rhadamanthys | 6cd031908922840ee684d3c05294e7e071b500915b760c474f22c1def0df14bc

Resubmissions

30-08-2024 02:12

240830-cm66wstfkp 10

27-08-2024 16:07

240827-tkmg5sygqb 10

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27-08-2024 16:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

2.5MB
MD5

61d31fb13c1dd46fcb03caf7f648508c
SHA1

ecd46d1e09bdfa50c1587690e70262bc14ba751c
SHA256

6cd031908922840ee684d3c05294e7e071b500915b760c474f22c1def0df14bc
SHA512

c0a20fd176c812f47902da3da6b1bbde8924218666752be985245a5bb804c943a9312550d110f3a95096042991ef8cec9b1931377e4a8d09781c406b9da31127
SSDEEP

49152:+pz3Y5ANfs2/w8JUgyUBx8pQIVf/OV9UdOV8ZUhJgnVlz2sTyNy:+pk5Am2/w8J9L8pQIVf/OMO277z9TWy

Score

10^/10

rhadamanthys xworm discovery rat stealer trojan

Malware Config

Extracted

Family

rhadamanthys

https://154.216.19.149:2047/888260cc6af8f/07djb4gj.jifud

Extracted

Family

xworm

Version

5.0

Mutex

TN3sSNYI1fDMFOs2

Attributes

install_file
USB.exe
pastebin_url
https://pastebin.com/raw/jxfGm9Pc

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4528-76-0x0000000000540000-0x000000000054E000-memory.dmp	family_xworm

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

V3.exe

description	pid	Process	procid_target
PID 2264 created 2620	2264	V3.exe	44

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

file.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	file.exe

Executes dropped EXE 2 IoCs

Processes:

SendBugReportNew.exeV3.exe

pid	Process
2108	SendBugReportNew.exe
2264	V3.exe

Loads dropped DLL 5 IoCs

Processes:

SendBugReportNew.exe

pid	Process
2108	SendBugReportNew.exe
2108	SendBugReportNew.exe
2108	SendBugReportNew.exe
2108	SendBugReportNew.exe
2108	SendBugReportNew.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

Processes:

flow	ioc
55	pastebin.com
56	pastebin.com

Suspicious use of SetThreadContext 2 IoCs

Processes:

SendBugReportNew.execmd.exe

description	pid	Process	procid_target
PID 2108 set thread context of 3232	2108	SendBugReportNew.exe	94
PID 3232 set thread context of 4528	3232	cmd.exe	100

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

timeout.exefile.exeSendBugReportNew.exeV3.exeopenwith.execmd.exeMSBuild.execmd.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SendBugReportNew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	V3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Delays execution with timeout.exe 1 IoCs

evasion

Processes:

timeout.exe

pid	Process
4832	timeout.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

SendBugReportNew.exeV3.exeopenwith.execmd.exe

pid	Process
2108	SendBugReportNew.exe
2108	SendBugReportNew.exe
2264	V3.exe
2264	V3.exe
4304	openwith.exe
4304	openwith.exe
4304	openwith.exe
4304	openwith.exe
3232	cmd.exe

Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

SendBugReportNew.execmd.exe

pid	Process
2108	SendBugReportNew.exe
3232	cmd.exe
3232	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MSBuild.exe

description	pid	Process
Token: SeDebugPrivilege	4528	MSBuild.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

file.exeSendBugReportNew.exeV3.execmd.exeMSBuild.execmd.exe

description	pid	Process	procid_target
PID 5092 wrote to memory of 2108	5092	file.exe	86
PID 5092 wrote to memory of 2108	5092	file.exe	86
PID 5092 wrote to memory of 2108	5092	file.exe	86
PID 2108 wrote to memory of 2264	2108	SendBugReportNew.exe	88
PID 2108 wrote to memory of 2264	2108	SendBugReportNew.exe	88
PID 2108 wrote to memory of 2264	2108	SendBugReportNew.exe	88
PID 2264 wrote to memory of 4304	2264	V3.exe	91
PID 2264 wrote to memory of 4304	2264	V3.exe	91
PID 2264 wrote to memory of 4304	2264	V3.exe	91
PID 2264 wrote to memory of 4304	2264	V3.exe	91
PID 2264 wrote to memory of 4304	2264	V3.exe	91
PID 2108 wrote to memory of 3232	2108	SendBugReportNew.exe	94
PID 2108 wrote to memory of 3232	2108	SendBugReportNew.exe	94
PID 2108 wrote to memory of 3232	2108	SendBugReportNew.exe	94
PID 2108 wrote to memory of 3232	2108	SendBugReportNew.exe	94
PID 3232 wrote to memory of 4528	3232	cmd.exe	100
PID 3232 wrote to memory of 4528	3232	cmd.exe	100
PID 3232 wrote to memory of 4528	3232	cmd.exe	100
PID 3232 wrote to memory of 4528	3232	cmd.exe	100
PID 3232 wrote to memory of 4528	3232	cmd.exe	100
PID 4528 wrote to memory of 2868	4528	MSBuild.exe	111
PID 4528 wrote to memory of 2868	4528	MSBuild.exe	111
PID 4528 wrote to memory of 2868	4528	MSBuild.exe	111
PID 2868 wrote to memory of 4832	2868	cmd.exe	113
PID 2868 wrote to memory of 4832	2868	cmd.exe	113
PID 2868 wrote to memory of 4832	2868	cmd.exe	113

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2620
- C:\Windows\SysWOW64\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4304

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Users\Admin\AppData\Local\Temp\SendBugReportNew.exe
  "C:\Users\Admin\AppData\Local\Temp\SendBugReportNew.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2108
- - C:\Users\Admin\AppData\Roaming\Javaoraclev4\HDBTKQHRKUSOGLYOV\V3.exe
    C:\Users\Admin\AppData\Roaming\Javaoraclev4\HDBTKQHRKUSOGLYOV\V3.exe
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2264
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe
    3⤵
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:3232
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4528
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp3D8C.tmp.bat""
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2868
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout 3
        6⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:4832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SendBugReportNew.exe

Filesize
1.3MB

MD5
58717509c1521eacfcc7cda39e6bd45c

SHA1
5102dc3a82e8a2710ac67521f85f43f5296b5045

SHA256
d76d0650b630fdb70756a446e0a43672b5da1c2a74014118b02133923305da9a

SHA512
c637c2960b8a0bc111b408af05a0879d9a10f05d802ee7b8b9f115cb54606f76f4475375cecfa9fdb0518be0340b2c5bd23f8fe100dc21db88287a9227c0e69f

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd3540ba

Filesize
1.1MB

MD5
940c6a234efdd0b17d9c1c852a02f789

SHA1
74d0b0b0d1032f0bec1a80fa05d8b372372e3c19

SHA256
b64ff2da8e66b006d77b480c83a33b2c5dadbb67cd0dd78eead9242070b0374d

SHA512
55f704a486dae2759409c8474b9b3062187cea5746101b2b9679f6cd337d066889b7a06f4d1bf4a4c16e53942c5e2a9a8c1799428581fb85b0bb077af90f78e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\mvyvk

Filesize
960KB

MD5
6fd4005525f3029cd0e664e5729f048d

SHA1
bcdd6ed97c89c33e24f15cc76ddf6a8db9136218

SHA256
20353143a20e7962473b12a4614b0874327c130a309f6d7b15ac5fd7214c2d13

SHA512
0cf2a9abc6d92628c226e0d86203532105234be5e0bb519f8a7f564f3c4b5514e6f3a682ec1ee16a61aff34afc2a26110b9e0b8bdfa191ee7c1f7f0a16d9eeb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nfsxtmg

Filesize
31KB

MD5
8ade14406162e1acd567b99843aeafb9

SHA1
76886ab3d6c8c62a9b5fc9d3785b4395e0a75678

SHA256
a465457514e861e867729368e650b69861e4c8a3ec547a30e67b3aec77599724

SHA512
bde1333a1cd35cb3c24db0055d1f761f966c68ef3a1b7060aa204f07813b0b697c6dc6700736804d05e41be15367493a13e1a9897cc5aa5ef1bc831dc6618905

Download Submit
C:\Users\Admin\AppData\Local\Temp\rtl120.bpl

Filesize
1.0MB

MD5
c80f3b711d04c486ccdf3740689b3569

SHA1
c8724122282a018f8fb9f8775d0615311da4fd70

SHA256
a4df6624a65c83002e97d81d96bd85c3b1370129c486bd43cb399e76a6e4d393

SHA512
e977a1118b3b94fdac13073e9c60f8e43531cd8f0136f60774fd891175815c3839a316aef496d6e5c3038cc119dd936356b1d01c521e3bc9c1c01f1be998d4b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp3D8C.tmp.bat

Filesize
171B

MD5
41068b8af397d9ca6de3b90b026472d7

SHA1
bcef63ad7e29e58462447e9aac143adbea2d8ccf

SHA256
7bf3017940ebabbc8d8842aba5ca296d71a981ea55a366c65768f43da8789bbb

SHA512
fecee60787b6aea0859aa2a55390cc3a47005767d495a5610de3c5bbc75e3187b2bc133c7cfe6206181dda7c63099146c1fdfb94464c9809f57f8c0877f3053a

Download Submit
C:\Users\Admin\AppData\Local\Temp\vcl120.bpl

Filesize
1.9MB

MD5
9a438a75e68e88cdabc13074a17f8a52

SHA1
97c94801d37d249ece7ba9aca05703303fd9cf06

SHA256
ccccadde7393f1b624cde32b38274e60bbe65b1769d614d129babdaeef9a6715

SHA512
19d260505972b96c2e5ae0058a29f61e606e276779a80732dbee70f9223dbff51dcb1f5e4eff19206c300ee08e6060987171f5b83ad87fdd8f797e0e2db529fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\vclx120.bpl

Filesize
223KB

MD5
8aaa3926885b3fa7ae0448f5e700cb79

SHA1
47bd7d281ddde5ebef8599482212743bf2f7e67b

SHA256
47396c301fbe78bfaf9e344936a0f7a4e6d174c096f847e160d822e48012162d

SHA512
86d395ca89ec2a988f035ecb32640ddac99247e2568673246388fe310e8c3a44807049e8f3482fae86c453d5e3529a8f2daf8614a1086b6d979e64fd917bbe3a

Download Submit
C:\Users\Admin\AppData\Roaming\Javaoraclev4\HDBTKQHRKUSOGLYOV\V3.exe

Filesize
423KB

MD5
ae36397a23d16920ddfe4dfec24f6b85

SHA1
49f1edaf5af83457fc10d1e73680b59202057e28

SHA256
e36bbdf75e56c4d0562ba5aba9e78d483a6196fe1ec891cc71ef9db5556c9c81

SHA512
7642e0509969b1de936f6f30a7a899bceda2dda526759911f2ff47bd32002dc992322d02347d26dfd3eb0594922f068bf9be20bb760ce08a006f64d78781d0c3

Download Submit
memory/2108-36-0x0000000074200000-0x000000007437B000-memory.dmp

Filesize
1.5MB

Download
memory/2108-38-0x0000000074200000-0x000000007437B000-memory.dmp

Filesize
1.5MB

Download
memory/2108-60-0x0000000074200000-0x000000007437B000-memory.dmp

Filesize
1.5MB

Download
memory/2108-37-0x0000000074213000-0x0000000074214000-memory.dmp

Filesize
4KB

Download
memory/2108-34-0x00007FFDA3CB0000-0x00007FFDA3EA5000-memory.dmp

Filesize
2.0MB

Download
memory/2108-63-0x0000000000400000-0x0000000000585000-memory.dmp

Filesize
1.5MB

Download
memory/2108-33-0x0000000074200000-0x000000007437B000-memory.dmp

Filesize
1.5MB

Download
memory/2108-64-0x0000000050000000-0x0000000050116000-memory.dmp

Filesize
1.1MB

Download
memory/2108-65-0x0000000050120000-0x000000005030D000-memory.dmp

Filesize
1.9MB

Download
memory/2108-66-0x0000000050310000-0x0000000050349000-memory.dmp

Filesize
228KB

Download
memory/2264-41-0x0000000000960000-0x00000000009DE000-memory.dmp

Filesize
504KB

Download
memory/2264-49-0x00000000038A0000-0x0000000003CA0000-memory.dmp

Filesize
4.0MB

Download
memory/2264-54-0x0000000000960000-0x00000000009DE000-memory.dmp

Filesize
504KB

Download
memory/2264-43-0x00000000038A0000-0x0000000003CA0000-memory.dmp

Filesize
4.0MB

Download
memory/2264-44-0x00000000038A0000-0x0000000003CA0000-memory.dmp

Filesize
4.0MB

Download
memory/2264-45-0x00000000038A0000-0x0000000003CA0000-memory.dmp

Filesize
4.0MB

Download
memory/2264-46-0x00007FFDA3CB0000-0x00007FFDA3EA5000-memory.dmp

Filesize
2.0MB

Download
memory/2264-48-0x0000000076510000-0x0000000076725000-memory.dmp

Filesize
2.1MB

Download
memory/3232-71-0x0000000074200000-0x000000007437B000-memory.dmp

Filesize
1.5MB

Download
memory/3232-68-0x00007FFDA3CB0000-0x00007FFDA3EA5000-memory.dmp

Filesize
2.0MB

Download
memory/4304-55-0x00007FFDA3CB0000-0x00007FFDA3EA5000-memory.dmp

Filesize
2.0MB

Download
memory/4304-50-0x0000000000FA0000-0x0000000000FA9000-memory.dmp

Filesize
36KB

Download
memory/4304-59-0x0000000002D00000-0x0000000003100000-memory.dmp

Filesize
4.0MB

Download
memory/4304-52-0x0000000002D00000-0x0000000003100000-memory.dmp

Filesize
4.0MB

Download
memory/4304-58-0x0000000076510000-0x0000000076725000-memory.dmp

Filesize
2.1MB

Download
memory/4304-57-0x0000000002D00000-0x0000000003100000-memory.dmp

Filesize
4.0MB

Download
memory/4304-53-0x0000000002D00000-0x0000000003100000-memory.dmp

Filesize
4.0MB

Download
memory/4528-76-0x0000000000540000-0x000000000054E000-memory.dmp

Filesize
56KB

Download
memory/4528-77-0x0000000004E90000-0x0000000004F2C000-memory.dmp

Filesize
624KB

Download
memory/4528-78-0x0000000005B70000-0x0000000005BD6000-memory.dmp

Filesize
408KB

Download
memory/4528-79-0x00000000067F0000-0x0000000006882000-memory.dmp

Filesize
584KB

Download
memory/4528-80-0x0000000006E40000-0x00000000073E4000-memory.dmp

Filesize
5.6MB

Download
memory/4528-81-0x0000000000590000-0x000000000059C000-memory.dmp

Filesize
48KB

Download
memory/4528-73-0x0000000072CD0000-0x0000000073F24000-memory.dmp

Filesize
18.3MB

Download