Rhadamanthys Stealer Module Launch Via Rundll32.EXE

Description

Detects the use of Rundll32 to launch an NSIS module that serves as the main stealer capability of Rhadamanthys infostealer, as observed in reports and samples in early 2023

Query · sigma

selection_rundll32:
- OriginalFileName: RUNDLL32.EXE
- Image|endswith: \rundll32.exe
selection_dll:
  CommandLine|contains: nsis_uns
selection_export_function:
  CommandLine|contains: PrintUIEntry
condition: all of selection_*

Known false positives

  • Unknown
Raw source Rhadamanthys Stealer Module Launch Via Rundll32.EXE · Sigma
Esc
Published by SigmaHQ/sigma ↗, licensed under Detection Rule License 1.1 ↗. Reproduced here unmodified. 
title: Rhadamanthys Stealer Module Launch Via Rundll32.EXE
id: 5cdbc2e8-86dd-43df-9a1a-200d4745fba5
status: test
description: Detects the use of Rundll32 to launch an NSIS module that serves as the main stealer capability of Rhadamanthys infostealer, as observed in reports and samples in early 2023
references:
    - https://elis531989.medium.com/dancing-with-shellcodes-analyzing-rhadamanthys-stealer-3c4986966a88
    - https://blog.cyble.com/2023/01/12/rhadamanthys-new-stealer-spreading-through-google-ads/
    - https://www.joesandbox.com/analysis/790122/0/html
    - https://twitter.com/anfam17/status/1607477672057208835
author: TropChaud
date: 2023-01-26
modified: 2023-02-05
tags:
    - attack.stealth
    - attack.t1218.011
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection_rundll32:
        - OriginalFileName: 'RUNDLL32.EXE'
        - Image|endswith: '\rundll32.exe'
    selection_dll:
        CommandLine|contains: 'nsis_uns'
    selection_export_function:
        CommandLine|contains: 'PrintUIEntry'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.