rhadamanthys | 0d28ccd84643ad4262c437bb93be0c5e3992014569395749c5bb45c6ac5f14fd

General

Target

0d28ccd84643ad4262c437bb93be0c5e3992014569395749c5bb45c6ac5f14fd.exe
Size

2.9MB
MD5

3236f27e8efbc95db91ac93970ff60e1
SHA1

afcf28c6f1100c7f6c2da313a320a05c92282746
SHA256

0d28ccd84643ad4262c437bb93be0c5e3992014569395749c5bb45c6ac5f14fd
SHA512

55154ba9b5409a45cf9385caeb703df4198cf0de4442023203776d326ac1feb8199b2cbb2eaf09cdd22641204bf188ce183a1c25c59e76f0ba09cbec952cb4f5
SSDEEP

49152:LkagEh1VUeYVbcmpzf4Ej3TYLhHyYE74:LPgEhC

Score

10^/10

Malware Config

Signatures

Detect rhadamanthys stealer shellcode 4 IoCs

resource	yara_rule
behavioral1/memory/4392-172-0x0000000000A30000-0x0000000000A4C000-memory.dmp	family_rhadamanthys
behavioral1/memory/4392-173-0x0000000000A30000-0x0000000000A4C000-memory.dmp	family_rhadamanthys
behavioral1/memory/4392-176-0x0000000002700000-0x0000000003700000-memory.dmp	family_rhadamanthys
behavioral1/memory/4392-177-0x0000000000A30000-0x0000000000A4C000-memory.dmp	family_rhadamanthys

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	0d28ccd84643ad4262c437bb93be0c5e3992014569395749c5bb45c6ac5f14fd.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
4392	RegAsm.exe
4392	RegAsm.exe
4392	RegAsm.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1912 set thread context of 4392	1912	0d28ccd84643ad4262c437bb93be0c5e3992014569395749c5bb45c6ac5f14fd.exe	97

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	RegAsm.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	RegAsm.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3508	powershell.exe
3508	powershell.exe
1912	0d28ccd84643ad4262c437bb93be0c5e3992014569395749c5bb45c6ac5f14fd.exe
1912	0d28ccd84643ad4262c437bb93be0c5e3992014569395749c5bb45c6ac5f14fd.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3508	powershell.exe
Token: SeDebugPrivilege	1912	0d28ccd84643ad4262c437bb93be0c5e3992014569395749c5bb45c6ac5f14fd.exe
Token: SeShutdownPrivilege	4392	RegAsm.exe
Token: SeCreatePagefilePrivilege	4392	RegAsm.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 3508	1912	0d28ccd84643ad4262c437bb93be0c5e3992014569395749c5bb45c6ac5f14fd.exe	88
PID 1912 wrote to memory of 3508	1912	0d28ccd84643ad4262c437bb93be0c5e3992014569395749c5bb45c6ac5f14fd.exe	88
PID 1912 wrote to memory of 3508	1912	0d28ccd84643ad4262c437bb93be0c5e3992014569395749c5bb45c6ac5f14fd.exe	88
PID 1912 wrote to memory of 3704	1912	0d28ccd84643ad4262c437bb93be0c5e3992014569395749c5bb45c6ac5f14fd.exe	96
PID 1912 wrote to memory of 3704	1912	0d28ccd84643ad4262c437bb93be0c5e3992014569395749c5bb45c6ac5f14fd.exe	96
PID 1912 wrote to memory of 3704	1912	0d28ccd84643ad4262c437bb93be0c5e3992014569395749c5bb45c6ac5f14fd.exe	96
PID 1912 wrote to memory of 4392	1912	0d28ccd84643ad4262c437bb93be0c5e3992014569395749c5bb45c6ac5f14fd.exe	97
PID 1912 wrote to memory of 4392	1912	0d28ccd84643ad4262c437bb93be0c5e3992014569395749c5bb45c6ac5f14fd.exe	97
PID 1912 wrote to memory of 4392	1912	0d28ccd84643ad4262c437bb93be0c5e3992014569395749c5bb45c6ac5f14fd.exe	97
PID 1912 wrote to memory of 4392	1912	0d28ccd84643ad4262c437bb93be0c5e3992014569395749c5bb45c6ac5f14fd.exe	97
PID 1912 wrote to memory of 4392	1912	0d28ccd84643ad4262c437bb93be0c5e3992014569395749c5bb45c6ac5f14fd.exe	97
PID 1912 wrote to memory of 4392	1912	0d28ccd84643ad4262c437bb93be0c5e3992014569395749c5bb45c6ac5f14fd.exe	97
PID 1912 wrote to memory of 4392	1912	0d28ccd84643ad4262c437bb93be0c5e3992014569395749c5bb45c6ac5f14fd.exe	97
PID 1912 wrote to memory of 4392	1912	0d28ccd84643ad4262c437bb93be0c5e3992014569395749c5bb45c6ac5f14fd.exe	97
PID 1912 wrote to memory of 4392	1912	0d28ccd84643ad4262c437bb93be0c5e3992014569395749c5bb45c6ac5f14fd.exe	97

C:\Users\Admin\AppData\Local\Temp\0d28ccd84643ad4262c437bb93be0c5e3992014569395749c5bb45c6ac5f14fd.exe
"C:\Users\Admin\AppData\Local\Temp\0d28ccd84643ad4262c437bb93be0c5e3992014569395749c5bb45c6ac5f14fd.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3508
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  2⤵
  PID:3704
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Checks SCSI registry key(s)
  - Suspicious use of AdjustPrivilegeToken
  PID:4392

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_e5rnn2qx.w3b.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1912-155-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

Filesize
64KB

Download
memory/1912-134-0x00000000052C0000-0x00000000052E2000-memory.dmp

Filesize
136KB

Download
memory/1912-163-0x00000000068F0000-0x0000000006E94000-memory.dmp

Filesize
5.6MB

Download
memory/1912-162-0x0000000005760000-0x00000000057F2000-memory.dmp

Filesize
584KB

Download
memory/1912-135-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

Filesize
64KB

Download
memory/1912-133-0x00000000002B0000-0x0000000000596000-memory.dmp

Filesize
2.9MB

Download
memory/3508-158-0x0000000004920000-0x0000000004930000-memory.dmp

Filesize
64KB

Download
memory/3508-137-0x0000000004F60000-0x0000000005588000-memory.dmp

Filesize
6.2MB

Download
memory/3508-150-0x0000000004920000-0x0000000004930000-memory.dmp

Filesize
64KB

Download
memory/3508-151-0x0000000004920000-0x0000000004930000-memory.dmp

Filesize
64KB

Download
memory/3508-152-0x0000000004920000-0x0000000004930000-memory.dmp

Filesize
64KB

Download
memory/3508-153-0x00000000074E0000-0x0000000007B5A000-memory.dmp

Filesize
6.5MB

Download
memory/3508-154-0x00000000061B0000-0x00000000061CA000-memory.dmp

Filesize
104KB

Download
memory/3508-139-0x0000000005690000-0x00000000056F6000-memory.dmp

Filesize
408KB

Download
memory/3508-138-0x0000000004E00000-0x0000000004E66000-memory.dmp

Filesize
408KB

Download
memory/3508-156-0x0000000004920000-0x0000000004930000-memory.dmp

Filesize
64KB

Download
memory/3508-157-0x0000000004920000-0x0000000004930000-memory.dmp

Filesize
64KB

Download
memory/3508-149-0x0000000005CB0000-0x0000000005CCE000-memory.dmp

Filesize
120KB

Download
memory/3508-136-0x00000000026C0000-0x00000000026F6000-memory.dmp

Filesize
216KB

Download
memory/4392-164-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4392-169-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4392-167-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4392-166-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4392-170-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4392-172-0x0000000000A30000-0x0000000000A4C000-memory.dmp

Filesize
112KB

Download
memory/4392-173-0x0000000000A30000-0x0000000000A4C000-memory.dmp

Filesize
112KB

Download
memory/4392-175-0x0000000000BD0000-0x0000000000BEA000-memory.dmp

Filesize
104KB

Download
memory/4392-176-0x0000000002700000-0x0000000003700000-memory.dmp

Filesize
16.0MB

Download
memory/4392-177-0x0000000000A30000-0x0000000000A4C000-memory.dmp

Filesize
112KB

Download
memory/4392-178-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads