rhadamanthys | 12053a39feabd429dedc85c58cf8e8bf7b58136683ec043d85a318094116f92e

Analysis

max time kernel
40s
max time network
40s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
12-10-2024 02:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

launcher.zip
Size

13.4MB
MD5

0d09102590621fdc32d7bdbd302a9e3f
SHA1

4cf577548b6575ff84aeca8a0e9e9a6ced76f4ec
SHA256

12053a39feabd429dedc85c58cf8e8bf7b58136683ec043d85a318094116f92e
SHA512

0da119520a3138c780d524309eb856413240f2a27bb424c50cebf1db0da5995a1051f70aac04efd5f4555566180e2acee4e25c40c7e812f5a409186b5fcdf8da
SSDEEP

393216:S+d6IiKvpP7FcCzeGno8/8Ms9jdwWJ4ThPVfA:nIIiMuY1no8kaAaPVY

Score

10^/10

rhadamanthys discovery execution stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4388 created 2944	4388	djneFzBKZY.exe	50

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3300	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4388	djneFzBKZY.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	djneFzBKZY.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
3300	powershell.exe
3300	powershell.exe
3300	powershell.exe
4388	djneFzBKZY.exe
4388	djneFzBKZY.exe
4340	openwith.exe
4340	openwith.exe
4340	openwith.exe
4340	openwith.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeRestorePrivilege	1448	7zFM.exe
Token: 35	1448	7zFM.exe
Token: SeSecurityPrivilege	1448	7zFM.exe
Token: SeDebugPrivilege	3300	powershell.exe
Token: SeIncreaseQuotaPrivilege	3300	powershell.exe
Token: SeSecurityPrivilege	3300	powershell.exe
Token: SeTakeOwnershipPrivilege	3300	powershell.exe
Token: SeLoadDriverPrivilege	3300	powershell.exe
Token: SeSystemProfilePrivilege	3300	powershell.exe
Token: SeSystemtimePrivilege	3300	powershell.exe
Token: SeProfSingleProcessPrivilege	3300	powershell.exe
Token: SeIncBasePriorityPrivilege	3300	powershell.exe
Token: SeCreatePagefilePrivilege	3300	powershell.exe
Token: SeBackupPrivilege	3300	powershell.exe
Token: SeRestorePrivilege	3300	powershell.exe
Token: SeShutdownPrivilege	3300	powershell.exe
Token: SeDebugPrivilege	3300	powershell.exe
Token: SeSystemEnvironmentPrivilege	3300	powershell.exe
Token: SeRemoteShutdownPrivilege	3300	powershell.exe
Token: SeUndockPrivilege	3300	powershell.exe
Token: SeManageVolumePrivilege	3300	powershell.exe
Token: 33	3300	powershell.exe
Token: 34	3300	powershell.exe
Token: 35	3300	powershell.exe
Token: 36	3300	powershell.exe
Token: SeIncreaseQuotaPrivilege	3300	powershell.exe
Token: SeSecurityPrivilege	3300	powershell.exe
Token: SeTakeOwnershipPrivilege	3300	powershell.exe
Token: SeLoadDriverPrivilege	3300	powershell.exe
Token: SeSystemProfilePrivilege	3300	powershell.exe
Token: SeSystemtimePrivilege	3300	powershell.exe
Token: SeProfSingleProcessPrivilege	3300	powershell.exe
Token: SeIncBasePriorityPrivilege	3300	powershell.exe
Token: SeCreatePagefilePrivilege	3300	powershell.exe
Token: SeBackupPrivilege	3300	powershell.exe
Token: SeRestorePrivilege	3300	powershell.exe
Token: SeShutdownPrivilege	3300	powershell.exe
Token: SeDebugPrivilege	3300	powershell.exe
Token: SeSystemEnvironmentPrivilege	3300	powershell.exe
Token: SeRemoteShutdownPrivilege	3300	powershell.exe
Token: SeUndockPrivilege	3300	powershell.exe
Token: SeManageVolumePrivilege	3300	powershell.exe
Token: 33	3300	powershell.exe
Token: 34	3300	powershell.exe
Token: 35	3300	powershell.exe
Token: 36	3300	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1448	7zFM.exe
1448	7zFM.exe
1448	7zFM.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2496	launcher.exe
4388	djneFzBKZY.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 4720	2496	launcher.exe	81
PID 2496 wrote to memory of 4720	2496	launcher.exe	81
PID 4720 wrote to memory of 3300	4720	cmd.exe	82
PID 4720 wrote to memory of 3300	4720	cmd.exe	82
PID 2496 wrote to memory of 428	2496	launcher.exe	84
PID 2496 wrote to memory of 428	2496	launcher.exe	84
PID 428 wrote to memory of 4388	428	cmd.exe	85
PID 428 wrote to memory of 4388	428	cmd.exe	85
PID 428 wrote to memory of 4388	428	cmd.exe	85
PID 4388 wrote to memory of 4340	4388	djneFzBKZY.exe	86
PID 4388 wrote to memory of 4340	4388	djneFzBKZY.exe	86
PID 4388 wrote to memory of 4340	4388	djneFzBKZY.exe	86
PID 4388 wrote to memory of 4340	4388	djneFzBKZY.exe	86
PID 4388 wrote to memory of 4340	4388	djneFzBKZY.exe	86

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
1⤵
PID:2944
- C:\Windows\SysWOW64\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4340

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\launcher.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1448

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1596

C:\Users\Admin\Desktop\launcher\launcher.exe
"C:\Users\Admin\Desktop\launcher\launcher.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData'; Add-MpPreference -ExclusionPath 'C:\ProgramData'""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData'; Add-MpPreference -ExclusionPath 'C:\ProgramData'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Temp\djneFzBKZY.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:428
- - C:\Users\Admin\AppData\Local\Temp\djneFzBKZY.exe
    C:\Users\Admin\AppData\Local\Temp\djneFzBKZY.exe
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_x2fanflx.vzk.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\djneFzBKZY.exe

Filesize
2.5MB

MD5
0ec4b9b5f2c28fbf2492589a344b8664

SHA1
ec46f875687fbddf48290fd117a40750d510c837

SHA256
eb8966926eb86c0b7207bcbeb56a8540c88f3b4c002e8778405fb16c645ef286

SHA512
95e047410b7ba7a8f929e9d9bec1b7da87c863094651f65b5940d7217faa0101316d019e1965f82ee2cdd7d4004b08f2169a5bf5d9e42df57dfe344f4f24e7f2

Download Submit
memory/3300-10-0x000002AA98680000-0x000002AA986F6000-memory.dmp

Filesize
472KB

Download
memory/3300-7-0x000002AA98550000-0x000002AA98572000-memory.dmp

Filesize
136KB

Download
memory/4340-65-0x0000000002610000-0x0000000002619000-memory.dmp

Filesize
36KB

Download
memory/4340-72-0x0000000077430000-0x00000000775F2000-memory.dmp

Filesize
1.8MB

Download
memory/4340-70-0x00007FF99AF30000-0x00007FF99B10B000-memory.dmp

Filesize
1.9MB

Download
memory/4340-68-0x0000000004120000-0x0000000004520000-memory.dmp

Filesize
4.0MB

Download
memory/4388-60-0x0000000003500000-0x0000000003900000-memory.dmp

Filesize
4.0MB

Download
memory/4388-64-0x0000000077430000-0x00000000775F2000-memory.dmp

Filesize
1.8MB

Download
memory/4388-62-0x00007FF99AF30000-0x00007FF99B10B000-memory.dmp

Filesize
1.9MB

Download
memory/4388-67-0x0000000000400000-0x00000000007F9000-memory.dmp

Filesize
4.0MB

Download
memory/4388-61-0x0000000003500000-0x0000000003900000-memory.dmp

Filesize
4.0MB

Download
memory/4388-57-0x0000000000400000-0x00000000007F9000-memory.dmp

Filesize
4.0MB

Download
memory/4388-56-0x0000000000400000-0x00000000007F9000-memory.dmp

Filesize
4.0MB

Download