rhadamanthys | 6d4114742eb27a4e99c398904607bbfb07f91c2f2d25c921d888c0879f22d646

Analysis

max time kernel
92s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25/02/2024, 10:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ca70689089743ce8155264da577210df.exe
Size 1.1MB
Sample240225-l7cmfsaa7v
SHA256 6d4114742eb27a4e99c398904607bbfb07f91c2f2d25c921d888c0879f22d646
MD5 ca70689089743ce8155264da577210df
SHA1 e24d68e375625ab0eb59845272ed71088bc1de6f
SHA512 633528df5b92d985f5425a43ccb439b610d417aed26a4e547e00171e9a78472f7f015a0376db07e23d0cb5bcc07a32856ad8129a17658b4d2afa51f537604329
SSDEEP 24576:Cus8z4PUzQUbrnbqcnomja9g3hG3DzkvRMOApY3hw2mw:lsOZzFbqi/a9gmD4vR+Y3hwn
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 956 created 3424	956	Wallpapers.pif	31
PID 956 created 3060	956	Wallpapers.pif	60

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1392040655-2056082574-619088944-1000\Control Panel\International\Geo\Nation	ca70689089743ce8155264da577210df.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
956	Wallpapers.pif

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
528	956	WerFault.exe	100

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
1020	tasklist.exe
624	tasklist.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2096	PING.EXE

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
956	Wallpapers.pif
956	Wallpapers.pif
956	Wallpapers.pif
956	Wallpapers.pif
956	Wallpapers.pif
956	Wallpapers.pif
956	Wallpapers.pif
956	Wallpapers.pif
956	Wallpapers.pif
956	Wallpapers.pif
956	Wallpapers.pif
956	Wallpapers.pif
956	Wallpapers.pif
956	Wallpapers.pif
956	Wallpapers.pif
956	Wallpapers.pif
956	Wallpapers.pif
956	Wallpapers.pif
956	Wallpapers.pif
956	Wallpapers.pif
3660	dialer.exe
3660	dialer.exe
3660	dialer.exe
3660	dialer.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1020	tasklist.exe
Token: SeDebugPrivilege	624	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
956	Wallpapers.pif
956	Wallpapers.pif
956	Wallpapers.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
956	Wallpapers.pif
956	Wallpapers.pif
956	Wallpapers.pif

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 3648 wrote to memory of 4796	3648	ca70689089743ce8155264da577210df.exe	90
PID 3648 wrote to memory of 4796	3648	ca70689089743ce8155264da577210df.exe	90
PID 3648 wrote to memory of 4796	3648	ca70689089743ce8155264da577210df.exe	90
PID 4796 wrote to memory of 1020	4796	cmd.exe	92
PID 4796 wrote to memory of 1020	4796	cmd.exe	92
PID 4796 wrote to memory of 1020	4796	cmd.exe	92
PID 4796 wrote to memory of 2392	4796	cmd.exe	93
PID 4796 wrote to memory of 2392	4796	cmd.exe	93
PID 4796 wrote to memory of 2392	4796	cmd.exe	93
PID 4796 wrote to memory of 624	4796	cmd.exe	95
PID 4796 wrote to memory of 624	4796	cmd.exe	95
PID 4796 wrote to memory of 624	4796	cmd.exe	95
PID 4796 wrote to memory of 3152	4796	cmd.exe	96
PID 4796 wrote to memory of 3152	4796	cmd.exe	96
PID 4796 wrote to memory of 3152	4796	cmd.exe	96
PID 4796 wrote to memory of 3668	4796	cmd.exe	97
PID 4796 wrote to memory of 3668	4796	cmd.exe	97
PID 4796 wrote to memory of 3668	4796	cmd.exe	97
PID 4796 wrote to memory of 4072	4796	cmd.exe	98
PID 4796 wrote to memory of 4072	4796	cmd.exe	98
PID 4796 wrote to memory of 4072	4796	cmd.exe	98
PID 4796 wrote to memory of 2344	4796	cmd.exe	99
PID 4796 wrote to memory of 2344	4796	cmd.exe	99
PID 4796 wrote to memory of 2344	4796	cmd.exe	99
PID 4796 wrote to memory of 956	4796	cmd.exe	100
PID 4796 wrote to memory of 956	4796	cmd.exe	100
PID 4796 wrote to memory of 956	4796	cmd.exe	100
PID 4796 wrote to memory of 2096	4796	cmd.exe	101
PID 4796 wrote to memory of 2096	4796	cmd.exe	101
PID 4796 wrote to memory of 2096	4796	cmd.exe	101
PID 956 wrote to memory of 2120	956	Wallpapers.pif	102
PID 956 wrote to memory of 2120	956	Wallpapers.pif	102
PID 956 wrote to memory of 2120	956	Wallpapers.pif	102
PID 956 wrote to memory of 3660	956	Wallpapers.pif	106
PID 956 wrote to memory of 3660	956	Wallpapers.pif	106
PID 956 wrote to memory of 3660	956	Wallpapers.pif	106
PID 956 wrote to memory of 3660	956	Wallpapers.pif	106
PID 956 wrote to memory of 3660	956	Wallpapers.pif	106

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3424
- C:\Users\Admin\AppData\Local\Temp\ca70689089743ce8155264da577210df.exe
  "C:\Users\Admin\AppData\Local\Temp\ca70689089743ce8155264da577210df.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3648
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k move Bathrooms Bathrooms.bat & Bathrooms.bat & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4796
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1020
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
      4⤵
      PID:2392
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:624
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "wrsa.exe opssvc.exe"
      4⤵
      PID:3152
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c md 13664
      4⤵
      PID:3668
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b Compound + Injection + Emotions + Worm + Participants + Richmond 13664\Wallpapers.pif
      4⤵
      PID:4072
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b Funeral + Charles + Refurbished 13664\Q
      4⤵
      PID:2344
  - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\13664\Wallpapers.pif
      13664\Wallpapers.pif 13664\Q
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:956
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 956 -s 1064
        5⤵
        Program crash
        
        PID:528
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 5 localhost
      4⤵
      Runs ping.exe
      PID:2096
- C:\Windows\SysWOW64\cmd.exe
  cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url" & echo URL="C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url" & exit
  2⤵
  - Drops startup file
  PID:2120

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:3060
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 956 -ip 956
1⤵
PID:4544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\13664\Q
Size 1.2MB
SHA256 e95b53f210703826123d744032e96175a9b93debf189e919005f103b36901854
MD5 2113d1c4104ccc6b6f91e03d2ccef91d
SHA1 b84b3f422c498385df60ee3d781454edf074a30c
SHA512 1bdb801006c23040782d821866dada17c49ddd2c1035ce8d21f8972d25aa897267c33134e366bd0e97423d19519416729313d212287bf4a74331c8022da831ba
SSDEEP 12288:N7DWQYWQy5Wuah7HXICbICxVIlC2LpDnwiDXdlrrIMBG63/Ez4jONI79Yq4vldp2:Ndlw+81iyvoOHe8E+Znng
MD5 SHA1 SHA512 SSDEEP

Submit Download

Wallpapers.pif

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\13664\Wallpapers.pif
Size 924KB
SHA256 f58d3a4b2f3f7f10815c24586fae91964eeed830369e7e0701b43895b0cefbd3
MD5 848164d084384c49937f99d5b894253e
SHA1 3055ef803eeec4f175ebf120f94125717ee12444
SHA512 aabe1cf076f48f32542f49a92e4ca9f054b31d5a9949119991b897b9489fe775d8009896408ba49ac43ec431c87c0d385daead9dbbde7ef6309b0c97bbaf852a
SSDEEP 24576:LOo8pEnK4mrqlEZuVZ2HOI+X0l1lMZyYFaeBmyF:LF8p4KpqlEZeXI+X0TVcae3F
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bathrooms

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Bathrooms
Size 12KB
SHA256 eeb0c78b88cde6fc918779ee30367fd8bc2ad4340a8694da0f134a0c0092ff9a
MD5 c8c5950385aceef6d0b9863e4b3c9dc0
SHA1 3743375bba4d90f66b18ee07894453a7791b7279
SHA512 956414b5c1ec81f98bb1a293e27b1b9b0444e18d6dee7ab7b3278cdeec909851ec604d4cc39c04a7146e7ad12181c0329966c573d76399863d73485f0864320b
SSDEEP 192:CZOgsTZzssa/9myO9wmquT4V1PkCYWY+mqnI4IESr:CIbzklvxjBBYWdBSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Charles

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Charles
Size 439KB
SHA256 aa69b17859ab5857a0ea2e6dee130874db2c20e533b2f20237f192460eb84e58
MD5 16f7582c10b97f96a3ba16f39947817c
SHA1 fd4a13db0ae2bec10df368cd52acc41eb08eb5e6
SHA512 1896b5f2f1041d1b33d0ce2aab362e142500c5b62f49f03355ed432ffb6f2e0eaef369045404e48a29ed059009f9e5143e6a9baf97453693385cd231b7125ebe
SSDEEP 6144:9igMZN+nuPQtJcdKyXITvMIF91tKHqhds055yJmydpq:sz4jONI79Yq4vldpq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Compound

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Compound
Size 285KB
SHA256 01911bd9e9c36f67e5eb5dcce15e5e2879a7aa29bb386e971ac56bf8efbf4fa8
MD5 d3ff67bd9050dffd6bc274486ab282b1
SHA1 c47ed301597976e6f3889a1575b9659cb79f8100
SHA512 99f3c026c95e1a56c2464d3ae34332e2d0b0406faf89096d2740155d425da8774380b9b8afa05d697fb55ade4958cf68887dc04612ae8f6523cee02fb02d7ba5
SSDEEP 6144:LQBk7JjX74cN0lrztgwU0Wyw3mFygyE4mqd12lqlEAehuqq:LO0z8e0lvSr0Wyw20K4mqClqlEZuD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Emotions

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Emotions
Size 143KB
SHA256 4cd8004089e4d0bb65bf14dd0ed0f4c0bd3bdea6eea952118594a27ebe148918
MD5 7a966829e539deb572cd9264cc2a65e8
SHA1 71fbdab7fc12a4cbad44334b6844c8df30034520
SHA512 66af2598e3a1bc42e3175760f12082a76f2c687cf5e556a81cd7887909305f6a1959bf9ad5e8e96a390cf6e44a22759be173edcf3d0cb5f35110b1e1842843b0
SSDEEP 3072:2fsUQwHJJX4xF5jtHk5B+LNBPcAvPTjFq9iOIXyTw0ltj0EowPOGU6WS2uLhY:6svqJX4xNAB+xHFq9O0lHPOGUWLhY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Funeral

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Funeral
Size 406KB
SHA256 eccdc1ecae8590c7de8419553678a57a8720b1f821dd8ea1e9fd3c4110970ed8
MD5 e9bfa28d7c639fbd6c182f55b863389d
SHA1 c16d3251bf95d0d335ff64b069e575dd5b2a8f70
SHA512 22d4af77c0618a38b7b681caddda4b43216266d0a713e959aa9c5be6c95a8290b50e138233f2c7059970f44042752050ca5f0f7b49ed05debb6abccc5d645c7c
SSDEEP 12288:N7DWQYWQy5Wuah7HXICbICxVIlC2LpDnwiDXdlrrIMBG63/v:Ndlw+3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Injection

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Injection
Size 163KB
SHA256 a4c95db9f38634e8e5b21912c6009880c57a10acee028ed8edda5f709d892f21
MD5 265cc28f39376f199446961b3e1b5071
SHA1 275aa9a3ce5ca041731fb40a81dc7d871876c6b8
SHA512 17f712ea6da2887adfbd222963884fa731c6be60f8736e2cafd1661aa928478d5caee1ad5ee071f9b04ec1614b18c46b2f6c7f685fa769a12d03ceff7700dc99
SSDEEP 3072:mrwzW3Nzl8F5hPLaLWysRIO7vHZnBfzHl8Dz5YaZYvlfA6Gfza6iyY5tVGvHs:m8zwNzlmhPL1b5nZ2tZ6lfA6Gfm608U
MD5 SHA1 SHA512 SSDEEP

Submit Download

Participants

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Participants
Size 146KB
SHA256 dbc21f2c5279741420a8db8d324faf83a1a8a7e7ec770968af57c6d999aa0b46
MD5 a197f36b0aa2b60310064c245619e984
SHA1 3fb2b0b238f1a8435bd01a5a48ffc1d8d2fc4181
SHA512 553f9755f87e2ae88789d4d41598f523c435d361a8997a08233a6b1b0589619f368463e453afe6a5bffa117842902a3a2a6cc558b3f6a03e48080c0377530c21
SSDEEP 1536:CMaj6iTcohiPfKj+wsxjgarB3RZg3EYrDWyu0uZo2:i6jKj+wsxjgarB3RZgDWy4ZN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Refurbished

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Refurbished
Size 344KB
SHA256 9423bfb3d3ca01a873b5be2c290ccb74960e0343cffb8e8bcd26ac94ddd39b39
MD5 28253745ea1850650362755480cc17bd
SHA1 966f4c9070171813acd2dad99dd09036d863fd52
SHA512 7deafc51968081379dbb2353253910567a2cff56b4dd9da00da8998a474b2c77f3ee391eb0539cd35ee055db0df3b2d766a2911ab6ba930d827ec9ab27ac1062
SSDEEP 6144:7HnOftOJ2+MFz48B3Op+E2UoZvPES6ZkBg:rnO15+98tO9oZvPng
MD5 SHA1 SHA512 SSDEEP

Submit Download

Richmond

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Richmond
Size 43KB
SHA256 04f1b50a94b2a6b267bab78b56eeecc9095faf904a05c669fb52803c585e5879
MD5 f68425c29a0fed4c53d24ef92d90c646
SHA1 d385b10313b79f49b4725db51235d2012a867b00
SHA512 b66d613823fddc9eaa31dc3781548bbcf2acd68d03d7043d9515fd631c34331d7f4339ea18e6d571d629168bc7521832474971f3497f4024b8c3b564927d63c7
SSDEEP 768:I9BkxXNHMi0O0GmpefKSlgaJyc3rE2UWb/hMjFQTVat3VEV3GPkjI:I9BkxXiblenlJJyIE2UWb/hoQZ2OE3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Worm

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Worm
Size 144KB
SHA256 40831cd41a3276fdbc62551076a518f326952f0bcec5c91391baf30b9fe2c2ab
MD5 0db014a8101d3e23a83b472adec1d75a
SHA1 70752385cb37d2f4bdfbd0d14397e2e391bef1b4
SHA512 5e52fffb6eeb8ab78100fc0863448b2051b4e8001f07a7bb4ff8b410cf7b2c6981b27da871dabc0163beda838912a87f77a18a0260d2ba88cda6250892ba92bd
SSDEEP 3072:+jRYH/fA9vtqmcCVs5A3q5eAg0Fuz08XvBNbIaAtbP6:+jRYmFqZvEAOz04pmdVS
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/956-45-0x0000000008200000-0x0000000008288000-memory.dmp

Download

memory/956-55-0x00007FF88F950000-0x00007FF88FB45000-memory.dmp

Download

memory/956-43-0x0000000008200000-0x0000000008288000-memory.dmp

Download

memory/956-44-0x0000000008200000-0x0000000008288000-memory.dmp

Download

memory/956-35-0x0000000077B51000-0x0000000077C71000-memory.dmp

Download

memory/956-47-0x0000000008200000-0x0000000008288000-memory.dmp

Download

memory/956-48-0x0000000008200000-0x0000000008288000-memory.dmp

Download

memory/956-49-0x0000000008200000-0x0000000008288000-memory.dmp

Download

memory/956-50-0x0000000008200000-0x0000000008288000-memory.dmp

Download

memory/956-51-0x0000000004240000-0x0000000004640000-memory.dmp

Download

memory/956-53-0x0000000008200000-0x0000000008288000-memory.dmp

Download

memory/956-42-0x0000000004220000-0x0000000004221000-memory.dmp

Download

memory/956-52-0x0000000004240000-0x0000000004640000-memory.dmp

Download

memory/956-54-0x0000000004240000-0x0000000004640000-memory.dmp

Download

memory/956-56-0x0000000004240000-0x0000000004640000-memory.dmp

Download

memory/956-58-0x00000000765F0000-0x0000000076805000-memory.dmp

Download

memory/3660-59-0x0000000000B20000-0x0000000000B29000-memory.dmp

Download

memory/3660-62-0x0000000002960000-0x0000000002D60000-memory.dmp

Download

memory/3660-63-0x00007FF88F950000-0x00007FF88FB45000-memory.dmp

Download

memory/3660-65-0x0000000002960000-0x0000000002D60000-memory.dmp

Download

memory/3660-66-0x00000000765F0000-0x0000000076805000-memory.dmp

Download

memory/3660-67-0x0000000002960000-0x0000000002D60000-memory.dmp

Download