rhadamanthys | 6d38ecc7c7421b3294ece31e257138dba7c1e933d5d4aecac68acd1b0395f7f8

General

Target

6d38ecc7c7421b3294ece31e257138dba7c1e933d5d4aecac68acd1b0395f7f8.exe
Size

777KB
MD5

f20953273a29f211ad2fbd1db9961349
SHA1

e6ed3e4123dc0d727ea759f9560eab6971f1fcc0
SHA256

6d38ecc7c7421b3294ece31e257138dba7c1e933d5d4aecac68acd1b0395f7f8
SHA512

a5c9e0e4711d869fea9589ac7df843c1a66e93250997c1e009ebaa4afe219edf48a340f9435ff233b92e3a1d810713b901de3bc41b7f8f77d454ade549e048f7
SSDEEP

12288:dEUWVser3NvH4qsanwmgW7gPLKp/31lOXwAH5eawCZyNRpJeSzEZFf9J/hw8:dJmBDZHfPgGgzKtjUZeaL2feHbjh

Score

10^/10

rhadamanthys zgrat rat stealer

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2756-0-0x0000000000D50000-0x0000000000E18000-memory.dmp	family_zgrat_v1

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

AddInProcess32.exe

description pid process target process

PID 60 created 3040 60 AddInProcess32.exe sihost.exe
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

description	pid	process	target process
PID 60 created 3040	60	AddInProcess32.exe	sihost.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

6d38ecc7c7421b3294ece31e257138dba7c1e933d5d4aecac68acd1b0395f7f8.exe

description	pid	process	target process
PID 2756 set thread context of 60	2756	6d38ecc7c7421b3294ece31e257138dba7c1e933d5d4aecac68acd1b0395f7f8.exe	AddInProcess32.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4988 60 WerFault.exe AddInProcess32.exe
3676 60 WerFault.exe AddInProcess32.exe

pid	pid_target	process	target process
4988	60	WerFault.exe	AddInProcess32.exe
3676	60	WerFault.exe	AddInProcess32.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

6d38ecc7c7421b3294ece31e257138dba7c1e933d5d4aecac68acd1b0395f7f8.exeAddInProcess32.exedialer.exe

pid	process
2756	6d38ecc7c7421b3294ece31e257138dba7c1e933d5d4aecac68acd1b0395f7f8.exe
60	AddInProcess32.exe
60	AddInProcess32.exe
2184	dialer.exe
2184	dialer.exe
2184	dialer.exe
2184	dialer.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

6d38ecc7c7421b3294ece31e257138dba7c1e933d5d4aecac68acd1b0395f7f8.exe

description pid process

Token: SeDebugPrivilege 2756 6d38ecc7c7421b3294ece31e257138dba7c1e933d5d4aecac68acd1b0395f7f8.exe

description	pid	process
Token: SeDebugPrivilege	2756	6d38ecc7c7421b3294ece31e257138dba7c1e933d5d4aecac68acd1b0395f7f8.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

6d38ecc7c7421b3294ece31e257138dba7c1e933d5d4aecac68acd1b0395f7f8.exeAddInProcess32.exe

description	pid	process	target process
PID 2756 wrote to memory of 60	2756	6d38ecc7c7421b3294ece31e257138dba7c1e933d5d4aecac68acd1b0395f7f8.exe	AddInProcess32.exe
PID 2756 wrote to memory of 60	2756	6d38ecc7c7421b3294ece31e257138dba7c1e933d5d4aecac68acd1b0395f7f8.exe	AddInProcess32.exe
PID 2756 wrote to memory of 60	2756	6d38ecc7c7421b3294ece31e257138dba7c1e933d5d4aecac68acd1b0395f7f8.exe	AddInProcess32.exe
PID 2756 wrote to memory of 60	2756	6d38ecc7c7421b3294ece31e257138dba7c1e933d5d4aecac68acd1b0395f7f8.exe	AddInProcess32.exe
PID 2756 wrote to memory of 60	2756	6d38ecc7c7421b3294ece31e257138dba7c1e933d5d4aecac68acd1b0395f7f8.exe	AddInProcess32.exe
PID 2756 wrote to memory of 60	2756	6d38ecc7c7421b3294ece31e257138dba7c1e933d5d4aecac68acd1b0395f7f8.exe	AddInProcess32.exe
PID 2756 wrote to memory of 60	2756	6d38ecc7c7421b3294ece31e257138dba7c1e933d5d4aecac68acd1b0395f7f8.exe	AddInProcess32.exe
PID 2756 wrote to memory of 60	2756	6d38ecc7c7421b3294ece31e257138dba7c1e933d5d4aecac68acd1b0395f7f8.exe	AddInProcess32.exe
PID 2756 wrote to memory of 60	2756	6d38ecc7c7421b3294ece31e257138dba7c1e933d5d4aecac68acd1b0395f7f8.exe	AddInProcess32.exe
PID 2756 wrote to memory of 60	2756	6d38ecc7c7421b3294ece31e257138dba7c1e933d5d4aecac68acd1b0395f7f8.exe	AddInProcess32.exe
PID 60 wrote to memory of 2184	60	AddInProcess32.exe	dialer.exe
PID 60 wrote to memory of 2184	60	AddInProcess32.exe	dialer.exe
PID 60 wrote to memory of 2184	60	AddInProcess32.exe	dialer.exe
PID 60 wrote to memory of 2184	60	AddInProcess32.exe	dialer.exe
PID 60 wrote to memory of 2184	60	AddInProcess32.exe	dialer.exe

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:3040

C:\Windows\SysWOW64\dialer.exe
"C:\Windows\system32\dialer.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2184

C:\Users\Admin\AppData\Local\Temp\6d38ecc7c7421b3294ece31e257138dba7c1e933d5d4aecac68acd1b0395f7f8.exe
"C:\Users\Admin\AppData\Local\Temp\6d38ecc7c7421b3294ece31e257138dba7c1e933d5d4aecac68acd1b0395f7f8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2756

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
#cmd
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:60

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 444
3⤵
- Program crash
PID:4988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 468
3⤵
- Program crash
PID:3676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 60 -ip 60
1⤵
PID:4104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 60 -ip 60
1⤵
PID:4504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/60-13-0x00000000041F0000-0x00000000045F0000-memory.dmp

Filesize
4.0MB

Download
memory/60-9-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/60-27-0x00000000041F0000-0x00000000045F0000-memory.dmp

Filesize
4.0MB

Download
memory/60-15-0x00000000041F0000-0x00000000045F0000-memory.dmp

Filesize
4.0MB

Download
memory/60-14-0x00007FFE56430000-0x00007FFE56625000-memory.dmp

Filesize
2.0MB

Download
memory/60-5-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/60-17-0x0000000075D40000-0x0000000075F55000-memory.dmp

Filesize
2.1MB

Download
memory/60-11-0x00000000041F0000-0x00000000045F0000-memory.dmp

Filesize
4.0MB

Download
memory/60-10-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2184-21-0x0000000001EF0000-0x00000000022F0000-memory.dmp

Filesize
4.0MB

Download
memory/2184-24-0x0000000001EF0000-0x00000000022F0000-memory.dmp

Filesize
4.0MB

Download
memory/2184-25-0x0000000075D40000-0x0000000075F55000-memory.dmp

Filesize
2.1MB

Download
memory/2184-22-0x00007FFE56430000-0x00007FFE56625000-memory.dmp

Filesize
2.0MB

Download
memory/2184-26-0x0000000001EF0000-0x00000000022F0000-memory.dmp

Filesize
4.0MB

Download
memory/2184-18-0x0000000000160000-0x0000000000169000-memory.dmp

Filesize
36KB

Download
memory/2756-8-0x0000000074960000-0x0000000075110000-memory.dmp

Filesize
7.7MB

Download
memory/2756-3-0x00000000032E0000-0x00000000032E1000-memory.dmp

Filesize
4KB

Download
memory/2756-4-0x0000000005810000-0x0000000005870000-memory.dmp

Filesize
384KB

Download
memory/2756-2-0x0000000005890000-0x00000000058A0000-memory.dmp

Filesize
64KB

Download
memory/2756-1-0x0000000074960000-0x0000000075110000-memory.dmp

Filesize
7.7MB

Download
memory/2756-0-0x0000000000D50000-0x0000000000E18000-memory.dmp

Filesize
800KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads