rhadamanthys | 739390602ee64e0c6fc696e569f5e1672f24e7c75bd07c86e5b68ede56366fda

Analysis

max time kernel
133s
max time network
135s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
08/05/2024, 05:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
g2m.dll
Size 29.7MB
Sample240508-ft9gdafa67
SHA256 85294150b7e0b83c6e6517d22bfd4af2376dcdc7eea18b4bbc263453e2d8bba2
MD5 e6c5740b9b6c48c8bff6117be93cb540
SHA1 3da3d7891efc78b30450c0bb4649e6e2a80f3e74
SHA512 642ba1deabf5c629a27035742461c160908718a998fd5ac661b6aa94255096996b6e0169b7b09af62ad9687f3f3062e5492c84bddf33e6ed6f93bd1e61d917b9
SSDEEP 393216:LezzzEDJ63vIMxrsjnh7CHfqkALvIzhJRYiE/XWKNnBcR7L:az2CvRGwCXUhJRYiE+0nBcR7L
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rhadamanthys persistence stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4228 created 2864	4228	regsvr32.exe	50

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Windows\CurrentVersion\Run\*Mouhn = "rundll32.exe C:\\Users\\Admin\\AppData\\Roaming\\Lopeunt.dll,EntryPoint"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2544	regsvr32.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1320	4228	WerFault.exe	75
972	4228	WerFault.exe	75

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4228	regsvr32.exe
4228	regsvr32.exe
2108	dialer.exe
2108	dialer.exe
2108	dialer.exe
2108	dialer.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 2544	2752	regsvr32.exe	74
PID 2752 wrote to memory of 2544	2752	regsvr32.exe	74
PID 2752 wrote to memory of 2544	2752	regsvr32.exe	74
PID 2544 wrote to memory of 4228	2544	regsvr32.exe	75
PID 2544 wrote to memory of 4228	2544	regsvr32.exe	75
PID 2544 wrote to memory of 4228	2544	regsvr32.exe	75
PID 2544 wrote to memory of 4228	2544	regsvr32.exe	75
PID 2544 wrote to memory of 4228	2544	regsvr32.exe	75
PID 2544 wrote to memory of 4228	2544	regsvr32.exe	75
PID 4228 wrote to memory of 2108	4228	regsvr32.exe	76
PID 4228 wrote to memory of 2108	4228	regsvr32.exe	76
PID 4228 wrote to memory of 2108	4228	regsvr32.exe	76
PID 4228 wrote to memory of 2108	4228	regsvr32.exe	76
PID 4228 wrote to memory of 2108	4228	regsvr32.exe	76
PID 2544 wrote to memory of 1208	2544	regsvr32.exe	80
PID 2544 wrote to memory of 1208	2544	regsvr32.exe	80
PID 2544 wrote to memory of 1208	2544	regsvr32.exe	80
PID 1208 wrote to memory of 1140	1208	cmd.exe	82
PID 1208 wrote to memory of 1140	1208	cmd.exe	82
PID 1208 wrote to memory of 1140	1208	cmd.exe	82

c:\windows\system32\sihost.exe
sihost.exe
1⤵
PID:2864
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2108

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\g2m.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\g2m.dll
  2⤵
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\SysWOW64\regsvr32.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4228
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 612
      4⤵
      Program crash
      PID:1320
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 600
      4⤵
      Program crash
      PID:972
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*Mouhn" /t REG_SZ /d "rundll32.exe C:\Users\Admin\AppData\Roaming\Lopeunt.dll",EntryPoint /f & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1208
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*Mouhn" /t REG_SZ /d "rundll32.exe C:\Users\Admin\AppData\Roaming\Lopeunt.dll",EntryPoint /f
      4⤵
      Adds Run key to start application
      PID:1140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2108-16-0x0000000000940000-0x0000000000949000-memory.dmp

Download

memory/2108-19-0x00007FF8907F0000-0x00007FF8909CB000-memory.dmp

Download

memory/2108-21-0x0000000076CA0000-0x0000000076E62000-memory.dmp

Download

memory/2108-18-0x0000000004900000-0x0000000004D00000-memory.dmp

Download

memory/2544-2-0x0000000010000000-0x0000000011CED000-memory.dmp

Download

memory/2544-0-0x0000000010000000-0x0000000011CED000-memory.dmp

Download

memory/2544-12-0x0000000011C7F000-0x0000000011C87000-memory.dmp

Download

memory/2544-1-0x0000000010869000-0x0000000010882000-memory.dmp

Download

memory/2544-6-0x0000000010000000-0x0000000011CED000-memory.dmp

Download

memory/2544-5-0x0000000010000000-0x0000000011CED000-memory.dmp

Download

memory/4228-7-0x0000000002150000-0x00000000021BD000-memory.dmp

Download

memory/4228-13-0x00007FF8907F0000-0x00007FF8909CB000-memory.dmp

Download

memory/4228-15-0x0000000076CA0000-0x0000000076E62000-memory.dmp

Download

memory/4228-9-0x0000000004FC0000-0x00000000053C0000-memory.dmp

Download

memory/4228-8-0x0000000002150000-0x00000000021BD000-memory.dmp

Download

memory/4228-10-0x0000000004FC0000-0x00000000053C0000-memory.dmp

Download

memory/4228-11-0x0000000002150000-0x00000000021BD000-memory.dmp

Download

memory/4228-3-0x00000000021C0000-0x00000000021C1000-memory.dmp

Download