rhadamanthys | 7e3dd42c629597daed74592793f86bfef82a17c3ba9a31e41208f22acf148f44

General

Target

8c781ac0de45f671ab49a742cd28e8c0N.exe
Size

2.9MB
MD5

8c781ac0de45f671ab49a742cd28e8c0
SHA1

16aebb88d5666725b21c71692d34ebce696e030c
SHA256

7e3dd42c629597daed74592793f86bfef82a17c3ba9a31e41208f22acf148f44
SHA512

931d63ee6e823611412ee4bb710ee0686233a9adc8a12fda0d598ae102f8f929c1ccb28209f8aa588b027152ced0e03ae57d30dcf3e9738e55bfc6d4190fd103
SSDEEP

49152:XwREDDMTow9V3Faw4z0g3QghUTOO6gvdHeMxWrP+beY7UY714:XwREI5f3gDzJQgyTOO6gvdMwZgN

Score

10^/10

rhadamanthys discovery execution stealer

Malware Config

Extracted

Family

rhadamanthys

C2

https://95.217.44.124:7584/335a04be4e97b94a436125e/ldvwm3x2.60ndt

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

GoogleUpdateCore.exe

description	pid	Process	procid_target
PID 2280 created 1216	2280	GoogleUpdateCore.exe	21

Executes dropped EXE 2 IoCs

Processes:

8c781ac0de45f671ab49a742cd28e8c0N.tmpAutoit3.exe

pid	Process
2164	8c781ac0de45f671ab49a742cd28e8c0N.tmp
1028	Autoit3.exe

Loads dropped DLL 2 IoCs

Processes:

8c781ac0de45f671ab49a742cd28e8c0N.exe8c781ac0de45f671ab49a742cd28e8c0N.tmp

pid	Process
2412	8c781ac0de45f671ab49a742cd28e8c0N.exe
2164	8c781ac0de45f671ab49a742cd28e8c0N.tmp

Command and Scripting Interpreter: AutoIT 1 TTPs 1 IoCs

Using AutoIT for possible automate script.

execution

AutoHotKey & AutoIT

T1059.010

Processes:

Autoit3.exe

pid	Process
1028	Autoit3.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Autoit3.exe

description	pid	Process	procid_target
PID 1028 set thread context of 2280	1028	Autoit3.exe	32

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

GoogleUpdateCore.exedialer.exe8c781ac0de45f671ab49a742cd28e8c0N.exe8c781ac0de45f671ab49a742cd28e8c0N.tmpAutoit3.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdateCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dialer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8c781ac0de45f671ab49a742cd28e8c0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8c781ac0de45f671ab49a742cd28e8c0N.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Autoit3.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Autoit3.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Autoit3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Autoit3.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

GoogleUpdateCore.exedialer.exe

pid	Process
2280	GoogleUpdateCore.exe
2280	GoogleUpdateCore.exe
348	dialer.exe
348	dialer.exe
348	dialer.exe
348	dialer.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

8c781ac0de45f671ab49a742cd28e8c0N.exe8c781ac0de45f671ab49a742cd28e8c0N.tmpAutoit3.exeGoogleUpdateCore.exe

description	pid	Process	procid_target
PID 2412 wrote to memory of 2164	2412	8c781ac0de45f671ab49a742cd28e8c0N.exe	30
PID 2412 wrote to memory of 2164	2412	8c781ac0de45f671ab49a742cd28e8c0N.exe	30
PID 2412 wrote to memory of 2164	2412	8c781ac0de45f671ab49a742cd28e8c0N.exe	30
PID 2412 wrote to memory of 2164	2412	8c781ac0de45f671ab49a742cd28e8c0N.exe	30
PID 2412 wrote to memory of 2164	2412	8c781ac0de45f671ab49a742cd28e8c0N.exe	30
PID 2412 wrote to memory of 2164	2412	8c781ac0de45f671ab49a742cd28e8c0N.exe	30
PID 2412 wrote to memory of 2164	2412	8c781ac0de45f671ab49a742cd28e8c0N.exe	30
PID 2164 wrote to memory of 1028	2164	8c781ac0de45f671ab49a742cd28e8c0N.tmp	31
PID 2164 wrote to memory of 1028	2164	8c781ac0de45f671ab49a742cd28e8c0N.tmp	31
PID 2164 wrote to memory of 1028	2164	8c781ac0de45f671ab49a742cd28e8c0N.tmp	31
PID 2164 wrote to memory of 1028	2164	8c781ac0de45f671ab49a742cd28e8c0N.tmp	31
PID 1028 wrote to memory of 2280	1028	Autoit3.exe	32
PID 1028 wrote to memory of 2280	1028	Autoit3.exe	32
PID 1028 wrote to memory of 2280	1028	Autoit3.exe	32
PID 1028 wrote to memory of 2280	1028	Autoit3.exe	32
PID 1028 wrote to memory of 2280	1028	Autoit3.exe	32
PID 1028 wrote to memory of 2280	1028	Autoit3.exe	32
PID 1028 wrote to memory of 2280	1028	Autoit3.exe	32
PID 1028 wrote to memory of 2280	1028	Autoit3.exe	32
PID 1028 wrote to memory of 2280	1028	Autoit3.exe	32
PID 2280 wrote to memory of 348	2280	GoogleUpdateCore.exe	33
PID 2280 wrote to memory of 348	2280	GoogleUpdateCore.exe	33
PID 2280 wrote to memory of 348	2280	GoogleUpdateCore.exe	33
PID 2280 wrote to memory of 348	2280	GoogleUpdateCore.exe	33
PID 2280 wrote to memory of 348	2280	GoogleUpdateCore.exe	33
PID 2280 wrote to memory of 348	2280	GoogleUpdateCore.exe	33

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1216
- C:\Users\Admin\AppData\Local\Temp\8c781ac0de45f671ab49a742cd28e8c0N.exe
  "C:\Users\Admin\AppData\Local\Temp\8c781ac0de45f671ab49a742cd28e8c0N.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2412
- - C:\Users\Admin\AppData\Local\Temp\is-HIO13.tmp\8c781ac0de45f671ab49a742cd28e8c0N.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-HIO13.tmp\8c781ac0de45f671ab49a742cd28e8c0N.tmp" /SL5="$30144,2114521,845824,C:\Users\Admin\AppData\Local\Temp\8c781ac0de45f671ab49a742cd28e8c0N.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2164
  - - C:\Users\Admin\AppData\Local\Temp\is-MH9EI.tmp\Autoit3.exe
      "C:\Users\Admin\AppData\Local\Temp\is-MH9EI.tmp\Autoit3.exe" C:\Users\Admin\AppData\Local\Temp\is-MH9EI.tmp\script.a3x
      4⤵
      Executes dropped EXE
      Command and Scripting Interpreter: AutoIT
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious use of WriteProcessMemory
      PID:1028
    - - C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe"
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2280
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

AutoHotKey & AutoIT

1

T1059.010

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-MH9EI.tmp\script.a3x

Filesize
594KB

MD5
8a35cc6fae1aaeee57c5a46168c76fa6

SHA1
af8bf40b0721b4d150fbcf9a9b3e909a48c42856

SHA256
a204fab99a37fc02e926231c1a758afa4ce8204e139327c90cd89498cd3c3657

SHA512
a8b8c287e52a88df949ece6d3ea41335450b02e9ca4ad9ab929a4c7d14244f10de0a7da2a9b1e9dd5658a3bec6371690de43240f3d59369a3e2721dcaf4735fa

Download Submit
\Users\Admin\AppData\Local\Temp\is-HIO13.tmp\8c781ac0de45f671ab49a742cd28e8c0N.tmp

Filesize
3.2MB

MD5
e587511f17c07622f2e88bde6dc2a499

SHA1
08899e43445db2e0d000b3afd80e028636786eeb

SHA256
9fbf0748b5d890c2c28b1ae20aad7fc23a93cc7a57c4a51220d9381af7637c60

SHA512
2e59d9c525c5383c4ea66c785584aa69256a47ffe928a6595cc2bf07469d2da4dd56dcd3d3d42496e593c39eec6356fc4c8a9cdeee6770c7e6c3319b8b614c6e

Download Submit
\Users\Admin\AppData\Local\Temp\is-MH9EI.tmp\Autoit3.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
memory/348-25-0x00000000000C0000-0x00000000000C9000-memory.dmp

Filesize
36KB

Download
memory/348-27-0x0000000001EE0000-0x00000000022E0000-memory.dmp

Filesize
4.0MB

Download
memory/348-30-0x00000000757C0000-0x0000000075807000-memory.dmp

Filesize
284KB

Download
memory/348-28-0x0000000077650000-0x00000000777F9000-memory.dmp

Filesize
1.7MB

Download
memory/2164-33-0x00000000010C0000-0x0000000001403000-memory.dmp

Filesize
3.3MB

Download
memory/2164-9-0x00000000010C0000-0x0000000001403000-memory.dmp

Filesize
3.3MB

Download
memory/2280-19-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2280-22-0x0000000077650000-0x00000000777F9000-memory.dmp

Filesize
1.7MB

Download
memory/2280-24-0x00000000757C0000-0x0000000075807000-memory.dmp

Filesize
284KB

Download
memory/2280-21-0x0000000002FE0000-0x00000000033E0000-memory.dmp

Filesize
4.0MB

Download
memory/2280-20-0x0000000002FE0000-0x00000000033E0000-memory.dmp

Filesize
4.0MB

Download
memory/2280-18-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2412-0-0x00000000010E0000-0x00000000011BC000-memory.dmp

Filesize
880KB

Download
memory/2412-34-0x00000000010E0000-0x00000000011BC000-memory.dmp

Filesize
880KB

Download
memory/2412-36-0x00000000010E0000-0x00000000011BC000-memory.dmp

Filesize
880KB

Download
memory/2412-2-0x00000000010E1000-0x0000000001189000-memory.dmp

Filesize
672KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads