rhadamanthys | 2a47c2d84f330efa04265b34e7dc1fd149954c5f1110c6896414f313b7ce17a2

Analysis

max time kernel
103s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
15-03-2023 13:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a47c2d84f330efa04265b34e7dc1fd149954c5f1110c6896414f313b7ce17a2.exe
Size

371KB
MD5

bf824b7e427ecdd9e48e9585e5320585
SHA1

b06f93a8c18a5c74357787a7a4159606f1abf6f6
SHA256

2a47c2d84f330efa04265b34e7dc1fd149954c5f1110c6896414f313b7ce17a2
SHA512

daae842378c6bbe624423758201dcc6bf7e5466e61f47716345b4694329ace011c923175e5d253ae9858a801b6ea906ce95b33bbd06d6c6ad4e584940f1d678f
SSDEEP

6144:b5KLjqVWr6/gajtgBB3Q7XghWiT3DH0J:bg/qMoLRgBB3Q7hi

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Detect rhadamanthys stealer shellcode 4 IoCs

resource	yara_rule
behavioral1/memory/4284-138-0x0000000002DF0000-0x0000000002E0C000-memory.dmp	family_rhadamanthys
behavioral1/memory/4284-140-0x0000000002DF0000-0x0000000002E0C000-memory.dmp	family_rhadamanthys
behavioral1/memory/4284-142-0x0000000004B70000-0x0000000005B70000-memory.dmp	family_rhadamanthys
behavioral1/memory/4284-143-0x0000000002DF0000-0x0000000002E0C000-memory.dmp	family_rhadamanthys

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
4284	2a47c2d84f330efa04265b34e7dc1fd149954c5f1110c6896414f313b7ce17a2.exe
4284	2a47c2d84f330efa04265b34e7dc1fd149954c5f1110c6896414f313b7ce17a2.exe
4284	2a47c2d84f330efa04265b34e7dc1fd149954c5f1110c6896414f313b7ce17a2.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2560	4284	WerFault.exe	85

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2a47c2d84f330efa04265b34e7dc1fd149954c5f1110c6896414f313b7ce17a2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2a47c2d84f330efa04265b34e7dc1fd149954c5f1110c6896414f313b7ce17a2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	2a47c2d84f330efa04265b34e7dc1fd149954c5f1110c6896414f313b7ce17a2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	2a47c2d84f330efa04265b34e7dc1fd149954c5f1110c6896414f313b7ce17a2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2a47c2d84f330efa04265b34e7dc1fd149954c5f1110c6896414f313b7ce17a2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4284	2a47c2d84f330efa04265b34e7dc1fd149954c5f1110c6896414f313b7ce17a2.exe
Token: SeCreatePagefilePrivilege	4284	2a47c2d84f330efa04265b34e7dc1fd149954c5f1110c6896414f313b7ce17a2.exe

C:\Users\Admin\AppData\Local\Temp\2a47c2d84f330efa04265b34e7dc1fd149954c5f1110c6896414f313b7ce17a2.exe
"C:\Users\Admin\AppData\Local\Temp\2a47c2d84f330efa04265b34e7dc1fd149954c5f1110c6896414f313b7ce17a2.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4284
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4284 -s 672
  2⤵
  - Program crash
  PID:2560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4284 -ip 4284
1⤵
PID:3564

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4284-134-0x0000000002DC0000-0x0000000002DEE000-memory.dmp

Filesize
184KB

Download
memory/4284-135-0x0000000000400000-0x0000000002B21000-memory.dmp

Filesize
39.1MB

Download
memory/4284-138-0x0000000002DF0000-0x0000000002E0C000-memory.dmp

Filesize
112KB

Download
memory/4284-140-0x0000000002DF0000-0x0000000002E0C000-memory.dmp

Filesize
112KB

Download
memory/4284-141-0x0000000002E10000-0x0000000002E2A000-memory.dmp

Filesize
104KB

Download
memory/4284-142-0x0000000004B70000-0x0000000005B70000-memory.dmp

Filesize
16.0MB

Download
memory/4284-143-0x0000000002DF0000-0x0000000002E0C000-memory.dmp

Filesize
112KB

Download
memory/4284-144-0x0000000000400000-0x0000000002B21000-memory.dmp

Filesize
39.1MB

Download