rhadamanthys | 432747c04ab478a654328867d7ca806b52fedf1572c74712fa8b7c0edb71df67

Analysis

max time kernel
145s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 23:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ghjkl.exe
Size 5.3MB
Sample240516-22ms8sdc53
SHA256 432747c04ab478a654328867d7ca806b52fedf1572c74712fa8b7c0edb71df67
MD5 de08b70c1b36bce2c90a34b9e5e61f09
SHA1 1628635f073c61ad744d406a16d46dfac871c9c2
SHA512 18a30e480ce7d122cfad5a99570042e3bef9e1f9feda1f7be32b273a7248274285c65ac997c90d3d6a950a37b4ea62e6b928bfefc924187c90e32ea571bfd1f5
SSDEEP 98304:/+p+LLypykV4RJGIfsv7RynHr/x1leOzcv0nbzKIKFStIJ:/+pMLCYJ/svlUr/x1vzcvib+Ir
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rhadamanthys execution stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1976 created 2760	1976	ghjkl.exe	47

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4112	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	ghjkl.exe

Executes dropped EXE 2 IoCs

pid	Process
4904	BLHisbnd.exe
1080	BLHisbnd.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2408 set thread context of 1976	2408	ghjkl.exe	92
PID 4904 set thread context of 1080	4904	BLHisbnd.exe	102

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3020	1976	WerFault.exe	92
3196	1976	WerFault.exe	92

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1976	ghjkl.exe
1976	ghjkl.exe
1384	dialer.exe
1384	dialer.exe
1384	dialer.exe
1384	dialer.exe
4112	powershell.exe
4112	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2408	ghjkl.exe
Token: SeDebugPrivilege	2408	ghjkl.exe
Token: SeDebugPrivilege	4904	BLHisbnd.exe
Token: SeDebugPrivilege	4904	BLHisbnd.exe
Token: SeDebugPrivilege	1080	BLHisbnd.exe
Token: SeDebugPrivilege	4112	powershell.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 4904	2408	ghjkl.exe	91
PID 2408 wrote to memory of 4904	2408	ghjkl.exe	91
PID 2408 wrote to memory of 4904	2408	ghjkl.exe	91
PID 2408 wrote to memory of 1976	2408	ghjkl.exe	92
PID 2408 wrote to memory of 1976	2408	ghjkl.exe	92
PID 2408 wrote to memory of 1976	2408	ghjkl.exe	92
PID 2408 wrote to memory of 1976	2408	ghjkl.exe	92
PID 2408 wrote to memory of 1976	2408	ghjkl.exe	92
PID 2408 wrote to memory of 1976	2408	ghjkl.exe	92
PID 2408 wrote to memory of 1976	2408	ghjkl.exe	92
PID 2408 wrote to memory of 1976	2408	ghjkl.exe	92
PID 2408 wrote to memory of 1976	2408	ghjkl.exe	92
PID 2408 wrote to memory of 1976	2408	ghjkl.exe	92
PID 1976 wrote to memory of 1384	1976	ghjkl.exe	96
PID 1976 wrote to memory of 1384	1976	ghjkl.exe	96
PID 1976 wrote to memory of 1384	1976	ghjkl.exe	96
PID 1976 wrote to memory of 1384	1976	ghjkl.exe	96
PID 1976 wrote to memory of 1384	1976	ghjkl.exe	96
PID 4904 wrote to memory of 1080	4904	BLHisbnd.exe	102
PID 4904 wrote to memory of 1080	4904	BLHisbnd.exe	102
PID 4904 wrote to memory of 1080	4904	BLHisbnd.exe	102
PID 4904 wrote to memory of 1080	4904	BLHisbnd.exe	102
PID 4904 wrote to memory of 1080	4904	BLHisbnd.exe	102
PID 4904 wrote to memory of 1080	4904	BLHisbnd.exe	102
PID 4904 wrote to memory of 1080	4904	BLHisbnd.exe	102
PID 4904 wrote to memory of 1080	4904	BLHisbnd.exe	102

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2760
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1384

C:\Users\Admin\AppData\Local\Temp\ghjkl.exe
"C:\Users\Admin\AppData\Local\Temp\ghjkl.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Users\Admin\AppData\Local\Temp\BLHisbnd.exe
  "C:\Users\Admin\AppData\Local\Temp\BLHisbnd.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4904
- - C:\Users\Admin\AppData\Local\Temp\BLHisbnd.exe
    "C:\Users\Admin\AppData\Local\Temp\BLHisbnd.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1080
- C:\Users\Admin\AppData\Local\Temp\ghjkl.exe
  "C:\Users\Admin\AppData\Local\Temp\ghjkl.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1976
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 448
    3⤵
    - Program crash
    PID:3020
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 340
    3⤵
    - Program crash
    PID:3196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1976 -ip 1976
1⤵
PID:2960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1976 -ip 1976
1⤵
PID:2612

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAVABhAGcAcwAuAGUAeABlADsA
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BLHisbnd.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\BLHisbnd.exe.log
Size 716B
SHA256 3be33b92192f6b439c3b03172670dfd25018b775a0de1bde5f1e81e22a49ab20
MD5 4f9cc40b2bfe17ac6d8f4e67dad23157
SHA1 f3a7e90a2af422f14a8913e2cf03cb5b639fdb18
SHA512 d3d7c1b1fc70cbd7cc4ebe8649bee97a33476e4a0bd67928b124685d793b463208b78982ce592d352ae5a351eaef4d96fde3b02e69860a1c63ab0e53a8a5fa94
MD5 SHA1 SHA512

Submit Download

BLHisbnd.exe

Path C:\Users\Admin\AppData\Local\Temp\BLHisbnd.exe
Size 3.4MB
SHA256 407e9094206a37707a368f4cd0103269c50b8c0c03edba87b4f20664d259f207
MD5 e13e6f7986b9d1eff55fe30133592c40
SHA1 8299d50b76990e9dc7e0a8cc67e2f4d44cb810f5
SHA512 bb41209d410ff38c01279d119f646658e363a3055a4f152b6a2c76b9cdb1fb42441b243fa8f7fb7a353a1b0e78c619e499274185f40d8592e43551da46bd97a6
SSDEEP 49152:ah+AyZk/7aAuRsWflOie87E7E21YoXzIVFoWB41934lyXrToSWIweMpM2Y2viQ2:aFifxNnRmI3R41937XrkSx03Ti9
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_f0f2ywmo.m2c.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_f0f2ywmo.m2c.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/1080-12030-0x0000000005B60000-0x0000000005BB6000-memory.dmp

Download

memory/1080-12029-0x00000000059C0000-0x00000000059C8000-memory.dmp

Download

memory/1080-9814-0x0000000005A00000-0x0000000005AE8000-memory.dmp

Download

memory/1080-12031-0x0000000005E10000-0x0000000005E76000-memory.dmp

Download

memory/1080-9812-0x0000000000400000-0x00000000004AC000-memory.dmp

Download

memory/1384-7181-0x0000000002610000-0x0000000002A10000-memory.dmp

Download

memory/1384-6899-0x0000000002610000-0x0000000002A10000-memory.dmp

Download

memory/1384-6825-0x0000000002610000-0x0000000002A10000-memory.dmp

Download

memory/1976-7581-0x0000000004600000-0x0000000004A00000-memory.dmp

Download

memory/1976-6758-0x0000000004600000-0x0000000004A00000-memory.dmp

Download

memory/1976-6662-0x0000000004600000-0x0000000004A00000-memory.dmp

Download

memory/1976-4905-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2408-38-0x0000000005840000-0x0000000005CEB000-memory.dmp

Download

memory/2408-34-0x0000000005840000-0x0000000005CEB000-memory.dmp

Download

memory/2408-46-0x0000000005840000-0x0000000005CEB000-memory.dmp

Download

memory/2408-44-0x0000000005840000-0x0000000005CEB000-memory.dmp

Download

memory/2408-50-0x0000000005840000-0x0000000005CEB000-memory.dmp

Download

memory/2408-48-0x0000000005840000-0x0000000005CEB000-memory.dmp

Download

memory/2408-42-0x0000000005840000-0x0000000005CEB000-memory.dmp

Download

memory/2408-40-0x0000000005840000-0x0000000005CEB000-memory.dmp

Download

memory/2408-36-0x0000000005840000-0x0000000005CEB000-memory.dmp

Download

memory/2408-32-0x0000000005840000-0x0000000005CEB000-memory.dmp

Download

memory/2408-30-0x0000000005840000-0x0000000005CEB000-memory.dmp

Download

memory/2408-26-0x0000000005840000-0x0000000005CEB000-memory.dmp

Download

memory/2408-22-0x0000000005840000-0x0000000005CEB000-memory.dmp

Download

memory/2408-52-0x0000000005840000-0x0000000005CEB000-memory.dmp

Download

memory/2408-66-0x0000000005840000-0x0000000005CEB000-memory.dmp

Download

memory/2408-64-0x0000000005840000-0x0000000005CEB000-memory.dmp

Download

memory/2408-62-0x0000000005840000-0x0000000005CEB000-memory.dmp

Download

memory/2408-60-0x0000000005840000-0x0000000005CEB000-memory.dmp

Download

memory/2408-58-0x0000000005840000-0x0000000005CEB000-memory.dmp

Download

memory/2408-56-0x0000000005840000-0x0000000005CEB000-memory.dmp

Download

memory/2408-54-0x0000000005840000-0x0000000005CEB000-memory.dmp

Download

memory/2408-4883-0x0000000074C80000-0x0000000075430000-memory.dmp

Download

memory/2408-4884-0x0000000074C80000-0x0000000075430000-memory.dmp

Download

memory/2408-4885-0x0000000007040000-0x000000000732C000-memory.dmp

Download

memory/2408-4886-0x0000000001490000-0x00000000014DC000-memory.dmp

Download

memory/2408-0-0x0000000074C8E000-0x0000000074C8F000-memory.dmp

Download

memory/2408-1-0x00000000007D0000-0x0000000000D2A000-memory.dmp

Download

memory/2408-2-0x0000000005840000-0x0000000005CF0000-memory.dmp

Download

memory/2408-4900-0x0000000001560000-0x00000000015B4000-memory.dmp

Download

memory/2408-28-0x0000000005840000-0x0000000005CEB000-memory.dmp

Download

memory/2408-4899-0x0000000009530000-0x0000000009AD4000-memory.dmp

Download

memory/2408-4907-0x0000000074C80000-0x0000000075430000-memory.dmp

Download

memory/2408-4-0x0000000005840000-0x0000000005CEB000-memory.dmp

Download

memory/2408-24-0x0000000005840000-0x0000000005CEB000-memory.dmp

Download

memory/2408-10-0x0000000005840000-0x0000000005CEB000-memory.dmp

Download

memory/2408-12-0x0000000005840000-0x0000000005CEB000-memory.dmp

Download

memory/2408-15-0x0000000005840000-0x0000000005CEB000-memory.dmp

Download

memory/2408-16-0x0000000005840000-0x0000000005CEB000-memory.dmp

Download

memory/2408-18-0x0000000005840000-0x0000000005CEB000-memory.dmp

Download

memory/2408-3-0x0000000005840000-0x0000000005CEB000-memory.dmp

Download

memory/2408-8-0x0000000005840000-0x0000000005CEB000-memory.dmp

Download

memory/2408-20-0x0000000005840000-0x0000000005CEB000-memory.dmp

Download

memory/2408-7-0x0000000005840000-0x0000000005CEB000-memory.dmp

Download

memory/4112-12038-0x000001F9B9E60000-0x000001F9B9E82000-memory.dmp

Download

memory/4904-9813-0x0000000074C80000-0x0000000075430000-memory.dmp

Download

memory/4904-9807-0x0000000006280000-0x0000000006374000-memory.dmp

Download

memory/4904-9806-0x0000000005B20000-0x0000000005B30000-memory.dmp

Download

memory/4904-4908-0x0000000005B30000-0x0000000005DE8000-memory.dmp

Download

memory/4904-4901-0x0000000074C80000-0x0000000075430000-memory.dmp

Download

memory/4904-4898-0x0000000000FA0000-0x0000000001300000-memory.dmp

Download