rhadamanthys | 5aff502c1a5ea267fed2a8f8ae63d512bc3a7eeedd7f36c94da93e6e6405b956

Analysis

max time kernel
99s
max time network
107s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
19/09/2025, 18:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
𝗦𝗘𝗧𝗨𝗣.exe
Size 96KB
Sample250919-xmpbasfl4y
SHA256 221e280026b6a95cb4e412c6b49d40369ad919f7c63d5431318d6252340b0352
MD5 2bc3674252e7014ff9a5da08c22de409
SHA1 4a382242a0b2b6319999817af2e172a4d4ffbab1
SHA512 f2a2aadf08327456536d9deadc4e5a714b9d4764695f3ae0f572199b5bad2f5fc0b38d680e742cc8bd96ef1762409be870f84fe2dd1cb6e861806f4a7da17671
SSDEEP 1536:Ov6uDgYlW777zK1rd6/+FXfMUXYg5z2wNeV1GtiFKrqsk/:5ukYMsrgAE1eNeV1GUFKrqsk/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery rhadamanthys stealer

Malware Config

Signatures

Detects Rhadamanthys Payload 1 IoCs

resource	yara_rule
behavioral3/memory/4836-45-0x00000000034A0000-0x00000000038A0000-memory.dmp	family_rhadamanthys_payload

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Rhadamanthys family
rhadamanthys

Loads dropped DLL 2 IoCs

pid	Process
4836	PulseVa.exe
3276	Chime.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3832 set thread context of 4836	3832	𝗦𝗘𝗧𝗨𝗣.exe	79
PID 3832 set thread context of 3276	3832	𝗦𝗘𝗧𝗨𝗣.exe	80

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	𝗦𝗘𝗧𝗨𝗣.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PulseVa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chime.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3832	𝗦𝗘𝗧𝗨𝗣.exe
3832	𝗦𝗘𝗧𝗨𝗣.exe
3832	𝗦𝗘𝗧𝗨𝗣.exe
3832	𝗦𝗘𝗧𝗨𝗣.exe
4836	PulseVa.exe
4836	PulseVa.exe
4836	PulseVa.exe
4836	PulseVa.exe
3276	Chime.exe
3276	Chime.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3832	𝗦𝗘𝗧𝗨𝗣.exe
3832	𝗦𝗘𝗧𝗨𝗣.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3832 wrote to memory of 4836	3832	𝗦𝗘𝗧𝗨𝗣.exe	79
PID 3832 wrote to memory of 4836	3832	𝗦𝗘𝗧𝗨𝗣.exe	79
PID 3832 wrote to memory of 4836	3832	𝗦𝗘𝗧𝗨𝗣.exe	79
PID 3832 wrote to memory of 4836	3832	𝗦𝗘𝗧𝗨𝗣.exe	79
PID 3832 wrote to memory of 4836	3832	𝗦𝗘𝗧𝗨𝗣.exe	79
PID 3832 wrote to memory of 3276	3832	𝗦𝗘𝗧𝗨𝗣.exe	80
PID 3832 wrote to memory of 3276	3832	𝗦𝗘𝗧𝗨𝗣.exe	80
PID 3832 wrote to memory of 3276	3832	𝗦𝗘𝗧𝗨𝗣.exe	80
PID 3832 wrote to memory of 3276	3832	𝗦𝗘𝗧𝗨𝗣.exe	80

C:\Users\Admin\AppData\Local\Temp\𝗦𝗘𝗧𝗨𝗣.exe
"C:\Users\Admin\AppData\Local\Temp\𝗦𝗘𝗧𝗨𝗣.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3832
- C:\Users\Admin\AppData\Local\PulseVa.exe
  C:\Users\Admin\AppData\Local\PulseVa.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4836
- C:\Users\Admin\AppData\Roaming\GEV_Validate\Chime.exe
  C:\Users\Admin\AppData\Roaming\GEV_Validate\Chime.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PulseVa.exe

Path C:\Users\Admin\AppData\Local\PulseVa.exe
Size 2.6MB
SHA256 54ee56421a67088a76359c6fab0ff64a5d105666b8e226b0fe2b8759bfbdde10
MD5 74585993ad66f985febcc9bfe0cf699d
SHA1 bf6739a1d3ca31d3c84ff37b78ec26473881c66c
SHA512 5f8ee722948e08f69ca7c4080df8da1aa40c30a2a03834883a4f2dea0bb9092499007acf81cfed543cbf3dcd6ad935cb1df93bf80a6a100eb55494700ce365af
SSDEEP 49152:9/Qp+T+WQLh5tA5pD5mgQUQFqNNHUhhyHiz55Q/FT/pgMXm:9/Qp+TEN5o5QUm2Uqiz5qpM
MD5 SHA1 SHA512 SSDEEP

Submit Download

B938F01.tmp

Path C:\Users\Admin\AppData\Local\Temp\B938F01.tmp
Size 4.0MB
SHA256 d6d6a85e107e4767b1988f1059c5c0e339620c51fff7095e0f178706530785bb
MD5 2958eac14a8ff6cc6770e73be689b495
SHA1 82846f752484b6c841c9314924bbb78d75925d51
SHA512 7ff66003a875cf4c0e47d7de1a94758bd9c9ac8d5fbc52a02ff07d885dc847f7aad81687f4f53dbe7e761501693067506395d89c90082874ea969d2852461c85
SSDEEP 98304:DRRKCNLPyGjInmfX0iLAO6DErZYiYHeX5kVBb3u7/RKXF6qXCPmo1jTV:1FD1InmLAO6DGZYvPe6AFTV
MD5 SHA1 SHA512 SSDEEP

Submit Download

B938F01.tmp

Path C:\Users\Admin\AppData\Local\Temp\B938F01.tmp
Size 4.0MB
SHA256 16e70ceca652dc233584a8a8fdfb86659e1871bd15e234269da54cbe0f086a8c
MD5 f8a8462c3a6f810062339554489a0d86
SHA1 c49df1a67abf0fe41f8f7b3515ac86fac7cad09d
SHA512 5123f900972a6031f14a8600e73afa646a03a918ebf9d7ed6cff7a5b22f03cfdc3866fc7c309ecbe46096d44737f978096fbefae2a68d6bd0aee8ede2f743303
SSDEEP 98304:zREKCNLPyGjInmfX0iLAO6DErZYiYHeX5kVBb3u7/RKXF6qXCPmo1jTV:FmD1InmLAO6DGZYvPe6AFTV
MD5 SHA1 SHA512 SSDEEP

Submit Download

FBABA88.tmp

Path C:\Users\Admin\AppData\Local\Temp\FBABA88.tmp
Size 40B
SHA256 cd7c1222651ec0add788933d674bcc0aaecee6125083a00350389a37da4ed136
MD5 0d733c3bc8047ab7dd83fd9a4653fc75
SHA1 b1575e61dd87d40bb8cef81e5a8a87f1d1f05a75
SHA512 f0fab42c68f0c0f85a2133768f9b8573e6a9b875b68c519f72d9dc75de06dcb85e9f53ffd9868a0423a3203a35afe520e59b15b14c0c5942f5e9546635147880
MD5 SHA1 SHA512

Submit Download

Chime.exe

Path C:\Users\Admin\AppData\Roaming\GEV_Validate\Chime.exe
Size 619KB
SHA256 adb8347dfa1b1df1ca2211fe4d7e82f27ced939f1bf3d52548e52bc9e23fc52c
MD5 dd65b976d1865ba6c2368fcf9c9eb223
SHA1 db933b1ff0dc73c2e4f230aa3bd47646632d5714
SHA512 5ff91cc29744416a32789f277f2494bbe60bd1f2eb53ea48e538075e8d735420c0256b7798e8f99b9286bf8c3b0dcf5f1a1539b8f2792991fb7d5754ec6fa0df
SSDEEP 6144:+Zzvhs2Z4n1E7g34XtVYAOfTdH8zjQSYoLdnU4q:+J+2Z4nShVY5CjQxoLdnU4q
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3276-59-0x00007FFF87840000-0x00007FFF87A49000-memory.dmp

Download

memory/3832-29-0x0000000073110000-0x000000007328D000-memory.dmp

Download

memory/3832-26-0x0000000073125000-0x0000000073126000-memory.dmp

Download

memory/3832-11-0x00007FFF87840000-0x00007FFF87A49000-memory.dmp

Download

memory/3832-28-0x0000000073110000-0x000000007328D000-memory.dmp

Download

memory/3832-32-0x0000000073110000-0x000000007328D000-memory.dmp

Download

memory/3832-10-0x0000000073110000-0x000000007328D000-memory.dmp

Download

memory/3832-34-0x0000000073110000-0x000000007328D000-memory.dmp

Download

memory/3832-6-0x0000000003760000-0x00000000045C4000-memory.dmp

Download

memory/3832-0-0x00000000018D0000-0x00000000018FA000-memory.dmp

Download

memory/3832-8-0x00000000045D0000-0x00000000047DE000-memory.dmp

Download

memory/3832-4-0x0000000001920000-0x00000000019DE000-memory.dmp

Download

memory/3832-3-0x0000000001900000-0x0000000001920000-memory.dmp

Download

memory/4836-38-0x0000000000A00000-0x0000000000AA0000-memory.dmp

Download

memory/4836-45-0x00000000034A0000-0x00000000038A0000-memory.dmp

Download

memory/4836-47-0x00000000034A0000-0x00000000038A0000-memory.dmp

Download

memory/4836-46-0x00000000034A0000-0x00000000038A0000-memory.dmp

Download

memory/4836-48-0x00000000034A0000-0x00000000038A0000-memory.dmp

Download

memory/4836-50-0x00007FFF87841000-0x00007FFF8796A000-memory.dmp

Download

memory/4836-55-0x0000000076290000-0x00000000764E2000-memory.dmp

Download

memory/4836-43-0x0000000000A00000-0x0000000000AA0000-memory.dmp

Download

memory/4836-42-0x00007FFF87840000-0x00007FFF87A49000-memory.dmp

Download

memory/4836-58-0x0000000000A00000-0x0000000000AA0000-memory.dmp

Download

memory/4836-36-0x0000000000A00000-0x0000000000AA0000-memory.dmp

Download