rhadamanthys | ea08a3b22d711a703d4932a3f0fb693d6faadbd6ad5d87ec7938784c36fb553a

Analysis

max time kernel
93s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 07:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ea08a3b22d711a703d4932a3f0fb693d6faadbd6ad5d87ec7938784c36fb553a.exe
Size 3.9MB
Sample240906-jbaf4stgpc
SHA256 ea08a3b22d711a703d4932a3f0fb693d6faadbd6ad5d87ec7938784c36fb553a
MD5 46cf6b1946429c912fe569ce4b5e8a10
SHA1 d7e0240a1a4d021800ccc9ace9fdb310ffa63052
SHA512 29a1f0c35f6d8beaa3941c120d01b255933edc7b4b7c6f21267ce19d2678ee868ade3e2c1e476704a22acfc0a13b627c755ad474eb960a17cd7725665adeeacf
SSDEEP 98304:sfUbmfIe1hxCTvblT3gbG3WfaWLUMxSZNOWfhL:sfUyzSTBgyGslhL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rhadamanthys discovery stealer

Malware Config

Extracted

Family

rhadamanthys

https://89.117.152.231:443/e0bd9c1f4515facb49/gj28n35o.2n73x

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 684 created 2664	684	explorer.exe	44

Executes dropped EXE 3 IoCs

pid	Process
3896	ea08a3b22d711a703d4932a3f0fb693d6faadbd6ad5d87ec7938784c36fb553a.exe
2368	pythonw.exe
3616	pythonw.exe

Loads dropped DLL 5 IoCs

pid	Process
3896	ea08a3b22d711a703d4932a3f0fb693d6faadbd6ad5d87ec7938784c36fb553a.exe
2368	pythonw.exe
2368	pythonw.exe
3616	pythonw.exe
3616	pythonw.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3616 set thread context of 3868	3616	pythonw.exe	98

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea08a3b22d711a703d4932a3f0fb693d6faadbd6ad5d87ec7938784c36fb553a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea08a3b22d711a703d4932a3f0fb693d6faadbd6ad5d87ec7938784c36fb553a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2368	pythonw.exe
3616	pythonw.exe
3616	pythonw.exe
3868	cmd.exe
3868	cmd.exe
684	explorer.exe
684	explorer.exe
4424	openwith.exe
4424	openwith.exe
4424	openwith.exe
4424	openwith.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3616	pythonw.exe
3868	cmd.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 3896	1880	ea08a3b22d711a703d4932a3f0fb693d6faadbd6ad5d87ec7938784c36fb553a.exe	85
PID 1880 wrote to memory of 3896	1880	ea08a3b22d711a703d4932a3f0fb693d6faadbd6ad5d87ec7938784c36fb553a.exe	85
PID 1880 wrote to memory of 3896	1880	ea08a3b22d711a703d4932a3f0fb693d6faadbd6ad5d87ec7938784c36fb553a.exe	85
PID 3896 wrote to memory of 2368	3896	ea08a3b22d711a703d4932a3f0fb693d6faadbd6ad5d87ec7938784c36fb553a.exe	96
PID 3896 wrote to memory of 2368	3896	ea08a3b22d711a703d4932a3f0fb693d6faadbd6ad5d87ec7938784c36fb553a.exe	96
PID 2368 wrote to memory of 3616	2368	pythonw.exe	97
PID 2368 wrote to memory of 3616	2368	pythonw.exe	97
PID 3616 wrote to memory of 3868	3616	pythonw.exe	98
PID 3616 wrote to memory of 3868	3616	pythonw.exe	98
PID 3616 wrote to memory of 3868	3616	pythonw.exe	98
PID 3616 wrote to memory of 3868	3616	pythonw.exe	98
PID 3868 wrote to memory of 684	3868	cmd.exe	101
PID 3868 wrote to memory of 684	3868	cmd.exe	101
PID 3868 wrote to memory of 684	3868	cmd.exe	101
PID 3868 wrote to memory of 684	3868	cmd.exe	101
PID 684 wrote to memory of 4424	684	explorer.exe	102
PID 684 wrote to memory of 4424	684	explorer.exe	102
PID 684 wrote to memory of 4424	684	explorer.exe	102
PID 684 wrote to memory of 4424	684	explorer.exe	102
PID 684 wrote to memory of 4424	684	explorer.exe	102

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2664
- C:\Windows\SysWOW64\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4424

C:\Users\Admin\AppData\Local\Temp\ea08a3b22d711a703d4932a3f0fb693d6faadbd6ad5d87ec7938784c36fb553a.exe
"C:\Users\Admin\AppData\Local\Temp\ea08a3b22d711a703d4932a3f0fb693d6faadbd6ad5d87ec7938784c36fb553a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\Temp\{28063A81-DF73-4141-B668-DCF7B10FCACF}\.cr\ea08a3b22d711a703d4932a3f0fb693d6faadbd6ad5d87ec7938784c36fb553a.exe
  "C:\Windows\Temp\{28063A81-DF73-4141-B668-DCF7B10FCACF}\.cr\ea08a3b22d711a703d4932a3f0fb693d6faadbd6ad5d87ec7938784c36fb553a.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\ea08a3b22d711a703d4932a3f0fb693d6faadbd6ad5d87ec7938784c36fb553a.exe" -burn.filehandle.attached=532 -burn.filehandle.self=540
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3896
- - C:\Windows\Temp\{1356800F-6F78-4605-BFD0-5A1F47C65107}\.ba\pythonw.exe
    "C:\Windows\Temp\{1356800F-6F78-4605-BFD0-5A1F47C65107}\.ba\pythonw.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2368
  - - C:\Users\Admin\AppData\Roaming\vkb_wordpad_v2\pythonw.exe
      C:\Users\Admin\AppData\Roaming\vkb_wordpad_v2\pythonw.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:3616
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\SysWOW64\cmd.exe
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:3868
      - C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bfc6c227

Path C:\Users\Admin\AppData\Local\Temp\bfc6c227
Size 1.1MB
SHA256 7c89585237bd72df910fc07354f941dd36a9a2163120f4ff8cd8f75189a72287
MD5 4d73e800509a4a8df0e4d9ad66555f0d
SHA1 ba76a16f79dcc097320b486a6fbb198aa21f1a79
SHA512 54fcbd3bbc349a4d3197ef4956a016d579648927885820e6e6879ebc114aea4f1c76101a0021284d65dba259a03b4e10860c268e22c189d039bda933799c2127
SSDEEP 24576:fua8obzE357rJpJjshCS0j2kkY0pahXlu2aWQam5:NEJtECS0ykk3p0vQJ5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jetsam.dll

Path C:\Windows\Temp\{1356800F-6F78-4605-BFD0-5A1F47C65107}\.ba\Jetsam.dll
Size 1.1MB
SHA256 97b3113d73a62755cd99fac73eadb311d1204e6ec1034a85a585955e202e1132
MD5 75b33115ef399463ee76b3421add1ea1
SHA1 1661b9acf1da0aca0c53fee71e5b2394c7c3320d
SHA512 fe86854113de67844fd92904ec8d9468f031ea40bbfd38df79d63ce53bc6e95a0ab5f444b4b85cd9a3c2ac264552366ef7148a8b30a09e8c1b95eb949061ddfc
SSDEEP 24576:1bdNMWL3qaF+PDBVMx4DBcbjzqF6FH9BRh3OYgTRelF2uxiCf6qhTTal1:BdNMWj7FiVMjSMjhJ2uxR6ITTal1
MD5 SHA1 SHA512 SSDEEP

Submit Download

dvanamu

Path C:\Windows\Temp\{1356800F-6F78-4605-BFD0-5A1F47C65107}\.ba\dvanamu
Size 953KB
SHA256 e6275bb0a6bb6fe4eb16d10dc91494535577689d68ff9301ef8471a4277dc552
MD5 e238ccd9fd17fb0007b0b033fcfdad41
SHA1 67f3a4e518be8cc306242f584197deac8cf12534
SHA512 fa439bcbb6956bba23cd702167ea2981dc63d7da1287b64ae8fa39606c1ade752a7e04377325d93a2b76e9c7bf4804e5c739a184fef7e906bcd98f8160436d5c
SSDEEP 24576:zsrGUKOwfGx7yBgbWUgS9A6tMJF1DdvCPUWxKfkngve:zsnw+xaX6OZv/WCBe
MD5 SHA1 SHA512 SSDEEP

Submit Download

python310.dll

Path C:\Windows\Temp\{1356800F-6F78-4605-BFD0-5A1F47C65107}\.ba\python310.dll
Size 4.3MB
SHA256 c1d822a1cd0d204d782d5d5627875608a5acb2008fbfd2346af4f63243e87a40
MD5 c67e805577c808d1b2e63bcc875a6e0c
SHA1 04405071881e4d7b9dae6a8e4f5cb94a69354ecd
SHA512 c17febfe45642bb125b1a80a9e2447b25152ce32034b46d1e8dfa74396e51e3c83fb3f844a3814138b308131292884a104afbc5a2262816bd682d6beca142599
SSDEEP 49152:LxWM30WEuKdhbvd9aCLYjiNME9KnPdZkAMnu08Mwc3MrOEJ8wwoJCzSy4I0mUHJQ:LeV7bkwMVPZ/Hqzt0XHaMZqSH1Vze
MD5 SHA1 SHA512 SSDEEP

Submit Download

pythonw.exe

Path C:\Windows\Temp\{1356800F-6F78-4605-BFD0-5A1F47C65107}\.ba\pythonw.exe
Size 94KB
SHA256 040d121a3179f49cd3f33f4bc998bc8f78b7f560bfd93f279224d69e76a06e92
MD5 9a4cc0d8e7007f7ef20ca585324e0739
SHA1 f3e5a2e477cac4bab85940a2158eed78f2d74441
SHA512 54636a48141804112f5b4f2fc70cb7c959a041e5743aeedb5184091b51daa1d1a03f0016e8299c0d56d924c6c8ae585e4fc864021081ffdf1e6f3eab11dd43b3
SSDEEP 1536:9M/AhIxHHWMpdPa5wiE21M8kJIGFvb1Cwn/ZDs5yf:9M4SwMpdCq/IM8uIGfV/ZDso
MD5 SHA1 SHA512 SSDEEP

Submit Download

tdn

Path C:\Windows\Temp\{1356800F-6F78-4605-BFD0-5A1F47C65107}\.ba\tdn
Size 83KB
SHA256 a9ccf11b8f6bcedff1b7d4eea4d4b2122f7e5ecac119617d0596b92c4ed5aeeb
MD5 8ca8f54b226bfcfa9c2c965c25247a45
SHA1 cb7950efc08e1bc279afb92a8a2173782f34deea
SHA512 d386e769d2a00b3344574e6a251c360d3ec8aa6d7747be19e34deeb57fcb440b24c4fe8b3c0fdc84c99fa4c6e32eb87f4d06ee756fc4e578ca1c9fc32a2e2dbe
SSDEEP 1536:aaPvvRTHJafcoPoGGddrmklGvXb8oKMOunrgOrPGO8NO3hbruXZ:9PxbJXLHWklGzAunrgoP0NO3oXZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcruntime140.dll

Path C:\Windows\Temp\{1356800F-6F78-4605-BFD0-5A1F47C65107}\.ba\vcruntime140.dll
Size 106KB
SHA256 69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc
MD5 49c96cecda5c6c660a107d378fdfc3d4
SHA1 00149b7a66723e3f0310f139489fe172f818ca8e
SHA512 e09e072f3095379b0c921d41d6e64f4f1cd78400594a2317cfb5e5dca03dedb5a8239ed89905c9e967d1acb376b0585a35addf6648422c7ddb472ce38b1ba60d
SSDEEP 1536:BcghDMWyjXZZIzpdbJhKm6Kuzu8fsecbq8uOFQr+zMtY+zA:BVHyQNdbJAKuzRsecbq8uOFvyU
MD5 SHA1 SHA512 SSDEEP

Submit Download

ea08a3b22d711a703d4932a3f0fb693d6faadbd6ad5d87ec7938784c36fb553a.exe

Path C:\Windows\Temp\{28063A81-DF73-4141-B668-DCF7B10FCACF}\.cr\ea08a3b22d711a703d4932a3f0fb693d6faadbd6ad5d87ec7938784c36fb553a.exe
Size 3.9MB
SHA256 ea08a3b22d711a703d4932a3f0fb693d6faadbd6ad5d87ec7938784c36fb553a
MD5 46cf6b1946429c912fe569ce4b5e8a10
SHA1 d7e0240a1a4d021800ccc9ace9fdb310ffa63052
SHA512 29a1f0c35f6d8beaa3941c120d01b255933edc7b4b7c6f21267ce19d2678ee868ade3e2c1e476704a22acfc0a13b627c755ad474eb960a17cd7725665adeeacf
SSDEEP 98304:sfUbmfIe1hxCTvblT3gbG3WfaWLUMxSZNOWfhL:sfUyzSTBgyGslhL
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/684-52-0x0000000075BF0000-0x0000000075E05000-memory.dmp

Download

memory/684-46-0x0000000000BD0000-0x0000000000C50000-memory.dmp

Download

memory/684-55-0x0000000000BD0000-0x0000000000C50000-memory.dmp

Download

memory/684-49-0x0000000004000000-0x0000000004400000-memory.dmp

Download

memory/684-48-0x0000000004000000-0x0000000004400000-memory.dmp

Download

memory/684-44-0x0000000000BD0000-0x0000000000C50000-memory.dmp

Download

memory/684-45-0x00007FFACEFB0000-0x00007FFACF1A5000-memory.dmp

Download

memory/2368-22-0x00007FFAC0020000-0x00007FFAC0192000-memory.dmp

Download

memory/3616-38-0x00007FFAC0020000-0x00007FFAC0192000-memory.dmp

Download

memory/3616-37-0x00007FFAC0020000-0x00007FFAC0192000-memory.dmp

Download

memory/3868-42-0x0000000074F10000-0x000000007508B000-memory.dmp

Download

memory/3868-41-0x00007FFACEFB0000-0x00007FFACF1A5000-memory.dmp

Download

memory/4424-53-0x0000000000F30000-0x0000000000F39000-memory.dmp

Download

memory/4424-57-0x0000000002D60000-0x0000000003160000-memory.dmp

Download

memory/4424-58-0x00007FFACEFB0000-0x00007FFACF1A5000-memory.dmp

Download

memory/4424-60-0x0000000075BF0000-0x0000000075E05000-memory.dmp

Download