rhadamanthys | f2eaeba4b3b7016304f9c348f973bf57a80dce2969f3a814250a0a506df4a5eb

Analysis

max time kernel
139s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
22/01/2023, 17:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dcf231abac2aa68b03b99c9b1bf7da5b.exe
Size 806KB
Sample230122-vsj8esgf62
SHA256 f2eaeba4b3b7016304f9c348f973bf57a80dce2969f3a814250a0a506df4a5eb
MD5 dcf231abac2aa68b03b99c9b1bf7da5b
SHA1 402182f1ae34880a21b25bf94116d42f80791e44
SHA512 842e79c3bdb6ca75ef3c1c4fa2d2b80f5cac5fe29bdb61f630a5cc83fccf3858e51b2f102e09e2ddf159fff340f330ab2ea95c9b5dea4e1f7ffe4f72b0545dfc
SSDEEP 24576:AWHMA9r11VUzYSE0LdFqjrJCIWe4ANipwOo1SLh:PXrP1b0nsrJ0Ki4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Detect rhadamanthys stealer shellcode 1 IoCs

resource	yara_rule
behavioral2/memory/1652-141-0x00000000008B0000-0x00000000008CD000-memory.dmp	family_rhadamanthys

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1980 set thread context of 1652	1980	dcf231abac2aa68b03b99c9b1bf7da5b.exe	82

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	AppLaunch.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1652	AppLaunch.exe
Token: SeCreatePagefilePrivilege	1652	AppLaunch.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 1652	1980	dcf231abac2aa68b03b99c9b1bf7da5b.exe	82
PID 1980 wrote to memory of 1652	1980	dcf231abac2aa68b03b99c9b1bf7da5b.exe	82
PID 1980 wrote to memory of 1652	1980	dcf231abac2aa68b03b99c9b1bf7da5b.exe	82
PID 1980 wrote to memory of 1652	1980	dcf231abac2aa68b03b99c9b1bf7da5b.exe	82
PID 1980 wrote to memory of 1652	1980	dcf231abac2aa68b03b99c9b1bf7da5b.exe	82

C:\Users\Admin\AppData\Local\Temp\dcf231abac2aa68b03b99c9b1bf7da5b.exe
"C:\Users\Admin\AppData\Local\Temp\dcf231abac2aa68b03b99c9b1bf7da5b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious use of AdjustPrivilegeToken
  PID:1652

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1652-133-0x0000000000500000-0x0000000000534000-memory.dmp

Download

memory/1652-139-0x0000000000500000-0x0000000000534000-memory.dmp

Download

memory/1652-141-0x00000000008B0000-0x00000000008CD000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads