rhadamanthys | 1390254e815bcf8b165746e61b75c33a67be98a927def1c0dcd9af10da66d9fc

General

Target

s-etup.exe

Score

10^/10

rhadamanthys discovery stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Rhadamanthys family
rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1716 created 1124	1716	s-etup.exe	20

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dialer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	s-etup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	s-etup.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1716	s-etup.exe
1716	s-etup.exe
2808	dialer.exe
2808	dialer.exe
2808	dialer.exe
2808	dialer.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 1716	2372	s-etup.exe	30
PID 2372 wrote to memory of 1716	2372	s-etup.exe	30
PID 2372 wrote to memory of 1716	2372	s-etup.exe	30
PID 2372 wrote to memory of 1716	2372	s-etup.exe	30
PID 2372 wrote to memory of 1716	2372	s-etup.exe	30
PID 2372 wrote to memory of 1716	2372	s-etup.exe	30
PID 1716 wrote to memory of 2808	1716	s-etup.exe	31
PID 1716 wrote to memory of 2808	1716	s-etup.exe	31
PID 1716 wrote to memory of 2808	1716	s-etup.exe	31
PID 1716 wrote to memory of 2808	1716	s-etup.exe	31
PID 1716 wrote to memory of 2808	1716	s-etup.exe	31
PID 1716 wrote to memory of 2808	1716	s-etup.exe	31

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1124
- C:\Users\Admin\AppData\Local\Temp\s-etup.exe
  "C:\Users\Admin\AppData\Local\Temp\s-etup.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Users\Admin\AppData\Local\Temp\s-etup.exe
    "C:\Users\Admin\AppData\Local\Temp\s-etup.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1716
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1716-32-0x0000000002EA0000-0x00000000032A0000-memory.dmp

Filesize
4.0MB

Download
memory/1716-25-0x0000000002EA0000-0x00000000032A0000-memory.dmp

Filesize
4.0MB

Download
memory/1716-35-0x0000000077741000-0x0000000077842000-memory.dmp

Filesize
1.0MB

Download
memory/1716-8-0x0000000000110000-0x000000000018E000-memory.dmp

Filesize
504KB

Download
memory/1716-31-0x0000000002EA0000-0x00000000032A0000-memory.dmp

Filesize
4.0MB

Download
memory/1716-24-0x0000000002EA0000-0x00000000032A0000-memory.dmp

Filesize
4.0MB

Download
memory/1716-13-0x0000000000110000-0x000000000018E000-memory.dmp

Filesize
504KB

Download
memory/1716-27-0x0000000077740000-0x00000000778E9000-memory.dmp

Filesize
1.7MB

Download
memory/1716-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1716-29-0x0000000076C30000-0x0000000076C77000-memory.dmp

Filesize
284KB

Download
memory/1716-23-0x0000000000110000-0x000000000018E000-memory.dmp

Filesize
504KB

Download
memory/1716-21-0x0000000000110000-0x000000000018E000-memory.dmp

Filesize
504KB

Download
memory/1716-26-0x0000000002EA0000-0x00000000032A0000-memory.dmp

Filesize
4.0MB

Download
memory/2372-22-0x000000001FA36000-0x000000001FA4E000-memory.dmp

Filesize
96KB

Download
memory/2372-1-0x000000001F8AD000-0x000000001F8CC000-memory.dmp

Filesize
124KB

Download
memory/2372-16-0x000000001F8AD000-0x000000001F8CC000-memory.dmp

Filesize
124KB

Download
memory/2372-43-0x000000001F870000-0x000000001FA4E000-memory.dmp

Filesize
1.9MB

Download
memory/2372-5-0x000000001F870000-0x000000001FA4E000-memory.dmp

Filesize
1.9MB

Download
memory/2372-3-0x000000001F870000-0x000000001FA4E000-memory.dmp

Filesize
1.9MB

Download
memory/2372-18-0x000000001FA06000-0x000000001FA32000-memory.dmp

Filesize
176KB

Download
memory/2372-19-0x000000001F870000-0x000000001FA4E000-memory.dmp

Filesize
1.9MB

Download
memory/2372-10-0x000000001F870000-0x000000001FA4E000-memory.dmp

Filesize
1.9MB

Download
memory/2372-0-0x000000001F870000-0x000000001FA4E000-memory.dmp

Filesize
1.9MB

Download
memory/2372-7-0x000000001F870000-0x000000001FA4E000-memory.dmp

Filesize
1.9MB

Download
memory/2372-17-0x000000001FA33000-0x000000001FA4E000-memory.dmp

Filesize
108KB

Download
memory/2372-4-0x000000001F870000-0x000000001FA4E000-memory.dmp

Filesize
1.9MB

Download
memory/2372-6-0x000000001F870000-0x000000001FA4E000-memory.dmp

Filesize
1.9MB

Download
memory/2808-36-0x0000000001E10000-0x0000000002210000-memory.dmp

Filesize
4.0MB

Download
memory/2808-34-0x0000000001E10000-0x0000000002210000-memory.dmp

Filesize
4.0MB

Download
memory/2808-41-0x0000000077741000-0x0000000077842000-memory.dmp

Filesize
1.0MB

Download
memory/2808-40-0x0000000001E10000-0x0000000002210000-memory.dmp

Filesize
4.0MB

Download
memory/2808-39-0x0000000076C30000-0x0000000076C77000-memory.dmp

Filesize
284KB

Download
memory/2808-37-0x0000000077740000-0x00000000778E9000-memory.dmp

Filesize
1.7MB

Download
memory/2808-30-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/2808-42-0x0000000001E10000-0x0000000002210000-memory.dmp

Filesize
4.0MB

Download

Analysis

Sharing