Rhadamanthys Stealer Module Launch Via Rundll32.EXE

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: TropChaud
Source: github.com/SigmaHQ/sigma

Detects the use of Rundll32 to launch an NSIS module that serves as the main stealer capability of Rhadamanthys infostealer, as observed in reports and samples in early 2023

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1218.011` System Binary Proxy Execution: Rundll32

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Rhadamanthys Stealer Module Launch Via Rundll32.EXE
id: 5cdbc2e8-86dd-43df-9a1a-200d4745fba5
status: test
description: Detects the use of Rundll32 to launch an NSIS module that serves as the main stealer capability of Rhadamanthys infostealer, as observed in reports and samples in early 2023
references:
    - https://elis531989.medium.com/dancing-with-shellcodes-analyzing-rhadamanthys-stealer-3c4986966a88
    - https://blog.cyble.com/2023/01/12/rhadamanthys-new-stealer-spreading-through-google-ads/
    - https://www.joesandbox.com/analysis/790122/0/html
    - https://twitter.com/anfam17/status/1607477672057208835
author: TropChaud
date: 2023-01-26
modified: 2023-02-05
tags:
    - attack.stealth
    - attack.t1218.011
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection_rundll32:
        - OriginalFileName: 'RUNDLL32.EXE'
        - Image|endswith: '\rundll32.exe'
    selection_dll:
        CommandLine|contains: 'nsis_uns'
    selection_export_function:
        CommandLine|contains: 'PrintUIEntry'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_rundll32`

selection_rundll32:
    - OriginalFileName: 'RUNDLL32.EXE'
    - Image|endswith: '\rundll32.exe'

Stage 2: `selection_dll`

selection_dll:
    CommandLine|contains: 'nsis_uns'

Stage 3: `selection_export_function`

selection_export_function:
    CommandLine|contains: 'PrintUIEntry'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`PrintUIEntry` `nsis_uns`	`field:"CommandLine" kind:match`
`Image`	ends_with	`\rundll32.exe` corpus 94 (sigma 94)	`field:"Image" kind:ends_with value:"\rundll32.exe"`
`OriginalFileName`	eq	`RUNDLL32.EXE` corpus 78 (sigma 35, elastic 22, splunk 21)	`field:"OriginalFileName" kind:eq value:"RUNDLL32.EXE"`