0x0000000000EDE000-memory.dmp

Download

memory/2200-18-0x0000000073510000-0x000000007368B000-memory.dmp

Download

memory/2200-15-0x0000000073510000-0x000000007368B000-memory.dmp

Download

memory/2200-14-0x0000000073510000-0x000000007368B000-memory.dmp

Download

memory/2200-12-0x0000000073525000-0x0000000073526000-memory.dmp

Download

memory/4828-41-0x00007FFC9F350000-0x00007FFC9F548000-memory.dmp

Download