rhadamanthys | d5c4f26dc62481afd19c0f66a0955270eb5a1aaec1d49da9aff2e0038656370c

General

Target

setup.exe
Size

337KB
MD5

549b4969e6c19a9da8cc01cc569ebda1
SHA1

ce157b8936f936f4b4475c104636a941ac5b80b1
SHA256

d5c4f26dc62481afd19c0f66a0955270eb5a1aaec1d49da9aff2e0038656370c
SHA512

433851f5d4b84d9c1f1dca2c8d824b8a21c2242344fbaf16e0d124cc854c3499279f8c0ba5e78ee418a0b9c9f929db09e8633ea13fbc5c41c13e810e52eae89a
SSDEEP

6144:H8Crle4ePCnBZFALyInuUI1VZmdaXR/fYhppCAr:H8CrlePCnzFAvndvaB/3

Score

10^/10

rhadamanthys collection stealer

Malware Config

Extracted

Family

rhadamanthys

C2

http://179.43.142.201/img/favicon.png

Signatures

Detect rhadamanthys stealer shellcode 4 IoCs

resource	yara_rule
behavioral1/memory/1728-59-0x0000000000350000-0x000000000036C000-memory.dmp	family_rhadamanthys
behavioral1/memory/1728-61-0x0000000000350000-0x000000000036C000-memory.dmp	family_rhadamanthys
behavioral1/memory/1728-62-0x0000000000350000-0x000000000036C000-memory.dmp	family_rhadamanthys
behavioral1/memory/1728-69-0x0000000000350000-0x000000000036C000-memory.dmp	family_rhadamanthys

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	dllhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	dllhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook	dllhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook	dllhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook	dllhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	dllhost.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dllhost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	dllhost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1728	setup.exe
1728	setup.exe
536	dllhost.exe
536	dllhost.exe
536	dllhost.exe
536	dllhost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 536	1728	setup.exe	28
PID 1728 wrote to memory of 536	1728	setup.exe	28
PID 1728 wrote to memory of 536	1728	setup.exe	28
PID 1728 wrote to memory of 536	1728	setup.exe	28
PID 1728 wrote to memory of 536	1728	setup.exe	28
PID 1728 wrote to memory of 536	1728	setup.exe	28

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	dllhost.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	dllhost.exe

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\system32\dllhost.exe
  "C:\Windows\system32\dllhost.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - outlook_office_path
  - outlook_win_path
  PID:536

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/536-66-0x000007FFFFEB0000-0x000007FFFFFAA000-memory.dmp

Filesize
1000KB

Download
memory/536-73-0x000007FFFFEB0000-0x000007FFFFFAA000-memory.dmp

Filesize
1000KB

Download
memory/536-72-0x000007FFFFEB0000-0x000007FFFFFAA000-memory.dmp

Filesize
1000KB

Download
memory/536-71-0x000007FFFFEB0000-0x000007FFFFFAA000-memory.dmp

Filesize
1000KB

Download
memory/536-70-0x000007FFFFEB0000-0x000007FFFFFAA000-memory.dmp

Filesize
1000KB

Download
memory/536-67-0x000007FFFFEB0000-0x000007FFFFFAA000-memory.dmp

Filesize
1000KB

Download
memory/536-63-0x0000000000050000-0x0000000000051000-memory.dmp

Filesize
4KB

Download
memory/536-64-0x00000000001E0000-0x00000000001E7000-memory.dmp

Filesize
28KB

Download
memory/536-65-0x000007FFFFEB0000-0x000007FFFFFAA000-memory.dmp

Filesize
1000KB

Download
memory/1728-61-0x0000000000350000-0x000000000036C000-memory.dmp

Filesize
112KB

Download
memory/1728-62-0x0000000000350000-0x000000000036C000-memory.dmp

Filesize
112KB

Download
memory/1728-68-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/1728-69-0x0000000000350000-0x000000000036C000-memory.dmp

Filesize
112KB

Download
memory/1728-55-0x0000000001D10000-0x0000000001D3E000-memory.dmp

Filesize
184KB

Download
memory/1728-59-0x0000000000350000-0x000000000036C000-memory.dmp

Filesize
112KB

Download
memory/1728-60-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/1728-56-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download

Analysis

Sharing