rhadamanthys | 154100466cd20b3768c323d8f6ea67bcc3c2a14b529b132fda3b52c08bc9a3d9

Analysis

max time kernel
30s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
19/03/2023, 17:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

23a34d5cd145e663015d364f485b8ee77aca233982ec4f7023f617b4ecf1cb03.exe
Size

359KB
MD5

2665574e54a70ab457d570ed4c2605a2
SHA1

28efd8059b52bcf198c1ca2cbe9539a332b6c88f
SHA256

23a34d5cd145e663015d364f485b8ee77aca233982ec4f7023f617b4ecf1cb03
SHA512

c0c6877a34cab6118646ae4a2556fe55678bf80c0f36fa441cdbffaf96b7d3a2ac5a8f878fa2bf3bb034ff4ff8bb19513c1922910528b8459cc90c4c9e9f99d6
SSDEEP

6144:lpJ7Lo3bC9wVRuaWi7uS/ywC0P1zw/J3Z0vwkHu8dtd9u:nJ7Gb+wVRuoyE63Z0vw0tnu

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Detect rhadamanthys stealer shellcode 3 IoCs

resource	yara_rule
behavioral1/memory/1372-59-0x0000000000270000-0x000000000028C000-memory.dmp	family_rhadamanthys
behavioral1/memory/1372-61-0x0000000000270000-0x000000000028C000-memory.dmp	family_rhadamanthys
behavioral1/memory/1372-63-0x0000000000270000-0x000000000028C000-memory.dmp	family_rhadamanthys

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
1372	23a34d5cd145e663015d364f485b8ee77aca233982ec4f7023f617b4ecf1cb03.exe
1372	23a34d5cd145e663015d364f485b8ee77aca233982ec4f7023f617b4ecf1cb03.exe
1372	23a34d5cd145e663015d364f485b8ee77aca233982ec4f7023f617b4ecf1cb03.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	23a34d5cd145e663015d364f485b8ee77aca233982ec4f7023f617b4ecf1cb03.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	23a34d5cd145e663015d364f485b8ee77aca233982ec4f7023f617b4ecf1cb03.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	23a34d5cd145e663015d364f485b8ee77aca233982ec4f7023f617b4ecf1cb03.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1372	23a34d5cd145e663015d364f485b8ee77aca233982ec4f7023f617b4ecf1cb03.exe

C:\Users\Admin\AppData\Local\Temp\23a34d5cd145e663015d364f485b8ee77aca233982ec4f7023f617b4ecf1cb03.exe
"C:\Users\Admin\AppData\Local\Temp\23a34d5cd145e663015d364f485b8ee77aca233982ec4f7023f617b4ecf1cb03.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1372

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1372-55-0x00000000001B0000-0x00000000001DE000-memory.dmp

Filesize
184KB

Download
memory/1372-56-0x0000000000400000-0x0000000002B0A000-memory.dmp

Filesize
39.0MB

Download
memory/1372-59-0x0000000000270000-0x000000000028C000-memory.dmp

Filesize
112KB

Download
memory/1372-60-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/1372-61-0x0000000000270000-0x000000000028C000-memory.dmp

Filesize
112KB

Download
memory/1372-63-0x0000000000270000-0x000000000028C000-memory.dmp

Filesize
112KB

Download
memory/1372-64-0x0000000000400000-0x0000000002B0A000-memory.dmp

Filesize
39.0MB

Download