rhadamanthys | 12053a39feabd429dedc85c58cf8e8bf7b58136683ec043d85a318094116f92e

Analysis

max time kernel
40s
max time network
40s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
12/10/2024, 02:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
launcher.zip
Size 13.4MB
Sample241012-c8b8msshmq
SHA256 12053a39feabd429dedc85c58cf8e8bf7b58136683ec043d85a318094116f92e
MD5 0d09102590621fdc32d7bdbd302a9e3f
SHA1 4cf577548b6575ff84aeca8a0e9e9a6ced76f4ec
SHA512 0da119520a3138c780d524309eb856413240f2a27bb424c50cebf1db0da5995a1051f70aac04efd5f4555566180e2acee4e25c40c7e812f5a409186b5fcdf8da
SSDEEP 393216:S+d6IiKvpP7FcCzeGno8/8Ms9jdwWJ4ThPVfA:nIIiMuY1no8kaAaPVY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rhadamanthys discovery execution stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4388 created 2944	4388	djneFzBKZY.exe	50

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3300	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4388	djneFzBKZY.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	djneFzBKZY.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
3300	powershell.exe
3300	powershell.exe
3300	powershell.exe
4388	djneFzBKZY.exe
4388	djneFzBKZY.exe
4340	openwith.exe
4340	openwith.exe
4340	openwith.exe
4340	openwith.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeRestorePrivilege	1448	7zFM.exe
Token: 35	1448	7zFM.exe
Token: SeSecurityPrivilege	1448	7zFM.exe
Token: SeDebugPrivilege	3300	powershell.exe
Token: SeIncreaseQuotaPrivilege	3300	powershell.exe
Token: SeSecurityPrivilege	3300	powershell.exe
Token: SeTakeOwnershipPrivilege	3300	powershell.exe
Token: SeLoadDriverPrivilege	3300	powershell.exe
Token: SeSystemProfilePrivilege	3300	powershell.exe
Token: SeSystemtimePrivilege	3300	powershell.exe
Token: SeProfSingleProcessPrivilege	3300	powershell.exe
Token: SeIncBasePriorityPrivilege	3300	powershell.exe
Token: SeCreatePagefilePrivilege	3300	powershell.exe
Token: SeBackupPrivilege	3300	powershell.exe
Token: SeRestorePrivilege	3300	powershell.exe
Token: SeShutdownPrivilege	3300	powershell.exe
Token: SeDebugPrivilege	3300	powershell.exe
Token: SeSystemEnvironmentPrivilege	3300	powershell.exe
Token: SeRemoteShutdownPrivilege	3300	powershell.exe
Token: SeUndockPrivilege	3300	powershell.exe
Token: SeManageVolumePrivilege	3300	powershell.exe
Token: 33	3300	powershell.exe
Token: 34	3300	powershell.exe
Token: 35	3300	powershell.exe
Token: 36	3300	powershell.exe
Token: SeIncreaseQuotaPrivilege	3300	powershell.exe
Token: SeSecurityPrivilege	3300	powershell.exe
Token: SeTakeOwnershipPrivilege	3300	powershell.exe
Token: SeLoadDriverPrivilege	3300	powershell.exe
Token: SeSystemProfilePrivilege	3300	powershell.exe
Token: SeSystemtimePrivilege	3300	powershell.exe
Token: SeProfSingleProcessPrivilege	3300	powershell.exe
Token: SeIncBasePriorityPrivilege	3300	powershell.exe
Token: SeCreatePagefilePrivilege	3300	powershell.exe
Token: SeBackupPrivilege	3300	powershell.exe
Token: SeRestorePrivilege	3300	powershell.exe
Token: SeShutdownPrivilege	3300	powershell.exe
Token: SeDebugPrivilege	3300	powershell.exe
Token: SeSystemEnvironmentPrivilege	3300	powershell.exe
Token: SeRemoteShutdownPrivilege	3300	powershell.exe
Token: SeUndockPrivilege	3300	powershell.exe
Token: SeManageVolumePrivilege	3300	powershell.exe
Token: 33	3300	powershell.exe
Token: 34	3300	powershell.exe
Token: 35	3300	powershell.exe
Token: 36	3300	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1448	7zFM.exe
1448	7zFM.exe
1448	7zFM.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2496	launcher.exe
4388	djneFzBKZY.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 4720	2496	launcher.exe	81
PID 2496 wrote to memory of 4720	2496	launcher.exe	81
PID 4720 wrote to memory of 3300	4720	cmd.exe	82
PID 4720 wrote to memory of 3300	4720	cmd.exe	82
PID 2496 wrote to memory of 428	2496	launcher.exe	84
PID 2496 wrote to memory of 428	2496	launcher.exe	84
PID 428 wrote to memory of 4388	428	cmd.exe	85
PID 428 wrote to memory of 4388	428	cmd.exe	85
PID 428 wrote to memory of 4388	428	cmd.exe	85
PID 4388 wrote to memory of 4340	4388	djneFzBKZY.exe	86
PID 4388 wrote to memory of 4340	4388	djneFzBKZY.exe	86
PID 4388 wrote to memory of 4340	4388	djneFzBKZY.exe	86
PID 4388 wrote to memory of 4340	4388	djneFzBKZY.exe	86
PID 4388 wrote to memory of 4340	4388	djneFzBKZY.exe	86

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
1⤵
PID:2944
- C:\Windows\SysWOW64\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4340

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\launcher.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1448

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1596

C:\Users\Admin\Desktop\launcher\launcher.exe
"C:\Users\Admin\Desktop\launcher\launcher.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData'; Add-MpPreference -ExclusionPath 'C:\ProgramData'""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData'; Add-MpPreference -ExclusionPath 'C:\ProgramData'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Temp\djneFzBKZY.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:428
- - C:\Users\Admin\AppData\Local\Temp\djneFzBKZY.exe
    C:\Users\Admin\AppData\Local\Temp\djneFzBKZY.exe
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_x2fanflx.vzk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_x2fanflx.vzk.ps1
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

djneFzBKZY.exe

Path C:\Users\Admin\AppData\Local\Temp\djneFzBKZY.exe
Size 2.5MB
SHA256 eb8966926eb86c0b7207bcbeb56a8540c88f3b4c002e8778405fb16c645ef286
MD5 0ec4b9b5f2c28fbf2492589a344b8664
SHA1 ec46f875687fbddf48290fd117a40750d510c837
SHA512 95e047410b7ba7a8f929e9d9bec1b7da87c863094651f65b5940d7217faa0101316d019e1965f82ee2cdd7d4004b08f2169a5bf5d9e42df57dfe344f4f24e7f2
SSDEEP 49152:8qlpNm4Bp2nYepwO931BH779cAvWodI2AezUBTwkVZi9QyLdmeDR2sbP+u+S9G+:ZbNzp2RlXveIwNEeypB95Cu+S9G+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3300-10-0x000002AA98680000-0x000002AA986F6000-memory.dmp

Download

memory/3300-7-0x000002AA98550000-0x000002AA98572000-memory.dmp

Download

memory/4340-65-0x0000000002610000-0x0000000002619000-memory.dmp

Download

memory/4340-72-0x0000000077430000-0x00000000775F2000-memory.dmp

Download

memory/4340-70-0x00007FF99AF30000-0x00007FF99B10B000-memory.dmp

Download

memory/4340-68-0x0000000004120000-0x0000000004520000-memory.dmp

Download

memory/4388-60-0x0000000003500000-0x0000000003900000-memory.dmp

Download

memory/4388-64-0x0000000077430000-0x00000000775F2000-memory.dmp

Download

memory/4388-62-0x00007FF99AF30000-0x00007FF99B10B000-memory.dmp

Download

memory/4388-67-0x0000000000400000-0x00000000007F9000-memory.dmp

Download

memory/4388-61-0x0000000003500000-0x0000000003900000-memory.dmp

Download

memory/4388-57-0x0000000000400000-0x00000000007F9000-memory.dmp

Download

memory/4388-56-0x0000000000400000-0x00000000007F9000-memory.dmp

Download