rhadamanthys | 12d3dc8a4fd8a2ebe6a839cce59920156d55e8d06fe2a5c95ad60419086877bb

General

Target

2cdffb841cfd9e2e729de2f02c47f8d1.exe
Size

30KB
MD5

2cdffb841cfd9e2e729de2f02c47f8d1
SHA1

8d4e116bd2cfc57bfbe5f05308020e65f93d592d
SHA256

12d3dc8a4fd8a2ebe6a839cce59920156d55e8d06fe2a5c95ad60419086877bb
SHA512

8d344d0afba0eca49b4541b75c3e39dde3b75c9503bdddaf435b834699010852a0ada54fa2381c64bb31211dd9cf12eec0394c1f30700521ae849e29a4e7b90f
SSDEEP

768:QVKaUWVgbStx+y4+LK2rTMk6vAZ2HtIWVpw5/:QEaP6QxNxTMSYted

Score

10^/10

rhadamanthys smokeloader kev backdoor collection stealer trojan

Malware Config

Extracted

Family

smokeloader

Botnet

kev

Extracted

Family

smokeloader

Version

2022

C2

http://atillapro.com/

https://atillapro.com/

rc4.i32

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

D6DF.exe

description pid process target process

PID 2504 created 1360 2504 D6DF.exe Explorer.EXE
Deletes itself 1 IoCs

Processes:

Explorer.EXE

pid process

1360 Explorer.EXE
Executes dropped EXE 1 IoCs

Processes:

D6DF.exe

pid process

2504 D6DF.exe

description	pid	process	target process
PID 2504 created 1360	2504	D6DF.exe	Explorer.EXE

pid	process
1360	Explorer.EXE

pid	process
2504	D6DF.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

2cdffb841cfd9e2e729de2f02c47f8d1.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2cdffb841cfd9e2e729de2f02c47f8d1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2cdffb841cfd9e2e729de2f02c47f8d1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2cdffb841cfd9e2e729de2f02c47f8d1.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

2cdffb841cfd9e2e729de2f02c47f8d1.exeExplorer.EXE

pid	process
2676	2cdffb841cfd9e2e729de2f02c47f8d1.exe
2676	2cdffb841cfd9e2e729de2f02c47f8d1.exe
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE

Suspicious behavior: MapViewOfSection 19 IoCs

Processes:

2cdffb841cfd9e2e729de2f02c47f8d1.exeExplorer.EXE

pid	process
2676	2cdffb841cfd9e2e729de2f02c47f8d1.exe
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE
1360	Explorer.EXE

Suspicious use of WriteProcessMemory 52 IoCs

Processes:

Explorer.EXED6DF.exe

description	pid	process	target process
PID 1360 wrote to memory of 2504	1360	Explorer.EXE	D6DF.exe
PID 1360 wrote to memory of 2504	1360	Explorer.EXE	D6DF.exe
PID 1360 wrote to memory of 2504	1360	Explorer.EXE	D6DF.exe
PID 1360 wrote to memory of 2504	1360	Explorer.EXE	D6DF.exe
PID 1360 wrote to memory of 2416	1360	Explorer.EXE	explorer.exe
PID 1360 wrote to memory of 2416	1360	Explorer.EXE	explorer.exe
PID 1360 wrote to memory of 2416	1360	Explorer.EXE	explorer.exe
PID 1360 wrote to memory of 2416	1360	Explorer.EXE	explorer.exe
PID 1360 wrote to memory of 2416	1360	Explorer.EXE	explorer.exe
PID 1360 wrote to memory of 2376	1360	Explorer.EXE	explorer.exe
PID 1360 wrote to memory of 2376	1360	Explorer.EXE	explorer.exe
PID 1360 wrote to memory of 2376	1360	Explorer.EXE	explorer.exe
PID 1360 wrote to memory of 2376	1360	Explorer.EXE	explorer.exe
PID 1360 wrote to memory of 1712	1360	Explorer.EXE	explorer.exe
PID 1360 wrote to memory of 1712	1360	Explorer.EXE	explorer.exe
PID 1360 wrote to memory of 1712	1360	Explorer.EXE	explorer.exe
PID 1360 wrote to memory of 1712	1360	Explorer.EXE	explorer.exe
PID 1360 wrote to memory of 1712	1360	Explorer.EXE	explorer.exe
PID 2504 wrote to memory of 2704	2504	D6DF.exe	dialer.exe
PID 2504 wrote to memory of 2704	2504	D6DF.exe	dialer.exe
PID 2504 wrote to memory of 2704	2504	D6DF.exe	dialer.exe
PID 2504 wrote to memory of 2704	2504	D6DF.exe	dialer.exe
PID 2504 wrote to memory of 2704	2504	D6DF.exe	dialer.exe
PID 2504 wrote to memory of 2704	2504	D6DF.exe	dialer.exe
PID 1360 wrote to memory of 2748	1360	Explorer.EXE	explorer.exe
PID 1360 wrote to memory of 2748	1360	Explorer.EXE	explorer.exe
PID 1360 wrote to memory of 2748	1360	Explorer.EXE	explorer.exe
PID 1360 wrote to memory of 2748	1360	Explorer.EXE	explorer.exe
PID 1360 wrote to memory of 2748	1360	Explorer.EXE	explorer.exe
PID 1360 wrote to memory of 1208	1360	Explorer.EXE	explorer.exe
PID 1360 wrote to memory of 1208	1360	Explorer.EXE	explorer.exe
PID 1360 wrote to memory of 1208	1360	Explorer.EXE	explorer.exe
PID 1360 wrote to memory of 1208	1360	Explorer.EXE	explorer.exe
PID 1360 wrote to memory of 2568	1360	Explorer.EXE	explorer.exe
PID 1360 wrote to memory of 2568	1360	Explorer.EXE	explorer.exe
PID 1360 wrote to memory of 2568	1360	Explorer.EXE	explorer.exe
PID 1360 wrote to memory of 2568	1360	Explorer.EXE	explorer.exe
PID 1360 wrote to memory of 2568	1360	Explorer.EXE	explorer.exe
PID 1360 wrote to memory of 1840	1360	Explorer.EXE	explorer.exe
PID 1360 wrote to memory of 1840	1360	Explorer.EXE	explorer.exe
PID 1360 wrote to memory of 1840	1360	Explorer.EXE	explorer.exe
PID 1360 wrote to memory of 1840	1360	Explorer.EXE	explorer.exe
PID 1360 wrote to memory of 1840	1360	Explorer.EXE	explorer.exe
PID 1360 wrote to memory of 1624	1360	Explorer.EXE	explorer.exe
PID 1360 wrote to memory of 1624	1360	Explorer.EXE	explorer.exe
PID 1360 wrote to memory of 1624	1360	Explorer.EXE	explorer.exe
PID 1360 wrote to memory of 1624	1360	Explorer.EXE	explorer.exe
PID 1360 wrote to memory of 2304	1360	Explorer.EXE	explorer.exe
PID 1360 wrote to memory of 2304	1360	Explorer.EXE	explorer.exe
PID 1360 wrote to memory of 2304	1360	Explorer.EXE	explorer.exe
PID 1360 wrote to memory of 2304	1360	Explorer.EXE	explorer.exe
PID 1360 wrote to memory of 2304	1360	Explorer.EXE	explorer.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

outlook_win_path 1 IoCs

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1360

C:\Users\Admin\AppData\Local\Temp\2cdffb841cfd9e2e729de2f02c47f8d1.exe
"C:\Users\Admin\AppData\Local\Temp\2cdffb841cfd9e2e729de2f02c47f8d1.exe"
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2676

C:\Users\Admin\AppData\Local\Temp\D6DF.exe
C:\Users\Admin\AppData\Local\Temp\D6DF.exe
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
2⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:2416

C:\Windows\explorer.exe
C:\Windows\explorer.exe
2⤵
PID:2376

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
2⤵
PID:1712

C:\Windows\SysWOW64\dialer.exe
"C:\Windows\system32\dialer.exe"
2⤵
PID:2704

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
2⤵
PID:2748

C:\Windows\explorer.exe
C:\Windows\explorer.exe
2⤵
PID:1208

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
2⤵
PID:2568

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
2⤵
PID:1840

C:\Windows\explorer.exe
C:\Windows\explorer.exe
2⤵
PID:1624

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
2⤵
PID:2304

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\D6DF.exe
Filesize
479KB

MD5
08e5f1243ad4970745975b27b6e2f9fa

SHA1
83b1a8939bd4e2ea5677d8742edd1a697edd196b

SHA256
05074675b07feb8e7556c5af449f5e677e0fabfb09b135971afbb11743bf3165

SHA512
d01f83c4c35e6049544d71037b3d8db29cf177e232839c684e2943899e7e891d0e30d996ddb0af58f760ac34dd8fc6acee7338b52b3fda5f17c892f7498d2280

Download Submit
memory/1208-79-0x0000000000070000-0x0000000000079000-memory.dmp

Filesize
36KB

Download
memory/1208-63-0x0000000000070000-0x0000000000079000-memory.dmp

Filesize
36KB

Download
memory/1208-61-0x0000000000060000-0x000000000006F000-memory.dmp

Filesize
60KB

Download
memory/1208-64-0x0000000000060000-0x000000000006F000-memory.dmp

Filesize
60KB

Download
memory/1360-1-0x0000000002590000-0x00000000025A6000-memory.dmp

Filesize
88KB

Download
memory/1624-72-0x0000000000070000-0x0000000000077000-memory.dmp

Filesize
28KB

Download
memory/1624-86-0x0000000000060000-0x000000000006D000-memory.dmp

Filesize
52KB

Download
memory/1624-74-0x0000000000060000-0x000000000006D000-memory.dmp

Filesize
52KB

Download
memory/1712-42-0x0000000000090000-0x000000000009A000-memory.dmp

Filesize
40KB

Download
memory/1712-44-0x0000000000080000-0x000000000008B000-memory.dmp

Filesize
44KB

Download
memory/1712-40-0x0000000000080000-0x000000000008B000-memory.dmp

Filesize
44KB

Download
memory/1840-85-0x0000000000080000-0x000000000008B000-memory.dmp

Filesize
44KB

Download
memory/1840-70-0x0000000000080000-0x000000000008B000-memory.dmp

Filesize
44KB

Download
memory/1840-71-0x0000000000090000-0x0000000000096000-memory.dmp

Filesize
24KB

Download
memory/2304-77-0x0000000000080000-0x000000000008B000-memory.dmp

Filesize
44KB

Download
memory/2304-75-0x0000000000080000-0x000000000008B000-memory.dmp

Filesize
44KB

Download
memory/2304-76-0x0000000000090000-0x0000000000098000-memory.dmp

Filesize
32KB

Download
memory/2304-87-0x0000000000090000-0x0000000000098000-memory.dmp

Filesize
32KB

Download
memory/2376-36-0x0000000000060000-0x000000000006C000-memory.dmp

Filesize
48KB

Download
memory/2376-35-0x0000000000060000-0x000000000006C000-memory.dmp

Filesize
48KB

Download
memory/2416-34-0x0000000000100000-0x000000000016B000-memory.dmp

Filesize
428KB

Download
memory/2416-21-0x0000000000100000-0x000000000016B000-memory.dmp

Filesize
428KB

Download
memory/2416-20-0x0000000000100000-0x000000000016B000-memory.dmp

Filesize
428KB

Download
memory/2416-19-0x0000000000170000-0x00000000001E5000-memory.dmp

Filesize
468KB

Download
memory/2504-48-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2504-47-0x0000000002E60000-0x0000000003260000-memory.dmp

Filesize
4.0MB

Download
memory/2504-45-0x0000000076430000-0x0000000076477000-memory.dmp

Filesize
284KB

Download
memory/2504-41-0x0000000077BB0000-0x0000000077D59000-memory.dmp

Filesize
1.7MB

Download
memory/2504-39-0x0000000002E60000-0x0000000003260000-memory.dmp

Filesize
4.0MB

Download
memory/2504-38-0x0000000002E60000-0x0000000003260000-memory.dmp

Filesize
4.0MB

Download
memory/2504-37-0x0000000002E60000-0x0000000003260000-memory.dmp

Filesize
4.0MB

Download
memory/2504-18-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2568-67-0x0000000000060000-0x000000000006F000-memory.dmp

Filesize
60KB

Download
memory/2568-80-0x0000000000060000-0x000000000006F000-memory.dmp

Filesize
60KB

Download
memory/2568-65-0x0000000000080000-0x00000000000A7000-memory.dmp

Filesize
156KB

Download
memory/2568-66-0x0000000000080000-0x00000000000A7000-memory.dmp

Filesize
156KB

Download
memory/2676-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2676-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2704-58-0x0000000076430000-0x0000000076477000-memory.dmp

Filesize
284KB

Download
memory/2704-62-0x0000000001DB0000-0x00000000021B0000-memory.dmp

Filesize
4.0MB

Download
memory/2704-54-0x0000000077BB0000-0x0000000077D59000-memory.dmp

Filesize
1.7MB

Download
memory/2704-51-0x0000000001DB0000-0x00000000021B0000-memory.dmp

Filesize
4.0MB

Download
memory/2704-59-0x0000000001DB0000-0x00000000021B0000-memory.dmp

Filesize
4.0MB

Download
memory/2704-50-0x0000000001DB0000-0x00000000021B0000-memory.dmp

Filesize
4.0MB

Download
memory/2704-46-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/2704-60-0x0000000077BB0000-0x0000000077D59000-memory.dmp

Filesize
1.7MB

Download
memory/2748-53-0x0000000000080000-0x000000000008B000-memory.dmp

Filesize
44KB

Download
memory/2748-57-0x0000000000080000-0x000000000008B000-memory.dmp

Filesize
44KB

Download
memory/2748-55-0x0000000000090000-0x0000000000097000-memory.dmp

Filesize
28KB

Download
memory/2748-78-0x0000000000090000-0x0000000000097000-memory.dmp

Filesize
28KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads