rhadamanthys | 087a6dafebbe457fd2085fc08162a3298891986290e3dd9fef21eec45e0df40f

Analysis

max time kernel
91s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2024, 19:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Trojan.Siggen26.46407.16274.1705.exe
Size 1.1MB
Sample240302-x3scwsgh44
SHA256 087a6dafebbe457fd2085fc08162a3298891986290e3dd9fef21eec45e0df40f
MD5 df942c5f094583de066648fbc24615dd
SHA1 1be754f2e896dd9b76fb52e99e482605d8facec3
SHA512 745db26648baad07c3e71e40feab744e28ea2b9fb4b0b03236dfea33b9e20a05aaa5a54055ff584729ac8299542be17f44d1a47bce74e4235ddc6ff4d732697a
SSDEEP 24576:38v438LmiAUue/5uChxS0nK3rhi9jHXFk5n672zimUGq:38vvKiT9DS0K3rhkjHXW5n66zkh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 5032 created 3452	5032	Beings.pif	57
PID 5032 created 3020	5032	Beings.pif	51

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	SecuriteInfo.com.Trojan.Siggen26.46407.16274.1705.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PixelGuard.url	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PixelGuard.url	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
5032	Beings.pif

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2888	5032	WerFault.exe	101

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
4604	tasklist.exe
1504	tasklist.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1124	PING.EXE

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
5032	Beings.pif
5032	Beings.pif
5032	Beings.pif
5032	Beings.pif
5032	Beings.pif
5032	Beings.pif
5032	Beings.pif
5032	Beings.pif
5032	Beings.pif
5032	Beings.pif
5032	Beings.pif
5032	Beings.pif
5032	Beings.pif
5032	Beings.pif
5032	Beings.pif
5032	Beings.pif
5032	Beings.pif
5032	Beings.pif
5032	Beings.pif
5032	Beings.pif
4140	dialer.exe
4140	dialer.exe
4140	dialer.exe
4140	dialer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5032	Beings.pif

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4604	tasklist.exe
Token: SeDebugPrivilege	1504	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5032	Beings.pif
5032	Beings.pif
5032	Beings.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
5032	Beings.pif
5032	Beings.pif
5032	Beings.pif

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 2216	4580	SecuriteInfo.com.Trojan.Siggen26.46407.16274.1705.exe	91
PID 4580 wrote to memory of 2216	4580	SecuriteInfo.com.Trojan.Siggen26.46407.16274.1705.exe	91
PID 4580 wrote to memory of 2216	4580	SecuriteInfo.com.Trojan.Siggen26.46407.16274.1705.exe	91
PID 2216 wrote to memory of 4604	2216	cmd.exe	93
PID 2216 wrote to memory of 4604	2216	cmd.exe	93
PID 2216 wrote to memory of 4604	2216	cmd.exe	93
PID 2216 wrote to memory of 2104	2216	cmd.exe	94
PID 2216 wrote to memory of 2104	2216	cmd.exe	94
PID 2216 wrote to memory of 2104	2216	cmd.exe	94
PID 2216 wrote to memory of 1504	2216	cmd.exe	96
PID 2216 wrote to memory of 1504	2216	cmd.exe	96
PID 2216 wrote to memory of 1504	2216	cmd.exe	96
PID 2216 wrote to memory of 4128	2216	cmd.exe	97
PID 2216 wrote to memory of 4128	2216	cmd.exe	97
PID 2216 wrote to memory of 4128	2216	cmd.exe	97
PID 2216 wrote to memory of 3992	2216	cmd.exe	98
PID 2216 wrote to memory of 3992	2216	cmd.exe	98
PID 2216 wrote to memory of 3992	2216	cmd.exe	98
PID 2216 wrote to memory of 4208	2216	cmd.exe	99
PID 2216 wrote to memory of 4208	2216	cmd.exe	99
PID 2216 wrote to memory of 4208	2216	cmd.exe	99
PID 2216 wrote to memory of 3472	2216	cmd.exe	100
PID 2216 wrote to memory of 3472	2216	cmd.exe	100
PID 2216 wrote to memory of 3472	2216	cmd.exe	100
PID 2216 wrote to memory of 5032	2216	cmd.exe	101
PID 2216 wrote to memory of 5032	2216	cmd.exe	101
PID 2216 wrote to memory of 5032	2216	cmd.exe	101
PID 2216 wrote to memory of 1124	2216	cmd.exe	102
PID 2216 wrote to memory of 1124	2216	cmd.exe	102
PID 2216 wrote to memory of 1124	2216	cmd.exe	102
PID 5032 wrote to memory of 3888	5032	Beings.pif	104
PID 5032 wrote to memory of 3888	5032	Beings.pif	104
PID 5032 wrote to memory of 3888	5032	Beings.pif	104
PID 5032 wrote to memory of 4140	5032	Beings.pif	107
PID 5032 wrote to memory of 4140	5032	Beings.pif	107
PID 5032 wrote to memory of 4140	5032	Beings.pif	107
PID 5032 wrote to memory of 4140	5032	Beings.pif	107
PID 5032 wrote to memory of 4140	5032	Beings.pif	107

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:3020
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4140

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3452
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen26.46407.16274.1705.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen26.46407.16274.1705.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4580
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k move Development Development.bat & Development.bat & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2216
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4604
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
      4⤵
      PID:2104
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1504
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "wrsa.exe opssvc.exe"
      4⤵
      PID:4128
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c md 12649
      4⤵
      PID:3992
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b Tribes + Changelog + Boutique + Fisheries + Close 12649\Beings.pif
      4⤵
      PID:4208
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b Led 12649\A
      4⤵
      PID:3472
  - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\12649\Beings.pif
      12649\Beings.pif 12649\A
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:5032
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 1048
        5⤵
        Program crash
        
        PID:2888
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 5 127.0.0.1
      4⤵
      Runs ping.exe
      PID:1124
- C:\Windows\SysWOW64\cmd.exe
  cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PixelGuard.url" & echo URL="C:\Users\Admin\AppData\Local\PixelShield Innovations\PixelGuard.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PixelGuard.url" & exit
  2⤵
  - Drops startup file
  PID:3888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 5032 -ip 5032
1⤵
PID:3956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Beings.pif

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\12649\Beings.pif
Size 924KB
SHA256 f58d3a4b2f3f7f10815c24586fae91964eeed830369e7e0701b43895b0cefbd3
MD5 848164d084384c49937f99d5b894253e
SHA1 3055ef803eeec4f175ebf120f94125717ee12444
SHA512 aabe1cf076f48f32542f49a92e4ca9f054b31d5a9949119991b897b9489fe775d8009896408ba49ac43ec431c87c0d385daead9dbbde7ef6309b0c97bbaf852a
SSDEEP 24576:LOo8pEnK4mrqlEZuVZ2HOI+X0l1lMZyYFaeBmyF:LF8p4KpqlEZeXI+X0TVcae3F
MD5 SHA1 SHA512 SSDEEP

Submit Download

Boutique

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Boutique
Size 186KB
SHA256 5f75942b4e994b02f7002bfc6eeced01a33e2fb758272b30c028229160ce420b
MD5 784335c76fec1d530c897118e1d008d5
SHA1 398a684e82b8bd9edd7f13da8c69d579f4e18776
SHA512 cd990ae4498fc88987f01a1d35cd3b092789dc16e0465ef0c26ebc4a97f89f51469ab0f28d5b91a7bce5e777277e64838031e33f595f5b2e898b8cf595c4f2eb
SSDEEP 3072:onBfzHl8Dz5YaZYvlfA6Gfza6iyY5tVGvH7fsUQwHJJX4xF5jtHk5B+LNBPcAd:onZ2tZ6lfA6Gfm608DsvqJX4xNAB+b
MD5 SHA1 SHA512 SSDEEP

Submit Download

Changelog

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Changelog
Size 170KB
SHA256 7e23296d5813730857c977f763f89912c463de7c9755d51616da11d7471d8aa9
MD5 5e40a9ceb4cc8035452fd98a8db548d3
SHA1 63b751273e5ab22d0fa7bb843500c054e6605149
SHA512 c0b12a4b8f92318b7267369fb81df1575db901dca8315942547237ab46a2bf4e7dce0958f5cac66715d7441b17a25737399959d6c88db1f1166c6946df76bd96
SSDEEP 3072:K/33SrF7etHufKE5Kmqd1UhlqRWO/9EAehuqCkrwzW3Nzl8F5hPLaLWysRIO7vHy:m3mFygyE4mqd12lqlEAehuqN8zwNzlm+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Close
Size 178KB
SHA256 db576bf9cae0e2ec38f1efbcaad5e7941b3456bc7b9ab5d3570d281937ef007c
MD5 d8f9dd4003de34471d0797f274ebe7bc
SHA1 393aceab75a29520961e52cd0756e8971f02f72a
SHA512 bc34e3ee19055353eab85ef420a8ccbba81bc8ade7f745c7e7ca6fab6ebded5ffbce01bd2fec78bc8db661e89c62f021ff375d547670eb08050ac49e07ea657e
SSDEEP 3072:I6jKj+wsxjgarB3RZgDWy4ZNogXJ3i2Umb2Oq:I64EgarxUaBZ2myoG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Development

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Development
Size 12KB
SHA256 bb1c83e2816691f078e2a501e29127fbd38b5a181f36c7c2f8b04aa9a611820b
MD5 fda631a430d32823c0a4f56e816527ba
SHA1 324ebdc5099072f524e2b199bc3b04fe1795dfe3
SHA512 a9549f7c21dd29f63f9b794996ad07a6048efd4ed6513e5bd0776169c937bfaff8297a478fdf361ec92bb4ddc6b09ba00951988ffbae7ad5d9d76222225998ee
SSDEEP 384:RxHWqaxTUsxO4oiIUkVUq9Mlqhcjq7qbqSqrlqhchqaqCqbqSq7xq9quqW:RxHWDY4pIelIcjCSv6lIchp3SvMxAT1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fisheries

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Fisheries
Size 213KB
SHA256 a5697d08636213947bdbbc9054a2122644f0127115016fc78f7afa0c8c063311
MD5 2af4fa5dae895ba7dfee756e705dc3d7
SHA1 c6674ad14c55c8b3700d551d604666c5a54cecd2
SHA512 6f776c6bc51cfcf83f286a0a1631c0d748ade9e68ef83740813169ea5cd2953e8882488042f2cadf6beeb94b2ab5bcfc2a56dca5b89639d070378cec53f2b57d
SSDEEP 6144:lHFq9O0lHPOGUWLhxjRYmFqZvEAOz04pmdVs:j0lHPOGNnlMZce4wdVs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Led

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Led
Size 1.1MB
SHA256 23cef61e69337d876dc18fd8e8cd2510d067fdc95ae1a59966bc0ec5b919514b
MD5 baad6aee11f0fbca62386c59da5d8fc6
SHA1 fb0b2800bd62f8d096ad552f9595355e73d56868
SHA512 fba45936c8518a991716895af046b628106ae8253a8a288cfd8cbcd492c7df1d954afbea1381529cf43624c20a5795d03d706625584a1ccb103f4c3508a1fc94
SSDEEP 12288:tHoSb98XKnNRC3jBFsrzBReNL2lRkO+D08lVcXpaHf6YqBKuUH:pbqXkNRC3UBRetMkOZ8lVyaHAxUH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tribes

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Tribes
Size 177KB
SHA256 797b2e4ea542bcd31f0ea74f3d25f54439a3af110e7c0227bb0ce8a6c3c3f34e
MD5 561263612c09886dd59bb02aa6228138
SHA1 44d2faf84b411a7ffce27c96d346b4f0795f7cbc
SHA512 e8a40ea27d8d27c6f3408e9601db1ad59c002d0d6b458f2cf174349bec7c9a838e219621eece1fb29d713fe09ca87dc391c6a288490512bdf2a4733edd0ce0d1
SSDEEP 3072:pPpU08BjlWTPJth26X7Sn4UfpLUNN9t68cCWlrss4M5iRq3U0Pe3vHU4S1:LQBk7JjX74cN0lrztgwU0Wy1
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4140-58-0x00000000028D0000-0x0000000002CD0000-memory.dmp

Download

memory/4140-56-0x00000000772A0000-0x00000000774B5000-memory.dmp

Download

memory/4140-55-0x00000000028D0000-0x0000000002CD0000-memory.dmp

Download

memory/4140-53-0x00007FFA0D630000-0x00007FFA0D825000-memory.dmp

Download

memory/4140-52-0x00000000028D0000-0x0000000002CD0000-memory.dmp

Download

memory/4140-50-0x0000000000C80000-0x0000000000C89000-memory.dmp

Download

memory/5032-41-0x0000000008E00000-0x0000000008E6D000-memory.dmp

Download

memory/5032-47-0x0000000009E80000-0x000000000A280000-memory.dmp

Download

memory/5032-42-0x0000000008E00000-0x0000000008E6D000-memory.dmp

Download

memory/5032-43-0x0000000009E80000-0x000000000A280000-memory.dmp

Download

memory/5032-44-0x0000000009E80000-0x000000000A280000-memory.dmp

Download

memory/5032-45-0x0000000008E00000-0x0000000008E6D000-memory.dmp

Download

memory/5032-46-0x00007FFA0D630000-0x00007FFA0D825000-memory.dmp

Download

memory/5032-40-0x0000000008E00000-0x0000000008E6D000-memory.dmp

Download

memory/5032-49-0x00000000772A0000-0x00000000774B5000-memory.dmp

Download

memory/5032-39-0x0000000008E00000-0x0000000008E6D000-memory.dmp

Download

memory/5032-37-0x0000000008E00000-0x0000000008E6D000-memory.dmp

Download

memory/5032-36-0x0000000008E00000-0x0000000008E6D000-memory.dmp

Download

memory/5032-35-0x0000000008E00000-0x0000000008E6D000-memory.dmp

Download

memory/5032-34-0x0000000005210000-0x0000000005211000-memory.dmp

Download

memory/5032-57-0x0000000009E80000-0x000000000A280000-memory.dmp

Download

memory/5032-27-0x0000000077731000-0x0000000077851000-memory.dmp

Download