rhadamanthys | b8d717274bc433d50448adf0699ab7cd23498023dd105fc009b7cf61b343ce82

General

Target

8Ball-Pool-CHETO-Hack-main/license.dll
Size

1.2MB
MD5

36dea25d49b9dff21acebface8ea2044
SHA1

5bd97162bc98e36c124811c360dbf29c6233405e
SHA256

d960a2eac5e7f1aa04e9f8d0da4eb9bb0b097ca58d0ce83ea1bb8351baf26301
SHA512

64f06db24297e30d7ec91d3cf9ccc33f28eb9041e463933866b09de0d138d964505aa38f32158be5e5491e4aa68d8ae77bccce9c068e5980d2281a24294bccf8
SSDEEP

24576:1iE0l9oS0Cl/9qZPcYJZEiDO3ytIPMunHuGKFufrrH1:YE0l1ZlVsPc06i63aIPZnBX

Score

10^/10

rhadamanthys discovery stealer

Malware Config

Extracted

Family

rhadamanthys

C2

https://185.125.50.38:3034/739bd3e91cd40ca83/lem.api

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

Processes:

CHETO.exeCHETO.exe

description	pid	Process	procid_target
PID 2524 created 2652	2524	CHETO.exe	44
PID 2952 created 2652	2952	CHETO.exe	44

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

CHETO.exedialer.exeCHETO.exedialer.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CHETO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dialer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CHETO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dialer.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

CHETO.exedialer.exeCHETO.exedialer.exe

pid	Process
2524	CHETO.exe
2524	CHETO.exe
3960	dialer.exe
3960	dialer.exe
3960	dialer.exe
3960	dialer.exe
2952	CHETO.exe
2952	CHETO.exe
2212	dialer.exe
2212	dialer.exe
2212	dialer.exe
2212	dialer.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

CHETO.exeCHETO.exe

description	pid	Process	procid_target
PID 2524 wrote to memory of 3960	2524	CHETO.exe	105
PID 2524 wrote to memory of 3960	2524	CHETO.exe	105
PID 2524 wrote to memory of 3960	2524	CHETO.exe	105
PID 2524 wrote to memory of 3960	2524	CHETO.exe	105
PID 2524 wrote to memory of 3960	2524	CHETO.exe	105
PID 2952 wrote to memory of 2212	2952	CHETO.exe	112
PID 2952 wrote to memory of 2212	2952	CHETO.exe	112
PID 2952 wrote to memory of 2212	2952	CHETO.exe	112
PID 2952 wrote to memory of 2212	2952	CHETO.exe	112
PID 2952 wrote to memory of 2212	2952	CHETO.exe	112

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2652
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3960
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2212

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8Ball-Pool-CHETO-Hack-main\license.dll,#1
1⤵
PID:5020

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4836

C:\Users\Admin\Desktop\8Ball-Pool-CHETO-Hack-main\CHETO.exe
"C:\Users\Admin\Desktop\8Ball-Pool-CHETO-Hack-main\CHETO.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2524

C:\Users\Admin\Desktop\8Ball-Pool-CHETO-Hack-main\CHETO.exe
"C:\Users\Admin\Desktop\8Ball-Pool-CHETO-Hack-main\CHETO.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2212-28-0x0000000075750000-0x0000000075965000-memory.dmp

Filesize
2.1MB

Download
memory/2212-26-0x00007FF9186B0000-0x00007FF9188A5000-memory.dmp

Filesize
2.0MB

Download
memory/2212-25-0x0000000002C20000-0x0000000003020000-memory.dmp

Filesize
4.0MB

Download
memory/2524-0-0x0000000000D70000-0x0000000000DDD000-memory.dmp

Filesize
436KB

Download
memory/2524-1-0x0000000004100000-0x0000000004500000-memory.dmp

Filesize
4.0MB

Download
memory/2524-2-0x0000000004100000-0x0000000004500000-memory.dmp

Filesize
4.0MB

Download
memory/2524-3-0x0000000004100000-0x0000000004500000-memory.dmp

Filesize
4.0MB

Download
memory/2524-4-0x00007FF9186B0000-0x00007FF9188A5000-memory.dmp

Filesize
2.0MB

Download
memory/2524-5-0x0000000004100000-0x0000000004500000-memory.dmp

Filesize
4.0MB

Download
memory/2524-7-0x0000000075750000-0x0000000075965000-memory.dmp

Filesize
2.1MB

Download
memory/2524-9-0x0000000000D70000-0x0000000000DDD000-memory.dmp

Filesize
436KB

Download
memory/2952-19-0x0000000003FC0000-0x00000000043C0000-memory.dmp

Filesize
4.0MB

Download
memory/2952-20-0x00007FF9186B0000-0x00007FF9188A5000-memory.dmp

Filesize
2.0MB

Download
memory/2952-22-0x0000000075750000-0x0000000075965000-memory.dmp

Filesize
2.1MB

Download
memory/3960-13-0x00007FF9186B0000-0x00007FF9188A5000-memory.dmp

Filesize
2.0MB

Download
memory/3960-16-0x0000000075750000-0x0000000075965000-memory.dmp

Filesize
2.1MB

Download
memory/3960-17-0x0000000002120000-0x0000000002520000-memory.dmp

Filesize
4.0MB

Download
memory/3960-14-0x0000000002120000-0x0000000002520000-memory.dmp

Filesize
4.0MB

Download
memory/3960-11-0x0000000002120000-0x0000000002520000-memory.dmp

Filesize
4.0MB

Download
memory/3960-12-0x0000000002120000-0x0000000002520000-memory.dmp

Filesize
4.0MB

Download
memory/3960-8-0x0000000000110000-0x0000000000119000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads