rhadamanthys | 12d3dc8a4fd8a2ebe6a839cce59920156d55e8d06fe2a5c95ad60419086877bb

General

Target

2cdffb841cfd9e2e729de2f02c47f8d1.exe
Size

30KB
MD5

2cdffb841cfd9e2e729de2f02c47f8d1
SHA1

8d4e116bd2cfc57bfbe5f05308020e65f93d592d
SHA256

12d3dc8a4fd8a2ebe6a839cce59920156d55e8d06fe2a5c95ad60419086877bb
SHA512

8d344d0afba0eca49b4541b75c3e39dde3b75c9503bdddaf435b834699010852a0ada54fa2381c64bb31211dd9cf12eec0394c1f30700521ae849e29a4e7b90f
SSDEEP

768:QVKaUWVgbStx+y4+LK2rTMk6vAZ2HtIWVpw5/:QEaP6QxNxTMSYted

Score

10^/10

rhadamanthys smokeloader kev backdoor collection stealer trojan

Malware Config

Extracted

Family

smokeloader

Botnet

kev

Extracted

Family

smokeloader

Version

2022

C2

http://atillapro.com/

https://atillapro.com/

rc4.i32

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

88B8.exe

description pid process target process

PID 4824 created 2936 4824 88B8.exe sihost.exe
Deletes itself 1 IoCs

Processes:

pid process

3360
Executes dropped EXE 1 IoCs

Processes:

88B8.exe

pid process

4824 88B8.exe

description	pid	process	target process
PID 4824 created 2936	4824	88B8.exe	sihost.exe

pid	process
3360

pid	process
4824	88B8.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

2cdffb841cfd9e2e729de2f02c47f8d1.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2cdffb841cfd9e2e729de2f02c47f8d1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2cdffb841cfd9e2e729de2f02c47f8d1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2cdffb841cfd9e2e729de2f02c47f8d1.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

2cdffb841cfd9e2e729de2f02c47f8d1.exe

pid	process
1192	2cdffb841cfd9e2e729de2f02c47f8d1.exe
1192	2cdffb841cfd9e2e729de2f02c47f8d1.exe
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360

Suspicious behavior: MapViewOfSection 19 IoCs

Processes:

2cdffb841cfd9e2e729de2f02c47f8d1.exe

pid process

1192 2cdffb841cfd9e2e729de2f02c47f8d1.exe
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid process

3360

pid	process
3360

Suspicious use of WriteProcessMemory 41 IoCs

Processes:

88B8.exe

description	pid	process	target process
PID 3360 wrote to memory of 4824	3360		88B8.exe
PID 3360 wrote to memory of 4824	3360		88B8.exe
PID 3360 wrote to memory of 4824	3360		88B8.exe
PID 3360 wrote to memory of 4592	3360		explorer.exe
PID 3360 wrote to memory of 4592	3360		explorer.exe
PID 3360 wrote to memory of 4592	3360		explorer.exe
PID 3360 wrote to memory of 4592	3360		explorer.exe
PID 3360 wrote to memory of 3488	3360		explorer.exe
PID 3360 wrote to memory of 3488	3360		explorer.exe
PID 3360 wrote to memory of 3488	3360		explorer.exe
PID 3360 wrote to memory of 4728	3360		explorer.exe
PID 3360 wrote to memory of 4728	3360		explorer.exe
PID 3360 wrote to memory of 4728	3360		explorer.exe
PID 3360 wrote to memory of 4728	3360		explorer.exe
PID 4824 wrote to memory of 3900	4824	88B8.exe	dialer.exe
PID 4824 wrote to memory of 3900	4824	88B8.exe	dialer.exe
PID 4824 wrote to memory of 3900	4824	88B8.exe	dialer.exe
PID 4824 wrote to memory of 3900	4824	88B8.exe	dialer.exe
PID 4824 wrote to memory of 3900	4824	88B8.exe	dialer.exe
PID 3360 wrote to memory of 2516	3360		explorer.exe
PID 3360 wrote to memory of 2516	3360		explorer.exe
PID 3360 wrote to memory of 2516	3360		explorer.exe
PID 3360 wrote to memory of 2516	3360		explorer.exe
PID 3360 wrote to memory of 5072	3360		explorer.exe
PID 3360 wrote to memory of 5072	3360		explorer.exe
PID 3360 wrote to memory of 5072	3360		explorer.exe
PID 3360 wrote to memory of 864	3360		explorer.exe
PID 3360 wrote to memory of 864	3360		explorer.exe
PID 3360 wrote to memory of 864	3360		explorer.exe
PID 3360 wrote to memory of 864	3360		explorer.exe
PID 3360 wrote to memory of 1536	3360		explorer.exe
PID 3360 wrote to memory of 1536	3360		explorer.exe
PID 3360 wrote to memory of 1536	3360		explorer.exe
PID 3360 wrote to memory of 1536	3360		explorer.exe
PID 3360 wrote to memory of 2640	3360		explorer.exe
PID 3360 wrote to memory of 2640	3360		explorer.exe
PID 3360 wrote to memory of 2640	3360		explorer.exe
PID 3360 wrote to memory of 1188	3360		explorer.exe
PID 3360 wrote to memory of 1188	3360		explorer.exe
PID 3360 wrote to memory of 1188	3360		explorer.exe
PID 3360 wrote to memory of 1188	3360		explorer.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

outlook_win_path 1 IoCs

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2936

C:\Windows\SysWOW64\dialer.exe
"C:\Windows\system32\dialer.exe"
2⤵
PID:3900

C:\Users\Admin\AppData\Local\Temp\2cdffb841cfd9e2e729de2f02c47f8d1.exe
"C:\Users\Admin\AppData\Local\Temp\2cdffb841cfd9e2e729de2f02c47f8d1.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1192

C:\Users\Admin\AppData\Local\Temp\88B8.exe
C:\Users\Admin\AppData\Local\Temp\88B8.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:4592

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3488

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4728

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2516

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:5072

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:864

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1536

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2640

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1188

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\88B8.exe
Filesize
479KB

MD5
08e5f1243ad4970745975b27b6e2f9fa

SHA1
83b1a8939bd4e2ea5677d8742edd1a697edd196b

SHA256
05074675b07feb8e7556c5af449f5e677e0fabfb09b135971afbb11743bf3165

SHA512
d01f83c4c35e6049544d71037b3d8db29cf177e232839c684e2943899e7e891d0e30d996ddb0af58f760ac34dd8fc6acee7338b52b3fda5f17c892f7498d2280

Download Submit
memory/864-71-0x00000000012B0000-0x00000000012D7000-memory.dmp

Filesize
156KB

Download
memory/864-72-0x00000000012B0000-0x00000000012D7000-memory.dmp

Filesize
156KB

Download
memory/864-85-0x0000000000550000-0x000000000055F000-memory.dmp

Filesize
60KB

Download
memory/1188-82-0x00000000012B0000-0x00000000012BB000-memory.dmp

Filesize
44KB

Download
memory/1188-92-0x00000000003F0000-0x00000000003FD000-memory.dmp

Filesize
52KB

Download
memory/1188-80-0x00000000012B0000-0x00000000012BB000-memory.dmp

Filesize
44KB

Download
memory/1188-81-0x00000000003F0000-0x00000000003FD000-memory.dmp

Filesize
52KB

Download
memory/1192-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1192-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1536-90-0x00000000012C0000-0x00000000012C6000-memory.dmp

Filesize
24KB

Download
memory/1536-77-0x00000000012B0000-0x00000000012BB000-memory.dmp

Filesize
44KB

Download
memory/1536-76-0x00000000012C0000-0x00000000012C6000-memory.dmp

Filesize
24KB

Download
memory/1536-75-0x00000000012B0000-0x00000000012BB000-memory.dmp

Filesize
44KB

Download
memory/2516-66-0x00000000012B0000-0x00000000012BB000-memory.dmp

Filesize
44KB

Download
memory/2516-83-0x00000000026D0000-0x0000000002AD0000-memory.dmp

Filesize
4.0MB

Download
memory/2516-68-0x00000000012B0000-0x00000000012BB000-memory.dmp

Filesize
44KB

Download
memory/2516-67-0x00000000026D0000-0x0000000002AD0000-memory.dmp

Filesize
4.0MB

Download
memory/2640-78-0x00000000003F0000-0x00000000003FD000-memory.dmp

Filesize
52KB

Download
memory/2640-79-0x0000000000600000-0x0000000000607000-memory.dmp

Filesize
28KB

Download
memory/2640-91-0x00000000003F0000-0x00000000003FD000-memory.dmp

Filesize
52KB

Download
memory/3360-1-0x0000000007520000-0x0000000007536000-memory.dmp

Filesize
88KB

Download
memory/3488-41-0x00000000001C0000-0x00000000001C7000-memory.dmp

Filesize
28KB

Download
memory/3488-43-0x00000000001B0000-0x00000000001BC000-memory.dmp

Filesize
48KB

Download
memory/3488-44-0x00000000001B0000-0x00000000001BC000-memory.dmp

Filesize
48KB

Download
memory/3900-61-0x00007FFCED870000-0x00007FFCEDA65000-memory.dmp

Filesize
2.0MB

Download
memory/3900-64-0x00000000760F0000-0x0000000076305000-memory.dmp

Filesize
2.1MB

Download
memory/3900-65-0x00000000026D0000-0x0000000002AD0000-memory.dmp

Filesize
4.0MB

Download
memory/3900-63-0x00000000026D0000-0x0000000002AD0000-memory.dmp

Filesize
4.0MB

Download
memory/3900-59-0x00000000026D0000-0x0000000002AD0000-memory.dmp

Filesize
4.0MB

Download
memory/3900-60-0x00000000026D0000-0x0000000002AD0000-memory.dmp

Filesize
4.0MB

Download
memory/3900-53-0x0000000000A20000-0x0000000000A29000-memory.dmp

Filesize
36KB

Download
memory/4592-17-0x00000000009D0000-0x0000000000A3B000-memory.dmp

Filesize
428KB

Download
memory/4592-19-0x00000000009D0000-0x0000000000A3B000-memory.dmp

Filesize
428KB

Download
memory/4592-18-0x0000000000A40000-0x0000000000AB5000-memory.dmp

Filesize
468KB

Download
memory/4592-45-0x00000000009D0000-0x0000000000A3B000-memory.dmp

Filesize
428KB

Download
memory/4728-57-0x0000000000B00000-0x0000000000B0B000-memory.dmp

Filesize
44KB

Download
memory/4728-55-0x0000000000B10000-0x0000000000B1A000-memory.dmp

Filesize
40KB

Download
memory/4728-54-0x0000000000B00000-0x0000000000B0B000-memory.dmp

Filesize
44KB

Download
memory/4824-48-0x0000000003280000-0x0000000003680000-memory.dmp

Filesize
4.0MB

Download
memory/4824-49-0x00007FFCED870000-0x00007FFCEDA65000-memory.dmp

Filesize
2.0MB

Download
memory/4824-51-0x0000000003280000-0x0000000003680000-memory.dmp

Filesize
4.0MB

Download
memory/4824-46-0x0000000003280000-0x0000000003680000-memory.dmp

Filesize
4.0MB

Download
memory/4824-52-0x00000000760F0000-0x0000000076305000-memory.dmp

Filesize
2.1MB

Download
memory/4824-56-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4824-15-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/5072-84-0x0000000000550000-0x000000000055F000-memory.dmp

Filesize
60KB

Download
memory/5072-70-0x0000000000560000-0x0000000000569000-memory.dmp

Filesize
36KB

Download
memory/5072-69-0x0000000000550000-0x000000000055F000-memory.dmp

Filesize
60KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads