rhadamanthys | 5c8242a15f15acf2103be83a379c24b44bc5e5cd8adcb8fa9b93b4c3f5d576b0

Analysis

max time kernel
96s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25/02/2024, 15:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ch3tHUB.exe
Size

2.3MB
MD5

aaa141e36af7ec2ab10eb97fae862bbe
SHA1

312aa1c0761b561d6ce065d35a744a205804ae85
SHA256

5c8242a15f15acf2103be83a379c24b44bc5e5cd8adcb8fa9b93b4c3f5d576b0
SHA512

0fe0b1d8053bc62898259cb3a49e316757316e81202bcc9b3718b734a6079f2460a6d79463d2a05e89e06762e0aee8ee5b67a3bd42004f5489e434ac79acc575
SSDEEP

49152:x4vphxvoaq6x1yNx+mprM6eW/R9RDtSpTIdjIg0r:GhxJVx1y/+mprMARDtXjIg0r

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4012 created 2828	4012	AddInProcess32.exe	58

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5040 set thread context of 640	5040	ch3tHUB.exe	93
PID 5040 set thread context of 4012	5040	ch3tHUB.exe	98

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4980	4012	WerFault.exe	98
4708	4012	WerFault.exe	98

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5040	ch3tHUB.exe
5040	ch3tHUB.exe
640	AddInProcess32.exe
640	AddInProcess32.exe
4012	AddInProcess32.exe
4012	AddInProcess32.exe
3888	dialer.exe
3888	dialer.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5040	ch3tHUB.exe
Token: SeDebugPrivilege	640	AddInProcess32.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 640	5040	ch3tHUB.exe	93
PID 5040 wrote to memory of 640	5040	ch3tHUB.exe	93
PID 5040 wrote to memory of 640	5040	ch3tHUB.exe	93
PID 5040 wrote to memory of 640	5040	ch3tHUB.exe	93
PID 5040 wrote to memory of 640	5040	ch3tHUB.exe	93
PID 5040 wrote to memory of 640	5040	ch3tHUB.exe	93
PID 5040 wrote to memory of 640	5040	ch3tHUB.exe	93
PID 5040 wrote to memory of 640	5040	ch3tHUB.exe	93
PID 5040 wrote to memory of 4012	5040	ch3tHUB.exe	98
PID 5040 wrote to memory of 4012	5040	ch3tHUB.exe	98
PID 5040 wrote to memory of 4012	5040	ch3tHUB.exe	98
PID 5040 wrote to memory of 4012	5040	ch3tHUB.exe	98
PID 5040 wrote to memory of 4012	5040	ch3tHUB.exe	98
PID 5040 wrote to memory of 4012	5040	ch3tHUB.exe	98
PID 5040 wrote to memory of 4012	5040	ch3tHUB.exe	98
PID 5040 wrote to memory of 4012	5040	ch3tHUB.exe	98
PID 5040 wrote to memory of 4012	5040	ch3tHUB.exe	98
PID 5040 wrote to memory of 4012	5040	ch3tHUB.exe	98
PID 640 wrote to memory of 3560	640	AddInProcess32.exe	99
PID 640 wrote to memory of 3560	640	AddInProcess32.exe	99
PID 640 wrote to memory of 3560	640	AddInProcess32.exe	99
PID 640 wrote to memory of 3560	640	AddInProcess32.exe	99
PID 640 wrote to memory of 3560	640	AddInProcess32.exe	99
PID 640 wrote to memory of 3560	640	AddInProcess32.exe	99
PID 640 wrote to memory of 3560	640	AddInProcess32.exe	99
PID 640 wrote to memory of 3560	640	AddInProcess32.exe	99
PID 4012 wrote to memory of 3888	4012	AddInProcess32.exe	100
PID 4012 wrote to memory of 3888	4012	AddInProcess32.exe	100
PID 4012 wrote to memory of 3888	4012	AddInProcess32.exe	100
PID 4012 wrote to memory of 3888	4012	AddInProcess32.exe	100
PID 4012 wrote to memory of 3888	4012	AddInProcess32.exe	100

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2828
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3888

C:\Users\Admin\AppData\Local\Temp\ch3tHUB.exe
"C:\Users\Admin\AppData\Local\Temp\ch3tHUB.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:640
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
    3⤵
    PID:3560
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4012 -s 444
    3⤵
    - Program crash
    PID:4980
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4012 -s 440
    3⤵
    - Program crash
    PID:4708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4012 -ip 4012
1⤵
PID:4372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4012 -ip 4012
1⤵
PID:4704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/640-12-0x0000000000400000-0x00000000005EC000-memory.dmp

Filesize
1.9MB

Download
memory/640-20-0x00000000749C0000-0x0000000075170000-memory.dmp

Filesize
7.7MB

Download
memory/640-15-0x00000000749C0000-0x0000000075170000-memory.dmp

Filesize
7.7MB

Download
memory/640-14-0x0000000000400000-0x00000000005EC000-memory.dmp

Filesize
1.9MB

Download
memory/640-17-0x0000000005C90000-0x0000000005CD4000-memory.dmp

Filesize
272KB

Download
memory/640-16-0x0000000005470000-0x0000000005480000-memory.dmp

Filesize
64KB

Download
memory/640-18-0x0000000005470000-0x0000000005480000-memory.dmp

Filesize
64KB

Download
memory/640-21-0x0000000005470000-0x0000000005480000-memory.dmp

Filesize
64KB

Download
memory/640-22-0x0000000005470000-0x0000000005480000-memory.dmp

Filesize
64KB

Download
memory/3888-34-0x0000000000610000-0x0000000000619000-memory.dmp

Filesize
36KB

Download
memory/3888-37-0x0000000002270000-0x0000000002670000-memory.dmp

Filesize
4.0MB

Download
memory/3888-42-0x0000000002270000-0x0000000002670000-memory.dmp

Filesize
4.0MB

Download
memory/3888-36-0x0000000002270000-0x0000000002670000-memory.dmp

Filesize
4.0MB

Download
memory/3888-38-0x00007FFCE3470000-0x00007FFCE3665000-memory.dmp

Filesize
2.0MB

Download
memory/3888-39-0x0000000002270000-0x0000000002670000-memory.dmp

Filesize
4.0MB

Download
memory/3888-41-0x0000000076920000-0x0000000076B35000-memory.dmp

Filesize
2.1MB

Download
memory/4012-31-0x0000000003D70000-0x0000000004170000-memory.dmp

Filesize
4.0MB

Download
memory/4012-27-0x0000000003D70000-0x0000000004170000-memory.dmp

Filesize
4.0MB

Download
memory/4012-43-0x0000000003D70000-0x0000000004170000-memory.dmp

Filesize
4.0MB

Download
memory/4012-33-0x0000000076920000-0x0000000076B35000-memory.dmp

Filesize
2.1MB

Download
memory/4012-30-0x00007FFCE3470000-0x00007FFCE3665000-memory.dmp

Filesize
2.0MB

Download
memory/4012-29-0x0000000003D70000-0x0000000004170000-memory.dmp

Filesize
4.0MB

Download
memory/4012-28-0x0000000003D70000-0x0000000004170000-memory.dmp

Filesize
4.0MB

Download
memory/4012-23-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/4012-25-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/5040-8-0x00000000749C0000-0x0000000075170000-memory.dmp

Filesize
7.7MB

Download
memory/5040-7-0x00000000062F0000-0x0000000006334000-memory.dmp

Filesize
272KB

Download
memory/5040-13-0x0000000005720000-0x0000000005730000-memory.dmp

Filesize
64KB

Download
memory/5040-9-0x0000000005720000-0x0000000005730000-memory.dmp

Filesize
64KB

Download
memory/5040-10-0x0000000007310000-0x000000000732A000-memory.dmp

Filesize
104KB

Download
memory/5040-0-0x00000000749C0000-0x0000000075170000-memory.dmp

Filesize
7.7MB

Download
memory/5040-19-0x0000000005720000-0x0000000005730000-memory.dmp

Filesize
64KB

Download
memory/5040-26-0x00000000749C0000-0x0000000075170000-memory.dmp

Filesize
7.7MB

Download
memory/5040-6-0x00000000062A0000-0x00000000062AA000-memory.dmp

Filesize
40KB

Download
memory/5040-5-0x0000000005720000-0x0000000005730000-memory.dmp

Filesize
64KB

Download
memory/5040-4-0x0000000005520000-0x00000000055BC000-memory.dmp

Filesize
624KB

Download
memory/5040-3-0x00000000053E0000-0x0000000005472000-memory.dmp

Filesize
584KB

Download
memory/5040-2-0x00000000058F0000-0x0000000005E94000-memory.dmp

Filesize
5.6MB

Download
memory/5040-1-0x0000000000DF0000-0x000000000104C000-memory.dmp

Filesize
2.4MB

Download
memory/5040-11-0x0000000004E00000-0x0000000004E06000-memory.dmp

Filesize
24KB

Download