rhadamanthys | 12d3dc8a4fd8a2ebe6a839cce59920156d55e8d06fe2a5c95ad60419086877bb

General

Target

12d3dc8a4fd8a2ebe6a839cce59920156d55e8d06fe2a5c95ad60419086877bb.exe
Size

30KB
MD5

2cdffb841cfd9e2e729de2f02c47f8d1
SHA1

8d4e116bd2cfc57bfbe5f05308020e65f93d592d
SHA256

12d3dc8a4fd8a2ebe6a839cce59920156d55e8d06fe2a5c95ad60419086877bb
SHA512

8d344d0afba0eca49b4541b75c3e39dde3b75c9503bdddaf435b834699010852a0ada54fa2381c64bb31211dd9cf12eec0394c1f30700521ae849e29a4e7b90f
SSDEEP

768:QVKaUWVgbStx+y4+LK2rTMk6vAZ2HtIWVpw5/:QEaP6QxNxTMSYted

Score

10^/10

rhadamanthys smokeloader kev backdoor collection stealer trojan

Malware Config

Extracted

Family

smokeloader

Botnet

kev

Extracted

Family

smokeloader

Version

2022

C2

http://atillapro.com/

https://atillapro.com/

rc4.i32

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

5946.exe

description pid process target process

PID 1396 created 2656 1396 5946.exe sihost.exe
Deletes itself 1 IoCs

Processes:

pid process

3160
Executes dropped EXE 1 IoCs

Processes:

5946.exe

pid process

1396 5946.exe

description	pid	process	target process
PID 1396 created 2656	1396	5946.exe	sihost.exe

pid	process
3160

pid	process
1396	5946.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

12d3dc8a4fd8a2ebe6a839cce59920156d55e8d06fe2a5c95ad60419086877bb.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	12d3dc8a4fd8a2ebe6a839cce59920156d55e8d06fe2a5c95ad60419086877bb.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	12d3dc8a4fd8a2ebe6a839cce59920156d55e8d06fe2a5c95ad60419086877bb.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	12d3dc8a4fd8a2ebe6a839cce59920156d55e8d06fe2a5c95ad60419086877bb.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

12d3dc8a4fd8a2ebe6a839cce59920156d55e8d06fe2a5c95ad60419086877bb.exe

pid	process
2924	12d3dc8a4fd8a2ebe6a839cce59920156d55e8d06fe2a5c95ad60419086877bb.exe
2924	12d3dc8a4fd8a2ebe6a839cce59920156d55e8d06fe2a5c95ad60419086877bb.exe
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160

Suspicious behavior: MapViewOfSection 19 IoCs

Processes:

12d3dc8a4fd8a2ebe6a839cce59920156d55e8d06fe2a5c95ad60419086877bb.exe

pid	process
2924	12d3dc8a4fd8a2ebe6a839cce59920156d55e8d06fe2a5c95ad60419086877bb.exe
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160

Suspicious use of WriteProcessMemory 41 IoCs

Processes:

5946.exe

description	pid	process	target process
PID 3160 wrote to memory of 1396	3160		5946.exe
PID 3160 wrote to memory of 1396	3160		5946.exe
PID 3160 wrote to memory of 1396	3160		5946.exe
PID 3160 wrote to memory of 2732	3160		explorer.exe
PID 3160 wrote to memory of 2732	3160		explorer.exe
PID 3160 wrote to memory of 2732	3160		explorer.exe
PID 3160 wrote to memory of 2732	3160		explorer.exe
PID 3160 wrote to memory of 1148	3160		explorer.exe
PID 3160 wrote to memory of 1148	3160		explorer.exe
PID 3160 wrote to memory of 1148	3160		explorer.exe
PID 3160 wrote to memory of 3296	3160		explorer.exe
PID 3160 wrote to memory of 3296	3160		explorer.exe
PID 3160 wrote to memory of 3296	3160		explorer.exe
PID 3160 wrote to memory of 3296	3160		explorer.exe
PID 3160 wrote to memory of 1032	3160		explorer.exe
PID 3160 wrote to memory of 1032	3160		explorer.exe
PID 3160 wrote to memory of 1032	3160		explorer.exe
PID 3160 wrote to memory of 1032	3160		explorer.exe
PID 1396 wrote to memory of 2388	1396	5946.exe	dialer.exe
PID 1396 wrote to memory of 2388	1396	5946.exe	dialer.exe
PID 1396 wrote to memory of 2388	1396	5946.exe	dialer.exe
PID 1396 wrote to memory of 2388	1396	5946.exe	dialer.exe
PID 1396 wrote to memory of 2388	1396	5946.exe	dialer.exe
PID 3160 wrote to memory of 476	3160		explorer.exe
PID 3160 wrote to memory of 476	3160		explorer.exe
PID 3160 wrote to memory of 476	3160		explorer.exe
PID 3160 wrote to memory of 4452	3160		explorer.exe
PID 3160 wrote to memory of 4452	3160		explorer.exe
PID 3160 wrote to memory of 4452	3160		explorer.exe
PID 3160 wrote to memory of 4452	3160		explorer.exe
PID 3160 wrote to memory of 5088	3160		explorer.exe
PID 3160 wrote to memory of 5088	3160		explorer.exe
PID 3160 wrote to memory of 5088	3160		explorer.exe
PID 3160 wrote to memory of 5088	3160		explorer.exe
PID 3160 wrote to memory of 1468	3160		explorer.exe
PID 3160 wrote to memory of 1468	3160		explorer.exe
PID 3160 wrote to memory of 1468	3160		explorer.exe
PID 3160 wrote to memory of 3784	3160		explorer.exe
PID 3160 wrote to memory of 3784	3160		explorer.exe
PID 3160 wrote to memory of 3784	3160		explorer.exe
PID 3160 wrote to memory of 3784	3160		explorer.exe

outlook_office_path 1 IoCs

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

outlook_win_path 1 IoCs

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2656

C:\Windows\SysWOW64\dialer.exe
"C:\Windows\system32\dialer.exe"
2⤵
PID:2388

C:\Users\Admin\AppData\Local\Temp\12d3dc8a4fd8a2ebe6a839cce59920156d55e8d06fe2a5c95ad60419086877bb.exe
"C:\Users\Admin\AppData\Local\Temp\12d3dc8a4fd8a2ebe6a839cce59920156d55e8d06fe2a5c95ad60419086877bb.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2924

C:\Users\Admin\AppData\Local\Temp\5946.exe
C:\Users\Admin\AppData\Local\Temp\5946.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:2732

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1148

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3296

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1032

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:476

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4452

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:5088

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1468

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3784

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5946.exe
Filesize
479KB

MD5
08e5f1243ad4970745975b27b6e2f9fa

SHA1
83b1a8939bd4e2ea5677d8742edd1a697edd196b

SHA256
05074675b07feb8e7556c5af449f5e677e0fabfb09b135971afbb11743bf3165

SHA512
d01f83c4c35e6049544d71037b3d8db29cf177e232839c684e2943899e7e891d0e30d996ddb0af58f760ac34dd8fc6acee7338b52b3fda5f17c892f7498d2280

Download Submit
memory/476-67-0x00000000001E0000-0x00000000001EF000-memory.dmp

Filesize
60KB

Download
memory/476-87-0x0000000002E90000-0x0000000003290000-memory.dmp

Filesize
4.0MB

Download
memory/476-62-0x00000000001E0000-0x00000000001EF000-memory.dmp

Filesize
60KB

Download
memory/476-65-0x0000000002E90000-0x0000000003290000-memory.dmp

Filesize
4.0MB

Download
memory/1032-53-0x0000000001270000-0x000000000127B000-memory.dmp

Filesize
44KB

Download
memory/1032-52-0x0000000001280000-0x0000000001287000-memory.dmp

Filesize
28KB

Download
memory/1032-84-0x0000000001280000-0x0000000001287000-memory.dmp

Filesize
28KB

Download
memory/1032-51-0x0000000001270000-0x000000000127B000-memory.dmp

Filesize
44KB

Download
memory/1148-41-0x0000000000150000-0x000000000015C000-memory.dmp

Filesize
48KB

Download
memory/1148-42-0x0000000000160000-0x0000000000167000-memory.dmp

Filesize
28KB

Download
memory/1148-44-0x0000000000150000-0x000000000015C000-memory.dmp

Filesize
48KB

Download
memory/1396-50-0x00000000034D0000-0x00000000038D0000-memory.dmp

Filesize
4.0MB

Download
memory/1396-60-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1396-48-0x00000000034D0000-0x00000000038D0000-memory.dmp

Filesize
4.0MB

Download
memory/1396-49-0x00000000034D0000-0x00000000038D0000-memory.dmp

Filesize
4.0MB

Download
memory/1396-15-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1396-57-0x00000000759B0000-0x0000000075C02000-memory.dmp

Filesize
2.3MB

Download
memory/1396-54-0x00007FFEE14E0000-0x00007FFEE16E9000-memory.dmp

Filesize
2.0MB

Download
memory/1396-55-0x00000000034D0000-0x00000000038D0000-memory.dmp

Filesize
4.0MB

Download
memory/1468-81-0x0000000000100000-0x000000000010D000-memory.dmp

Filesize
52KB

Download
memory/1468-82-0x0000000000100000-0x000000000010D000-memory.dmp

Filesize
52KB

Download
memory/1468-89-0x0000000000530000-0x000000000053B000-memory.dmp

Filesize
44KB

Download
memory/2388-77-0x00007FFEE14E0000-0x00007FFEE16E9000-memory.dmp

Filesize
2.0MB

Download
memory/2388-76-0x0000000002E90000-0x0000000003290000-memory.dmp

Filesize
4.0MB

Download
memory/2388-58-0x0000000000E80000-0x0000000000E89000-memory.dmp

Filesize
36KB

Download
memory/2388-70-0x00000000759B0000-0x0000000075C02000-memory.dmp

Filesize
2.3MB

Download
memory/2388-61-0x00007FFEE14E0000-0x00007FFEE16E9000-memory.dmp

Filesize
2.0MB

Download
memory/2388-64-0x0000000002E90000-0x0000000003290000-memory.dmp

Filesize
4.0MB

Download
memory/2388-71-0x0000000002E90000-0x0000000003290000-memory.dmp

Filesize
4.0MB

Download
memory/2388-69-0x00007FFEE14E0000-0x00007FFEE16E9000-memory.dmp

Filesize
2.0MB

Download
memory/2388-63-0x0000000002E90000-0x0000000003290000-memory.dmp

Filesize
4.0MB

Download
memory/2732-17-0x0000000000580000-0x00000000005F5000-memory.dmp

Filesize
468KB

Download
memory/2732-43-0x0000000000510000-0x000000000057B000-memory.dmp

Filesize
428KB

Download
memory/2732-18-0x0000000000510000-0x000000000057B000-memory.dmp

Filesize
428KB

Download
memory/2732-19-0x0000000000510000-0x000000000057B000-memory.dmp

Filesize
428KB

Download
memory/2924-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2924-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3160-1-0x00000000024D0000-0x00000000024E6000-memory.dmp

Filesize
88KB

Download
memory/3296-45-0x0000000001040000-0x000000000104A000-memory.dmp

Filesize
40KB

Download
memory/3296-46-0x0000000001030000-0x000000000103B000-memory.dmp

Filesize
44KB

Download
memory/3296-47-0x0000000001030000-0x000000000103B000-memory.dmp

Filesize
44KB

Download
memory/3784-86-0x0000000000870000-0x000000000087B000-memory.dmp

Filesize
44KB

Download
memory/3784-83-0x0000000000870000-0x000000000087B000-memory.dmp

Filesize
44KB

Download
memory/3784-85-0x0000000000100000-0x000000000010D000-memory.dmp

Filesize
52KB

Download
memory/3784-90-0x0000000000100000-0x000000000010D000-memory.dmp

Filesize
52KB

Download
memory/4452-72-0x00000000003C0000-0x00000000003E7000-memory.dmp

Filesize
156KB

Download
memory/4452-74-0x00000000003C0000-0x00000000003E7000-memory.dmp

Filesize
156KB

Download
memory/4452-73-0x0000000000600000-0x0000000000621000-memory.dmp

Filesize
132KB

Download
memory/5088-79-0x0000000000540000-0x0000000000546000-memory.dmp

Filesize
24KB

Download
memory/5088-80-0x0000000000530000-0x000000000053B000-memory.dmp

Filesize
44KB

Download
memory/5088-88-0x0000000000530000-0x000000000053B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads