rhadamanthys | ad8a68b30eb57f68ac5114c34d84977986b8a1a861ea1510275ca9135ab69c27

General

Target

ee0a93c22584233cc9faf75b7b49bb78.exe
Size

2.4MB
MD5

ee0a93c22584233cc9faf75b7b49bb78
SHA1

a31b0ac14c81447b71524e2815be43d9a55ea9f1
SHA256

ad8a68b30eb57f68ac5114c34d84977986b8a1a861ea1510275ca9135ab69c27
SHA512

9fab2820bdb0a4e423f66c43105fc1f447d429b6ae525359f0977d034b562ca1a408e728324335f5aced12edd2135660711dd865b3c5fa641b57a02055ee170c
SSDEEP

49152:+pz3Cy3BkrhfRAXMSxDw7DDCDbNV2ZGomxwF2Nz2k+IsvOYIiPcT:+pey3BkrZRAXMwDuDeh4ZGXeUMSevI9

Score

10^/10

rhadamanthys discovery stealer

Malware Config

Extracted

Family

rhadamanthys

C2

https://154.216.19.149:2047/888260cc6af8f/pnmx326i.m7ats

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

explorer.exe

description pid process target process

PID 3188 created 2640 3188 explorer.exe sihost.exe

description	pid	process	target process
PID 3188 created 2640	3188	explorer.exe	sihost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ee0a93c22584233cc9faf75b7b49bb78.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ee0a93c22584233cc9faf75b7b49bb78.exe

Executes dropped EXE 2 IoCs

Processes:

dpaw.exedpaw.exe

pid process

2168 dpaw.exe
116 dpaw.exe
Loads dropped DLL 2 IoCs

Processes:

dpaw.exedpaw.exe

pid process

2168 dpaw.exe
116 dpaw.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

dpaw.exe

description pid process target process

PID 116 set thread context of 1368 116 dpaw.exe cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	pid	process	target process
PID 116 set thread context of 1368	116	dpaw.exe	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

ee0a93c22584233cc9faf75b7b49bb78.exedpaw.exedpaw.execmd.exeexplorer.exeopenwith.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ee0a93c22584233cc9faf75b7b49bb78.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dpaw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dpaw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

dpaw.exedpaw.execmd.exeexplorer.exeopenwith.exe

pid	process
2168	dpaw.exe
116	dpaw.exe
116	dpaw.exe
1368	cmd.exe
1368	cmd.exe
3188	explorer.exe
3188	explorer.exe
4916	openwith.exe
4916	openwith.exe
4916	openwith.exe
4916	openwith.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

dpaw.execmd.exe

pid process

116 dpaw.exe
1368 cmd.exe

pid	process
116	dpaw.exe
1368	cmd.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

ee0a93c22584233cc9faf75b7b49bb78.exedpaw.exedpaw.execmd.exeexplorer.exe

description	pid	process	target process
PID 2464 wrote to memory of 2168	2464	ee0a93c22584233cc9faf75b7b49bb78.exe	dpaw.exe
PID 2464 wrote to memory of 2168	2464	ee0a93c22584233cc9faf75b7b49bb78.exe	dpaw.exe
PID 2464 wrote to memory of 2168	2464	ee0a93c22584233cc9faf75b7b49bb78.exe	dpaw.exe
PID 2168 wrote to memory of 116	2168	dpaw.exe	dpaw.exe
PID 2168 wrote to memory of 116	2168	dpaw.exe	dpaw.exe
PID 2168 wrote to memory of 116	2168	dpaw.exe	dpaw.exe
PID 116 wrote to memory of 1368	116	dpaw.exe	cmd.exe
PID 116 wrote to memory of 1368	116	dpaw.exe	cmd.exe
PID 116 wrote to memory of 1368	116	dpaw.exe	cmd.exe
PID 116 wrote to memory of 1368	116	dpaw.exe	cmd.exe
PID 1368 wrote to memory of 3188	1368	cmd.exe	explorer.exe
PID 1368 wrote to memory of 3188	1368	cmd.exe	explorer.exe
PID 1368 wrote to memory of 3188	1368	cmd.exe	explorer.exe
PID 1368 wrote to memory of 3188	1368	cmd.exe	explorer.exe
PID 3188 wrote to memory of 4916	3188	explorer.exe	openwith.exe
PID 3188 wrote to memory of 4916	3188	explorer.exe	openwith.exe
PID 3188 wrote to memory of 4916	3188	explorer.exe	openwith.exe
PID 3188 wrote to memory of 4916	3188	explorer.exe	openwith.exe
PID 3188 wrote to memory of 4916	3188	explorer.exe	openwith.exe

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2640
- C:\Windows\SysWOW64\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4916

C:\Users\Admin\AppData\Local\Temp\ee0a93c22584233cc9faf75b7b49bb78.exe
"C:\Users\Admin\AppData\Local\Temp\ee0a93c22584233cc9faf75b7b49bb78.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Users\Admin\AppData\Local\Temp\dpaw.exe
  "C:\Users\Admin\AppData\Local\Temp\dpaw.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Users\Admin\AppData\Roaming\BackupstreamEar\dpaw.exe
    C:\Users\Admin\AppData\Roaming\BackupstreamEar\dpaw.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:116
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\SysWOW64\cmd.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:1368
    - - C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\57e2ea52

Filesize
1.1MB

MD5
641565b8fe2349f11c9e134384efc6ff

SHA1
73e41b96c3ae60b773469be3a14e449b3e5e124d

SHA256
caa82b1db2223d6c5d866dffd2fe3317647f70ca4e23b842fa8beb537a6db47b

SHA512
5601263e0a41c7d593b9ebaaf1b25c7028d3cc3bdd08810ae8bbf5d4b3094d41961f12183cb345e32cbc0c74d2513b30cde75d60a806c320341fdae793099fa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\d3dx9_43.dll

Filesize
1.9MB

MD5
4e35791c97152a0c01c6638fd26413fd

SHA1
048c20b2152b4aeb390c276dbf5df3334dba45a7

SHA256
f5bd2c558b6686c8e8c701be3c56108edf5edcaf7bda69ee0407b0829ad09833

SHA512
79a47f194fe68a9da5b882c97bf70ccb0ad944c287ce034b040e1ae7c0f5f78013777731f5352033fe2e2e2026fc0be4aae433bcd980bbd4d18fb5ed3a34af06

Download Submit
C:\Users\Admin\AppData\Local\Temp\dpaw.exe

Filesize
2.7MB

MD5
870feaab725b148208dd12ffabe33f9d

SHA1
9f3651ad5725848c880c24f8e749205a7e1e78c1

SHA256
bbf7154f14d736f0c8491fb9fb44d2f179cdb02d34ab54c04466fa0702ea7d55

SHA512
5bea301f85e6a55fd5730793b960442bc4dab92d0bf47e4e55c5490448a4a22ed6d0feb1dbe9d56d6b6ff8d06f163381807f83f467621f527bc6521857fc8e1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\hdxfld

Filesize
1007KB

MD5
c9a617c1948d7ea4a92cdec95eb0c2a8

SHA1
0d3bab8fae5b47475d8b6aaaf5a13f8ba2ee74d0

SHA256
303cfaaa049a750c2708f75348aa8160e5e40e6cda748f1d406a791a73ac59b7

SHA512
3a39a90238908c9aa5f9ac9fa9a3014cb61a4d9670d8dbe4967366bd594a243719d01887f67b7882e1d9ea9aceac1f1e146c8a93d057baa40c035f8c385bc1cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\kectdmb

Filesize
65KB

MD5
a9bd962417f5f9c7d3ee60059339d41a

SHA1
6872db237f15ce21eefc4182724397806488e8ff

SHA256
23eaeb4e7878be5897aaf9a3c7ab4ca9cb0815f6c2d5fd70c1fe60d1ed3e8dbe

SHA512
731ee69c219f93d3d687d8fc8a18aa50c5676c89ebc41cd0e737426de5780dbcf4f178c449c29d777091b25b236749c5db262116419f28d9c48f068d84941d41

Download Submit
memory/116-36-0x0000000073C80000-0x0000000073DFB000-memory.dmp

Filesize
1.5MB

Download
memory/116-32-0x0000000073C80000-0x0000000073DFB000-memory.dmp

Filesize
1.5MB

Download
memory/116-33-0x00007FFA0D7D0000-0x00007FFA0D9C5000-memory.dmp

Filesize
2.0MB

Download
memory/116-34-0x0000000073C93000-0x0000000073C95000-memory.dmp

Filesize
8KB

Download
memory/116-35-0x0000000073C80000-0x0000000073DFB000-memory.dmp

Filesize
1.5MB

Download
memory/1368-42-0x0000000073C80000-0x0000000073DFB000-memory.dmp

Filesize
1.5MB

Download
memory/1368-38-0x0000000073C80000-0x0000000073DFB000-memory.dmp

Filesize
1.5MB

Download
memory/1368-40-0x00007FFA0D7D0000-0x00007FFA0D9C5000-memory.dmp

Filesize
2.0MB

Download
memory/1368-43-0x0000000073C80000-0x0000000073DFB000-memory.dmp

Filesize
1.5MB

Download
memory/1368-45-0x0000000073C80000-0x0000000073DFB000-memory.dmp

Filesize
1.5MB

Download
memory/2168-20-0x00007FFA0D7D0000-0x00007FFA0D9C5000-memory.dmp

Filesize
2.0MB

Download
memory/2168-19-0x0000000073C80000-0x0000000073DFB000-memory.dmp

Filesize
1.5MB

Download
memory/3188-48-0x0000000000900000-0x000000000097F000-memory.dmp

Filesize
508KB

Download
memory/3188-47-0x00007FFA0D7D0000-0x00007FFA0D9C5000-memory.dmp

Filesize
2.0MB

Download
memory/3188-46-0x0000000000900000-0x000000000097F000-memory.dmp

Filesize
508KB

Download
memory/3188-50-0x0000000000900000-0x000000000097F000-memory.dmp

Filesize
508KB

Download
memory/3188-51-0x0000000003F20000-0x0000000004320000-memory.dmp

Filesize
4.0MB

Download
memory/3188-52-0x0000000003F20000-0x0000000004320000-memory.dmp

Filesize
4.0MB

Download
memory/3188-55-0x0000000075F50000-0x0000000076165000-memory.dmp

Filesize
2.1MB

Download
memory/3188-63-0x0000000000900000-0x000000000097F000-memory.dmp

Filesize
508KB

Download
memory/4916-56-0x0000000000F70000-0x0000000000F79000-memory.dmp

Filesize
36KB

Download
memory/4916-59-0x00007FFA0D7D0000-0x00007FFA0D9C5000-memory.dmp

Filesize
2.0MB

Download
memory/4916-61-0x0000000075F50000-0x0000000076165000-memory.dmp

Filesize
2.1MB

Download
memory/4916-58-0x0000000002DF0000-0x00000000031F0000-memory.dmp

Filesize
4.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads