rhadamanthys | 12d3dc8a4fd8a2ebe6a839cce59920156d55e8d06fe2a5c95ad60419086877bb

General

Target

12d3dc8a4fd8a2ebe6a839cce59920156d55e8d06fe2a5c95ad60419086877bb.exe
Size

30KB
MD5

2cdffb841cfd9e2e729de2f02c47f8d1
SHA1

8d4e116bd2cfc57bfbe5f05308020e65f93d592d
SHA256

12d3dc8a4fd8a2ebe6a839cce59920156d55e8d06fe2a5c95ad60419086877bb
SHA512

8d344d0afba0eca49b4541b75c3e39dde3b75c9503bdddaf435b834699010852a0ada54fa2381c64bb31211dd9cf12eec0394c1f30700521ae849e29a4e7b90f
SSDEEP

768:QVKaUWVgbStx+y4+LK2rTMk6vAZ2HtIWVpw5/:QEaP6QxNxTMSYted

Score

10^/10

rhadamanthys smokeloader kev backdoor collection stealer trojan

Malware Config

Extracted

Family

smokeloader

Botnet

kev

Extracted

Family

smokeloader

Version

2022

C2

http://atillapro.com/

https://atillapro.com/

rc4.i32

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

976D.exe

description pid process target process

PID 2872 created 2208 2872 976D.exe sihost.exe
Deletes itself 1 IoCs

Processes:

pid process

3472
Executes dropped EXE 1 IoCs

Processes:

976D.exe

pid process

2872 976D.exe

description	pid	process	target process
PID 2872 created 2208	2872	976D.exe	sihost.exe

pid	process
3472

pid	process
2872	976D.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

12d3dc8a4fd8a2ebe6a839cce59920156d55e8d06fe2a5c95ad60419086877bb.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	12d3dc8a4fd8a2ebe6a839cce59920156d55e8d06fe2a5c95ad60419086877bb.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	12d3dc8a4fd8a2ebe6a839cce59920156d55e8d06fe2a5c95ad60419086877bb.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	12d3dc8a4fd8a2ebe6a839cce59920156d55e8d06fe2a5c95ad60419086877bb.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

12d3dc8a4fd8a2ebe6a839cce59920156d55e8d06fe2a5c95ad60419086877bb.exe

pid	process
2452	12d3dc8a4fd8a2ebe6a839cce59920156d55e8d06fe2a5c95ad60419086877bb.exe
2452	12d3dc8a4fd8a2ebe6a839cce59920156d55e8d06fe2a5c95ad60419086877bb.exe
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472

Suspicious behavior: MapViewOfSection 19 IoCs

Processes:

12d3dc8a4fd8a2ebe6a839cce59920156d55e8d06fe2a5c95ad60419086877bb.exe

pid	process
2452	12d3dc8a4fd8a2ebe6a839cce59920156d55e8d06fe2a5c95ad60419086877bb.exe
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472
3472

Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid process

3472

pid	process
3472

Suspicious use of WriteProcessMemory 41 IoCs

Processes:

976D.exe

description	pid	process	target process
PID 3472 wrote to memory of 2872	3472		976D.exe
PID 3472 wrote to memory of 2872	3472		976D.exe
PID 3472 wrote to memory of 2872	3472		976D.exe
PID 3472 wrote to memory of 3628	3472		explorer.exe
PID 3472 wrote to memory of 3628	3472		explorer.exe
PID 3472 wrote to memory of 3628	3472		explorer.exe
PID 3472 wrote to memory of 3628	3472		explorer.exe
PID 3472 wrote to memory of 3784	3472		explorer.exe
PID 3472 wrote to memory of 3784	3472		explorer.exe
PID 3472 wrote to memory of 3784	3472		explorer.exe
PID 3472 wrote to memory of 1444	3472		explorer.exe
PID 3472 wrote to memory of 1444	3472		explorer.exe
PID 3472 wrote to memory of 1444	3472		explorer.exe
PID 3472 wrote to memory of 1444	3472		explorer.exe
PID 2872 wrote to memory of 4028	2872	976D.exe	dialer.exe
PID 2872 wrote to memory of 4028	2872	976D.exe	dialer.exe
PID 2872 wrote to memory of 4028	2872	976D.exe	dialer.exe
PID 2872 wrote to memory of 4028	2872	976D.exe	dialer.exe
PID 2872 wrote to memory of 4028	2872	976D.exe	dialer.exe
PID 3472 wrote to memory of 4596	3472		explorer.exe
PID 3472 wrote to memory of 4596	3472		explorer.exe
PID 3472 wrote to memory of 4596	3472		explorer.exe
PID 3472 wrote to memory of 4596	3472		explorer.exe
PID 3472 wrote to memory of 4884	3472		explorer.exe
PID 3472 wrote to memory of 4884	3472		explorer.exe
PID 3472 wrote to memory of 4884	3472		explorer.exe
PID 3472 wrote to memory of 2296	3472		explorer.exe
PID 3472 wrote to memory of 2296	3472		explorer.exe
PID 3472 wrote to memory of 2296	3472		explorer.exe
PID 3472 wrote to memory of 2296	3472		explorer.exe
PID 3472 wrote to memory of 400	3472		explorer.exe
PID 3472 wrote to memory of 400	3472		explorer.exe
PID 3472 wrote to memory of 400	3472		explorer.exe
PID 3472 wrote to memory of 400	3472		explorer.exe
PID 3472 wrote to memory of 5076	3472		explorer.exe
PID 3472 wrote to memory of 5076	3472		explorer.exe
PID 3472 wrote to memory of 5076	3472		explorer.exe
PID 3472 wrote to memory of 4252	3472		explorer.exe
PID 3472 wrote to memory of 4252	3472		explorer.exe
PID 3472 wrote to memory of 4252	3472		explorer.exe
PID 3472 wrote to memory of 4252	3472		explorer.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

outlook_win_path 1 IoCs

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2208

C:\Windows\SysWOW64\dialer.exe
"C:\Windows\system32\dialer.exe"
2⤵
PID:4028

C:\Users\Admin\AppData\Local\Temp\12d3dc8a4fd8a2ebe6a839cce59920156d55e8d06fe2a5c95ad60419086877bb.exe
"C:\Users\Admin\AppData\Local\Temp\12d3dc8a4fd8a2ebe6a839cce59920156d55e8d06fe2a5c95ad60419086877bb.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2452

C:\Users\Admin\AppData\Local\Temp\976D.exe
C:\Users\Admin\AppData\Local\Temp\976D.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:3628

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3784

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1444

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4596

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4884

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2296

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:400

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:5076

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4252

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\976D.exe
Filesize
479KB

MD5
08e5f1243ad4970745975b27b6e2f9fa

SHA1
83b1a8939bd4e2ea5677d8742edd1a697edd196b

SHA256
05074675b07feb8e7556c5af449f5e677e0fabfb09b135971afbb11743bf3165

SHA512
d01f83c4c35e6049544d71037b3d8db29cf177e232839c684e2943899e7e891d0e30d996ddb0af58f760ac34dd8fc6acee7338b52b3fda5f17c892f7498d2280

Download Submit
memory/400-77-0x0000000000590000-0x000000000059B000-memory.dmp

Filesize
44KB

Download
memory/400-76-0x0000000000660000-0x0000000000687000-memory.dmp

Filesize
156KB

Download
memory/400-75-0x0000000000590000-0x000000000059B000-memory.dmp

Filesize
44KB

Download
memory/1444-54-0x0000000000430000-0x000000000043B000-memory.dmp

Filesize
44KB

Download
memory/1444-53-0x00000000032D0000-0x00000000036D0000-memory.dmp

Filesize
4.0MB

Download
memory/1444-49-0x0000000000430000-0x000000000043B000-memory.dmp

Filesize
44KB

Download
memory/2296-73-0x0000000000DA0000-0x0000000000DAF000-memory.dmp

Filesize
60KB

Download
memory/2296-71-0x0000000000660000-0x0000000000687000-memory.dmp

Filesize
156KB

Download
memory/2296-70-0x0000000000660000-0x0000000000687000-memory.dmp

Filesize
156KB

Download
memory/2452-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2452-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2872-45-0x00000000032D0000-0x00000000036D0000-memory.dmp

Filesize
4.0MB

Download
memory/2872-15-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2872-48-0x00007FFA19190000-0x00007FFA19385000-memory.dmp

Filesize
2.0MB

Download
memory/2872-47-0x00000000032D0000-0x00000000036D0000-memory.dmp

Filesize
4.0MB

Download
memory/2872-50-0x00000000032D0000-0x00000000036D0000-memory.dmp

Filesize
4.0MB

Download
memory/2872-56-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2872-52-0x0000000075780000-0x0000000075995000-memory.dmp

Filesize
2.1MB

Download
memory/3472-1-0x0000000007C30000-0x0000000007C46000-memory.dmp

Filesize
88KB

Download
memory/3628-44-0x0000000001070000-0x00000000010DB000-memory.dmp

Filesize
428KB

Download
memory/3628-17-0x0000000001070000-0x00000000010DB000-memory.dmp

Filesize
428KB

Download
memory/3628-18-0x00000000010E0000-0x0000000001155000-memory.dmp

Filesize
468KB

Download
memory/3628-19-0x0000000001070000-0x00000000010DB000-memory.dmp

Filesize
428KB

Download
memory/3784-41-0x0000000000F90000-0x0000000000F9C000-memory.dmp

Filesize
48KB

Download
memory/3784-43-0x0000000000F90000-0x0000000000F9C000-memory.dmp

Filesize
48KB

Download
memory/3784-42-0x0000000001070000-0x00000000010DB000-memory.dmp

Filesize
428KB

Download
memory/4028-61-0x00000000023B0000-0x00000000027B0000-memory.dmp

Filesize
4.0MB

Download
memory/4028-55-0x00000000006C0000-0x00000000006C9000-memory.dmp

Filesize
36KB

Download
memory/4028-58-0x00000000023B0000-0x00000000027B0000-memory.dmp

Filesize
4.0MB

Download
memory/4028-67-0x00000000023B0000-0x00000000027B0000-memory.dmp

Filesize
4.0MB

Download
memory/4028-59-0x00000000023B0000-0x00000000027B0000-memory.dmp

Filesize
4.0MB

Download
memory/4028-60-0x00007FFA19190000-0x00007FFA19385000-memory.dmp

Filesize
2.0MB

Download
memory/4028-63-0x0000000075780000-0x0000000075995000-memory.dmp

Filesize
2.1MB

Download
memory/4252-82-0x0000000000FD0000-0x0000000000FDD000-memory.dmp

Filesize
52KB

Download
memory/4252-81-0x0000000001080000-0x000000000108B000-memory.dmp

Filesize
44KB

Download
memory/4252-83-0x0000000001080000-0x000000000108B000-memory.dmp

Filesize
44KB

Download
memory/4596-66-0x0000000001170000-0x000000000117B000-memory.dmp

Filesize
44KB

Download
memory/4596-64-0x0000000001170000-0x000000000117B000-memory.dmp

Filesize
44KB

Download
memory/4596-65-0x0000000001180000-0x0000000001187000-memory.dmp

Filesize
28KB

Download
memory/4596-84-0x0000000001180000-0x0000000001187000-memory.dmp

Filesize
28KB

Download
memory/4884-68-0x0000000000DA0000-0x0000000000DAF000-memory.dmp

Filesize
60KB

Download
memory/4884-69-0x0000000000DA0000-0x0000000000DAF000-memory.dmp

Filesize
60KB

Download
memory/4884-85-0x0000000001170000-0x000000000117B000-memory.dmp

Filesize
44KB

Download
memory/5076-79-0x0000000000FE0000-0x0000000000FE7000-memory.dmp

Filesize
28KB

Download
memory/5076-80-0x0000000000FD0000-0x0000000000FDD000-memory.dmp

Filesize
52KB

Download
memory/5076-78-0x0000000000FD0000-0x0000000000FDD000-memory.dmp

Filesize
52KB

Download
memory/5076-90-0x0000000000FE0000-0x0000000000FE7000-memory.dmp

Filesize
28KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads