rhadamanthys | 8b66a3ecbb30f4351758c45f1c11dfa8faa9804b2976e108e9557ba39bae3202

Analysis

max time kernel
138s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
submitted
17/02/2024, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 8.0MB
Sample240217-vs4xtshe32
SHA256 8b66a3ecbb30f4351758c45f1c11dfa8faa9804b2976e108e9557ba39bae3202
MD5 d8f4ab2a01c5d8ad7ffd4aec3cf93921
SHA1 3d85e9ba0f6972cc9aa6274da014bee2f63cd9aa
SHA512 0d21f31ce0cc46b2a4f623b4cfdd21bd8610484d0c1b2db39593357b6a792336f69858dc371f65a39eff08f23284411f4947efda65ba93448910c022555da6e1
SSDEEP 24576:etLWjQMC7jinocDJE2Hf1L5o350zlSqrKjSciG+ym:sL6PuN72/1Fo350z4aKWA5m
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rhadamanthys discovery stealer

Malware Config

Extracted

Family

rhadamanthys

https://5.35.34.193:5652/7754ab51414cb150c84e1ad/iron0qbw.c62kc

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Rhadamanthys family
rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 412 created 2476	412	Nfl.pif	38

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	file.exe

Executes dropped EXE 1 IoCs

pid	Process
412	Nfl.pif

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
2000	tasklist.exe
4952	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2456	412	WerFault.exe	94

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfl.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dialer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2980	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2980	PING.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
412	Nfl.pif
412	Nfl.pif
412	Nfl.pif
412	Nfl.pif
412	Nfl.pif
412	Nfl.pif
412	Nfl.pif
412	Nfl.pif
4984	dialer.exe
4984	dialer.exe
4984	dialer.exe
4984	dialer.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4952	tasklist.exe
Token: SeDebugPrivilege	2000	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
412	Nfl.pif
412	Nfl.pif
412	Nfl.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
412	Nfl.pif
412	Nfl.pif
412	Nfl.pif

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 1576	4852	file.exe	84
PID 4852 wrote to memory of 1576	4852	file.exe	84
PID 4852 wrote to memory of 1576	4852	file.exe	84
PID 1576 wrote to memory of 4952	1576	cmd.exe	86
PID 1576 wrote to memory of 4952	1576	cmd.exe	86
PID 1576 wrote to memory of 4952	1576	cmd.exe	86
PID 1576 wrote to memory of 4092	1576	cmd.exe	87
PID 1576 wrote to memory of 4092	1576	cmd.exe	87
PID 1576 wrote to memory of 4092	1576	cmd.exe	87
PID 1576 wrote to memory of 2000	1576	cmd.exe	89
PID 1576 wrote to memory of 2000	1576	cmd.exe	89
PID 1576 wrote to memory of 2000	1576	cmd.exe	89
PID 1576 wrote to memory of 692	1576	cmd.exe	90
PID 1576 wrote to memory of 692	1576	cmd.exe	90
PID 1576 wrote to memory of 692	1576	cmd.exe	90
PID 1576 wrote to memory of 3592	1576	cmd.exe	91
PID 1576 wrote to memory of 3592	1576	cmd.exe	91
PID 1576 wrote to memory of 3592	1576	cmd.exe	91
PID 1576 wrote to memory of 1808	1576	cmd.exe	92
PID 1576 wrote to memory of 1808	1576	cmd.exe	92
PID 1576 wrote to memory of 1808	1576	cmd.exe	92
PID 1576 wrote to memory of 4640	1576	cmd.exe	93
PID 1576 wrote to memory of 4640	1576	cmd.exe	93
PID 1576 wrote to memory of 4640	1576	cmd.exe	93
PID 1576 wrote to memory of 412	1576	cmd.exe	94
PID 1576 wrote to memory of 412	1576	cmd.exe	94
PID 1576 wrote to memory of 412	1576	cmd.exe	94
PID 1576 wrote to memory of 2980	1576	cmd.exe	95
PID 1576 wrote to memory of 2980	1576	cmd.exe	95
PID 1576 wrote to memory of 2980	1576	cmd.exe	95
PID 412 wrote to memory of 4984	412	Nfl.pif	103
PID 412 wrote to memory of 4984	412	Nfl.pif	103
PID 412 wrote to memory of 4984	412	Nfl.pif	103
PID 412 wrote to memory of 4984	412	Nfl.pif	103
PID 412 wrote to memory of 4984	412	Nfl.pif	103

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2476
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4984

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k move Wage Wage.bat & Wage.bat & exit
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1576
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4952
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4092
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2000
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "wrsa.exe opssvc.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:692
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 2685
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3592
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b Garmin + Cambridge + Rep + Dividend + Aluminium + Retailers 2685\Nfl.pif
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1808
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b Property + Atm + Heritage 2685\U
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4640
- - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2685\Nfl.pif
    2685\Nfl.pif 2685\U
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:412
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 412 -s 904
      4⤵
      Program crash
      PID:2456
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 5 localhost
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 412 -ip 412
1⤵
PID:4056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Nfl.pif

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2685\Nfl.pif
Size 924KB
SHA256 f58d3a4b2f3f7f10815c24586fae91964eeed830369e7e0701b43895b0cefbd3
MD5 848164d084384c49937f99d5b894253e
SHA1 3055ef803eeec4f175ebf120f94125717ee12444
SHA512 aabe1cf076f48f32542f49a92e4ca9f054b31d5a9949119991b897b9489fe775d8009896408ba49ac43ec431c87c0d385daead9dbbde7ef6309b0c97bbaf852a
SSDEEP 24576:LOo8pEnK4mrqlEZuVZ2HOI+X0l1lMZyYFaeBmyF:LF8p4KpqlEZeXI+X0TVcae3F
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2685\U
Size 1.0MB
SHA256 0f81fdc104f143bff1940aed3af561e912795c60a8566ce02f96558c8b82d834
MD5 f44fca97e38e6032a36a95bb272597fa
SHA1 6c9f34bb354a8f4c8079e5d8b9c28b24c0649a5e
SHA512 da33f2620c04671a9a033ba980606350d0c0a535558ec5f0363932718828bbc38c20349ece6dda8060af3406673132bac047b93daa445b0bcc369cf02c9f56b1
SSDEEP 12288:QMV37RiKhgiCAM/3ZCyOe5GjeORNkTCCatWA/2l8yXwy1e:N37RiKhgiR2IHuGSOo2LtWAullnc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aluminium

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Aluminium
Size 185KB
SHA256 f3f516899ea50c38d2a9c39269235939ab236dab195011827eacad7100803846
MD5 86625b61ee1fd186262960950f238b2b
SHA1 7376ab279d88362de814a8bfb9db6153674cbb72
SHA512 d24d602bc802a3ec0343b78b0dd46a5f8f1f9e1b2126c65f14e83461dfcc2e571bdd87a7c7eeb973c6b590c312ea21aaf9a3e15245a40386982518abc7548fd4
SSDEEP 3072:CH/fA9vtqmcCVs5A3q5eAg0Fuz08XvBNbIaAtbP:CmFqZvEAOz04pmdV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Atm

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Atm
Size 423KB
SHA256 ebfaece6f446922e6cd5a2b9334d9408e15ed5c9b8b144766305beb26c407f1a
MD5 7bd66857d800c921facb22b79a10eca8
SHA1 016d84b699e8d13cffbbdea21907f8e65414c38f
SHA512 9905f6227d78bf21ff4ee1bd4dd561af04810bec8b7c4733a67243aac8f5fd0e0479e5162fcd78c4da7a7337ba552217327c555b0462d32e73d005100c2e7175
SSDEEP 6144:TH0a3fe8U/0jaORNkT6RC7mtWA/0cUpl8a7E:TjeORNkTCCatWA/2l8J
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cambridge

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Cambridge
Size 102KB
SHA256 7f7bb966cf3016df10e0d8dd87aea889bffa2495b425306c70f8168a920c9146
MD5 37076843bf986d557bbfedb012ca832f
SHA1 23999c25315158e9989b97640ed375f68abccaad
SHA512 e2e36faa3026de1ae74a8a8a41ff086138efa74acae356921f14d49715cf3ae88b515e68760599ddea65ebcef006b72febc869ee6e34189d401ce0cc174803d9
SSDEEP 3072:Tqd1UhlqRWO/9EAehuqCkrwzW3Nzl8F5hPLI:Tqd12lqlEAehuqN8zwNzlmhPLI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dividend

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dividend
Size 118KB
SHA256 b7125231f644becb21de5d5be69124ec80ca919c3feed8e5bcd979a8cad5e004
MD5 55ff24316e66ede43116de79615bd400
SHA1 52bb4ce3db4f3810539fe7917463d5e75cd7d0e4
SHA512 198b46b132a15c7e6c334b0b1ba1823bb2c90b4d935ff06cf3278ce6f1b7d9bf40bde92cb8760c4aa25e2db5d9e5f1a350ca22e671a9bcaf33227f05be110814
SSDEEP 3072:O5jtHk5B+LNBPcAvPTjFq9iOIXyTw0ltj0EowPOGU6WS2uLhxjRp:8AB+xHFq9O0lHPOGUWLhxjRp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Garmin

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Garmin
Size 212KB
SHA256 3fa0c2b12a850df672918b4bc6f155863dc9131b7796b8cdd7e040908c5cea5b
MD5 43f6cfbf4f61433476deee3cffe894c1
SHA1 c3286fcf2b0ed5ead88881c9d6acc33fcd4cb487
SHA512 22f4ae399aa04c8818e90fced07b29081778d33f75f26832f4e9a13456f0f183a4c7d9b917a07c662f9906079b18c48e442632b1e81ba1ff76c74b08824b9eef
SSDEEP 6144:LQBk7JjX74cN0lrztgwU0Wyw3mFygyE4e:LO0z8e0lvSr0Wyw20K4e
MD5 SHA1 SHA512 SSDEEP

Submit Download

Heritage

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Heritage
Size 157KB
SHA256 93bcbf9e2b59feee8be47fdb24e8639705582e88d844bc75967725b3ffce9bcb
MD5 a19906bea61a96abbb4027972296b4f1
SHA1 260011f21cf63f2f86bb4e4a19bad515ff8b3efb
SHA512 3362cf5d0ab83fdb09c42fb89a52f0677528c9dbc435b9a6488792b8cc63392448011be74d40403275916079b59091f4aeaf54d2d892e058cd3864e9adad3d9a
SSDEEP 3072:aXR54p63HKk/zLil6onR2HVulTTpJfyXhG:onXKk/yJ01sAk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Property

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Property
Size 446KB
SHA256 8d92c424f4661f32f16189a5af5f79a0b3d4cdf8a13b6ab6c2c95678b6ddfd7b
MD5 264b1f9759379beda484a3d9b24d0804
SHA1 50ec201a1f48c6761b2ec678b4a909f0e035a234
SHA512 f7f41f39768a6a2eb43a75c556bb52411559e667050d13feb5127f3a20d3b2faefe1788364ef4de05c6d019817f8bfd244898ae3378096875c4d7fcfa4b5a89a
SSDEEP 6144:3A1mFpNopNbQp5V37RiKhgiCird9vwfz/L86fZCho/m9MVja:QMV37RiKhgiCAM/3ZCyOe5a
MD5 SHA1 SHA512 SSDEEP

Submit Download

Rep

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Rep
Size 168KB
SHA256 a317f3bd09eaeed2e9ce0b3ad061a9d446ea6e095a0c7a7f2977f3dec19afb44
MD5 8a39d056e00470f74578aa7bfd0f4909
SHA1 714552c9862e9259d5bd830eeed103f64a2bd614
SHA512 e8ce0c27f000902e4e5526500136dc8845cf3cba4c6c69a6ef298f00820b3ca108cfe5eb167081f2fccdbc6a9079a347e58845c51c485aa2e7c25fcb08bfe788
SSDEEP 3072:tLWysRIO7vHZnBfzHl8Dz5YaZYvlfA6Gfza6iyY5tVGvH7fsUQwHJJX4xY:Ab5nZ2tZ6lfA6Gfm608DsvqJX4xY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Retailers

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Retailers
Size 139KB
SHA256 afa04bc5e7565dc55796122c222b1bf313a9eaccee9950c47a7e3b0fe1e3e81a
MD5 6b960ef62185ed62f077876eadcc43ba
SHA1 43145a1cad268eb3a9e83976220c1fef520c9178
SHA512 99f644df6343d6c875f772c3131191bb9dbb43e7a4c8d8541cd6bafaea7e4bda1c92ce598b3795779f426b055f87631331489620b6bdf454c4820a374d7a7069
SSDEEP 3072:b6jKj+wsxjgarB3RZgDWy4ZNogXJ3i2Umb2Oq:b64EgarxUaBZ2myoG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Wage

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Wage
Size 10KB
SHA256 ce007d59fc7f5ef4b9693eb8bbe3c5ddfe414eb5adb1f03db554fd7e2116229a
MD5 2a33f900d862a3b60176bf3441ebc98b
SHA1 0a1e3a8ea0c929f828067e57f48586f5849989cf
SHA512 d2737fdd15ca1c1cbe2f13c91de81c3f0dc18144978d9f7bb81acc379d5baf8f0ecf9662fe970a35da9b9808418a3476818535abd07e922d329ab8f00543f039
SSDEEP 192:hfpsDmrV/O3/v0P0nnVtD4+StAtblPjowdAtn4ifLTX6OZy:ImdOayVWAPcK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/412-40-0x0000000000130000-0x00000000001B8000-memory.dmp

Download

memory/412-49-0x0000000005C00000-0x0000000006000000-memory.dmp

Download

memory/412-38-0x0000000000130000-0x00000000001B8000-memory.dmp

Download

memory/412-39-0x0000000000130000-0x00000000001B8000-memory.dmp

Download

memory/412-35-0x0000000077A11000-0x0000000077B31000-memory.dmp

Download

memory/412-42-0x0000000000130000-0x00000000001B8000-memory.dmp

Download

memory/412-43-0x0000000000130000-0x00000000001B8000-memory.dmp

Download

memory/412-44-0x0000000000130000-0x00000000001B8000-memory.dmp

Download

memory/412-45-0x0000000000130000-0x00000000001B8000-memory.dmp

Download

memory/412-46-0x0000000005C00000-0x0000000006000000-memory.dmp

Download

memory/412-47-0x0000000000130000-0x00000000001B8000-memory.dmp

Download

memory/412-37-0x00000000025E0000-0x00000000025E1000-memory.dmp

Download

memory/412-50-0x00007FFB87C10000-0x00007FFB87E05000-memory.dmp

Download

memory/412-51-0x0000000005C00000-0x0000000006000000-memory.dmp

Download

memory/412-53-0x0000000077480000-0x0000000077695000-memory.dmp

Download

memory/412-63-0x0000000005C00000-0x0000000006000000-memory.dmp

Download

memory/4984-56-0x0000000002830000-0x0000000002C30000-memory.dmp

Download

memory/4984-57-0x0000000002830000-0x0000000002C30000-memory.dmp

Download

memory/4984-58-0x00007FFB87C10000-0x00007FFB87E05000-memory.dmp

Download

memory/4984-60-0x0000000002830000-0x0000000002C30000-memory.dmp

Download

memory/4984-61-0x0000000077480000-0x0000000077695000-memory.dmp

Download

memory/4984-62-0x0000000002830000-0x0000000002C30000-memory.dmp

Download

memory/4984-54-0x0000000000A50000-0x0000000000A59000-memory.dmp

Download