rhadamanthys

Sharing

Copy URL Twitter E-mail

General

Target
PartyRoyale.exe
Size 71.2MB
Sample240609-q36rysbb9z
SHA256 0aef1e1f5f8cef19c63977278ca550ae4196d6ea13d51bc706bb64f03ea64ec6
MD5 2a92481eceb13b2bf8beb972891c0bf5
SHA1 cbacca4385818fdbe874e46616119cf0287186c7
SHA512 137861779d51bdb927e6b10939b084526d4ccbcf06128b9abf2fea8c725991c97a0e8952b914036d0e0338409c5b74ea438c1bdad807b0751fe9cfdae1ce8181
SSDEEP 1572864:QFPkJopcN0o63yf5z8wuiNwiwj3CT3JCO+IsuzW0u5Kkk/cMqvN:QF3pcN0o6QB5Nwhj30Jf1NCKr/c5vN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  PartyRoyale.exe
- Size 71.2MB
- SHA256 0aef1e1f5f8cef19c63977278ca550ae4196d6ea13d51bc706bb64f03ea64ec6
- MD5 2a92481eceb13b2bf8beb972891c0bf5
- SHA1 cbacca4385818fdbe874e46616119cf0287186c7
- SHA512 137861779d51bdb927e6b10939b084526d4ccbcf06128b9abf2fea8c725991c97a0e8952b914036d0e0338409c5b74ea438c1bdad807b0751fe9cfdae1ce8181
- SSDEEP 1572864:QFPkJopcN0o63yf5z8wuiNwiwj3CT3JCO+IsuzW0u5Kkk/cMqvN:QF3pcN0o6QB5Nwhj30Jf1NCKr/c5vN
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

rhadamanthys discovery stealer
- Rhadamanthys
  Rhadamanthys is an info stealer written in C++ first seen in August 2022.
  stealer rhadamanthys
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral4
- Target
  LICENSES.chromium.html
- Size 6.5MB
- SHA256 9f3f2b4d9bbd3113486839eca85de119fab766450cdca08a4574b80748885708
- MD5 796505037e030807d9ddd01c93eb353b
- SHA1 79a1eac3b505e6d94a6206d4a5198d3cc11ab038
- SHA512 9435273a4541a579a427a295be47af8b81133896f50c97bab1d8ab391089f90186a7fd057b53e8b74829e4747e98428d8b4d242eb6854b1304a94a2891c2fd11
- SSDEEP 24576:8Pjy5WjWSpgDrAV8gmfwN6i6w6C6g6T+gH3BMbp0W:oJDN
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5
- Target
  PartyRoyaleSetup.exe
- Size 150.7MB
- SHA256 d8e5f1e6a771ed82686aaccb0cfd5a2e39f2a39b9602f6c57bc8f12edc392841
- MD5 05a66b09c2ef3ef85d25a4ed62c68ac5
- SHA1 841501a01e99e9a0f14f2df7c7c1d2a9c583f6a3
- SHA512 b43cf41b66b0de977b6fb29b3b8d625a3fdaa374cc33bd4454561d037b72b61f1ede1837fcd4494f95d754b8d381db9ada3c7ca9b7f376a732f093ba258f127e
- SSDEEP 1572864:tlAhthKM29V6LLWANUB9IinJn1cpGN4vM+JlhrZnQ9I4FdUrczKrk4Ze2OC2+:2tSD64Jnqrt5v2
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral6
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a
- MD5 cb9807f6cf55ad799e920b7e0f97df99
- SHA1 bb76012ded5acd103adad49436612d073d159b29
- SHA512 f7c65bae4ede13616330ae46a197ebad106920dce6a31fd5a658da29ed1473234ca9e2b39cc9833ff903fb6b52ff19e39e6397fac02f005823ed366ca7a34f62
- SSDEEP 49152:IuhjwXkKcimPVqB4faGCMhGNYYpQVTxx6k/ftO4w6FXKpOD21pLeXvZCoFwI8cc:oy904wYbZCoOI85oyI
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7
- Target
  ffmpeg.dll
- Size 2.6MB
- SHA256 aad7e7ac9d74ac18892801950c9728e9c4eacd3b676cbb5d6f63382da2ce0559
- MD5 00ffabbb9438a0da15a021451a9c2d0d
- SHA1 4bb79fe2b09962c6c46b70d7dfb1f9d9604a22dc
- SHA512 989d8d0afd3ce64c65a90d1046f28b19e5b125f8b5a565b76b8c950d152d3b9a57d68126888321c7cd8a4985249c1ec649c453e7501aaa4ff60d9662afd85f34
- SSDEEP 49152:cqMAAYNDEmcTfAZMHkwfPYX6Edxhi1uGaVrFY7Q9b5hpN3lzl3hHLNoJX:cGDfRMHR8rFYU5hNA
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral8
- Target
  libEGL.dll
- Size 473KB
- SHA256 85f238fb7ace3cbdf7c29c72b01307c440f13491b07a509cbc5b9f257a637164
- MD5 ef4291ace01485ee773183ee3c1ed5c4
- SHA1 9c9d32813a733ebceb25c0dbb9f85ef27f6e0a0f
- SHA512 a98bfe1845a712943687f0b20d1904bae1b6836ea37f8a2053872f938dceb2f391fadd3db034c0b8563c0b1ab3d4506d13b613ed51780ef10e813c085c830f82
- SSDEEP 6144:VTv0fq4dz9B4x4w/jvtGW9ZST3BypG48yOnb4pgsHVlAYnReZRO8:VTN4dNw/jvtGW9c3BypaagYnKRO
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral9
- Target
  libGLESv2.dll
- Size 7.2MB
- SHA256 25d49934fc220b169cadeb21fc99dc2a8fb1dd5a4f244265799392f0f5f2f8f8
- MD5 60e42e83b260582fc96aaf43293d99e1
- SHA1 c548a10873f9a57e18c7fbb1fe89685f4cf1ba84
- SHA512 6a905e2b9427fb6e4a53080afdc2ae9dc32c54aab5460f88f7d3fd16e7e9a841d332057f58942d54defe91361a54d3cbedba295399cead754f353f80f92f238b
- SSDEEP 49152:Rs95E5fqF3q/xEpLJgw7yQj1+lSWsucneTA4fwEmN428bbvbgNqay6q/iyGtxJe5:2lq3ZieHhogDbBztUecv7r7frgsOMG
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11
- Target
  vk_swiftshader.dll
- Size 4.9MB
- SHA256 a32c3fbbf74699a10e7642bf4901191f29c88c5aec93ae7ba28c79ab28462a69
- MD5 afb174ccd1abb292da14779a079d4282
- SHA1 ddd74e61c48c4445f1b3fa886b7c28b0de3f1859
- SHA512 fddd4d70dc6b8d424adfa509ad145845d13d898eaedb1706de357cf1dcd4eb25fe581c9dc58c1de0954b1a10b232934d219563a1e2e8ed1bc01412bfc789cbfc
- SSDEEP 49152:/GrnxGr9pGmj8pGtA/bVVku6KZlxsMOtVKOkc4FjHjAW3vZ1B93k1RE7SrLop8cJ:YnxY9NURayzxX61u0Lflb0wrD
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral12
- Target
  vulkan-1.dll
- Size 894KB
- SHA256 1f8b647f161f20d45d554e349b3e5ef0b7b5da8c7bdbc1ff631d37dc9c819503
- MD5 7ba000aece0d376e6f77e4c2f48f69c8
- SHA1 24b103a2d9d5d742783ad3ecbfeb2cc57bd711c6
- SHA512 d051ed9d1b9c28cd38da020cebe8b58da53c520f8686dc08fb9e626a9751c23fc43b97b2c309314e3f9a94f1eea448b77657c955c7b22aaadc6c0753b85f744c
- SSDEEP 12288:3P1VNNJPqXu9D8xeLoCzG4JsZGS5ld/YlmQAuYvyRnsBsoj89C29h:3PXJPq+9QeLpDpmQ/YJBseS9h
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral13
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral14
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral15
- Target
  $R0/Uninstall PartyRoyaleSetup.exe
- Size 523KB
- SHA256 ea832e2a71b0efc6b6585a2cb4df3a075bd91dc6abdd0c9763968ab0bfec41b2
- MD5 245c28184e590c2e868e8b4fe49612e8
- SHA1 b901d44e568a5c6552ff0fa3d1f59bfbf2225107
- SHA512 6c5d4685f1cb2e8a90b8729303678fa695ac49fe7ed9bd7780c0c7f3660ba99e26805a968b2381cf2f49104c93495adee2b5bfe0132df971e608cb72ba82f9cd
- SSDEEP 12288:sKD2mx+D04QlBxyuIk+22FMumSLr+O4NRKJR:sKD2mx34uBxXIk+2+MumSXOMT
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral16
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral17
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral18
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- MD5 SHA1 SHA512
Score

3^/10
behavioral19
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral20

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Suspicious use of NtCreateUserProcessOtherParentProcess

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Suspicious use of SetThreadContext

Checks computer location settings

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20