rhadamanthys | f2d043e2159f6d68cbbc22adf3d5aa871fbfcefc571b57565616c981096a2d9e

General

Target

Sunlogin_output.exe
Size

63.6MB
MD5

af61e50d2c391aefd54d6fef36be542d
SHA1

0bd5a47894cf6436e541644ea957d2da6544b78a
SHA256

46379d431e8e4bb7104555ece6dd254b34ad461cca1793d0f7dcd3f7b70de7bf
SHA512

46ce0fd1f135ec19359d5cdb59c3f67dc31104f92d2a97b81a47b3ddd45311564dba49adcf6ea90eec168bca6b68c27b7da67ead648162d5f630332819cc7209
SSDEEP

786432:llOLwxvg0im7xP8tNA7RJlzOob13dT3mBspsQzS/bhu5UI798wJMwmnX0HGR5z:llOLio0r71qAvUob135mzQzpUu/rmZF

Score

10^/10

rhadamanthys discovery stealer upx

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Rhadamanthys family
rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

SunAnquan.exe

description pid process target process

PID 2004 created 1192 2004 SunAnquan.exe Explorer.EXE
Downloads MZ/PE file
Executes dropped EXE 5 IoCs

Processes:

SunAnquan.exeSunloginClient.exeSunAnquan.exeSunloginClient.exeSunAnquan.exe

pid process

1168 SunAnquan.exe
1920 SunloginClient.exe
2004 SunAnquan.exe
1708 SunloginClient.exe
1352 SunAnquan.exe

description	pid	process	target process
PID 2004 created 1192	2004	SunAnquan.exe	Explorer.EXE

pid	process
1168	SunAnquan.exe
1920	SunloginClient.exe
2004	SunAnquan.exe
1708	SunloginClient.exe
1352	SunAnquan.exe

Loads dropped DLL 16 IoCs

Processes:

Sunlogin_output.exeSunAnquan.exeSunAnquan.exeSunAnquan.exe

pid	process
2060	Sunlogin_output.exe
2060	Sunlogin_output.exe
2060	Sunlogin_output.exe
2060	Sunlogin_output.exe
2060	Sunlogin_output.exe
2060	Sunlogin_output.exe
2060	Sunlogin_output.exe
2060	Sunlogin_output.exe
2060	Sunlogin_output.exe
2060	Sunlogin_output.exe
1168	SunAnquan.exe
1168	SunAnquan.exe
2004	SunAnquan.exe
2004	SunAnquan.exe
1352	SunAnquan.exe
1352	SunAnquan.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral3/memory/1920-89-0x0000000000970000-0x0000000006CC2000-memory.dmp	upx
behavioral3/memory/1708-102-0x0000000000970000-0x0000000006CC2000-memory.dmp	upx

Drops file in Program Files directory 6 IoCs

Processes:

Sunlogin_output.exe

description	ioc	process
File created	C:\Program Files (x86)\Sunlogin\SunloginClient.exe	Sunlogin_output.exe
File created	C:\Program Files (x86)\Sunlogin\lua5.1.dll	Sunlogin_output.exe
File created	C:\Program Files (x86)\Sunlogin\SunAnquan.exe	Sunlogin_output.exe
File created	C:\Program Files (x86)\Sunlogin\alien\core.dll	Sunlogin_output.exe
File created	C:\Program Files (x86)\Sunlogin\config.ini	Sunlogin_output.exe
File created	C:\Program Files (x86)\Sunlogin\sun_config.ini	Sunlogin_output.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

SunAnquan.exedialer.exeSunloginClient.exeSunAnquan.exeSunlogin_output.exeSunAnquan.exeSunloginClient.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SunAnquan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dialer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SunloginClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SunAnquan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sunlogin_output.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SunAnquan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SunloginClient.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

Sunlogin_output.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	Sunlogin_output.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Sunlogin_output.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

SunAnquan.exedialer.exe

pid process

2004 SunAnquan.exe
2004 SunAnquan.exe
2000 dialer.exe
2000 dialer.exe
2000 dialer.exe
2000 dialer.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

SunAnquan.exeSunAnquan.exe

description pid process

Token: SeDebugPrivilege 1168 SunAnquan.exe
Token: SeDebugPrivilege 1352 SunAnquan.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

SunloginClient.exe

pid process

1708 SunloginClient.exe

pid	process
2004	SunAnquan.exe
2004	SunAnquan.exe
2000	dialer.exe
2000	dialer.exe
2000	dialer.exe
2000	dialer.exe

description	pid	process
Token: SeDebugPrivilege	1168	SunAnquan.exe
Token: SeDebugPrivilege	1352	SunAnquan.exe

pid	process
1708	SunloginClient.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

Sunlogin_output.exeSunAnquan.exeSunloginClient.exetaskeng.exe

description	pid	process	target process
PID 2060 wrote to memory of 1920	2060	Sunlogin_output.exe	SunloginClient.exe
PID 2060 wrote to memory of 1920	2060	Sunlogin_output.exe	SunloginClient.exe
PID 2060 wrote to memory of 1920	2060	Sunlogin_output.exe	SunloginClient.exe
PID 2060 wrote to memory of 1920	2060	Sunlogin_output.exe	SunloginClient.exe
PID 2060 wrote to memory of 1168	2060	Sunlogin_output.exe	SunAnquan.exe
PID 2060 wrote to memory of 1168	2060	Sunlogin_output.exe	SunAnquan.exe
PID 2060 wrote to memory of 1168	2060	Sunlogin_output.exe	SunAnquan.exe
PID 2060 wrote to memory of 1168	2060	Sunlogin_output.exe	SunAnquan.exe
PID 2060 wrote to memory of 2004	2060	Sunlogin_output.exe	SunAnquan.exe
PID 2060 wrote to memory of 2004	2060	Sunlogin_output.exe	SunAnquan.exe
PID 2060 wrote to memory of 2004	2060	Sunlogin_output.exe	SunAnquan.exe
PID 2060 wrote to memory of 2004	2060	Sunlogin_output.exe	SunAnquan.exe
PID 2004 wrote to memory of 2000	2004	SunAnquan.exe	dialer.exe
PID 2004 wrote to memory of 2000	2004	SunAnquan.exe	dialer.exe
PID 2004 wrote to memory of 2000	2004	SunAnquan.exe	dialer.exe
PID 2004 wrote to memory of 2000	2004	SunAnquan.exe	dialer.exe
PID 2004 wrote to memory of 2000	2004	SunAnquan.exe	dialer.exe
PID 2004 wrote to memory of 2000	2004	SunAnquan.exe	dialer.exe
PID 1920 wrote to memory of 1708	1920	SunloginClient.exe	SunloginClient.exe
PID 1920 wrote to memory of 1708	1920	SunloginClient.exe	SunloginClient.exe
PID 1920 wrote to memory of 1708	1920	SunloginClient.exe	SunloginClient.exe
PID 1920 wrote to memory of 1708	1920	SunloginClient.exe	SunloginClient.exe
PID 1436 wrote to memory of 1352	1436	taskeng.exe	SunAnquan.exe
PID 1436 wrote to memory of 1352	1436	taskeng.exe	SunAnquan.exe
PID 1436 wrote to memory of 1352	1436	taskeng.exe	SunAnquan.exe
PID 1436 wrote to memory of 1352	1436	taskeng.exe	SunAnquan.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1192
- C:\Users\Admin\AppData\Local\Temp\Sunlogin_output.exe
  "C:\Users\Admin\AppData\Local\Temp\Sunlogin_output.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious use of WriteProcessMemory
  PID:2060
- - C:\Program Files (x86)\Sunlogin\SunloginClient.exe
    "C:\Program Files (x86)\Sunlogin\SunloginClient.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1920
  - - C:\Program Files (x86)\Sunlogin\SunloginClient.exe
      "C:\Program Files (x86)\Sunlogin\SunloginClient.exe" --mod=install --admin=1
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1708
- - C:\Program Files (x86)\Sunlogin\SunAnquan.exe
    "C:\Program Files (x86)\Sunlogin\SunAnquan.exe" "C:\Program Files (x86)\Sunlogin\config.ini"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1168
- - C:\Program Files (x86)\Sunlogin\SunAnquan.exe
    "C:\Program Files (x86)\Sunlogin\SunAnquan.exe" "C:\Program Files (x86)\Sunlogin\sun_config.ini"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2004
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2000

C:\Windows\system32\taskeng.exe
taskeng.exe {532D8310-E71C-47D1-80B9-FF3E4CD6D7FF} S-1-5-21-3692679935-4019334568-335155002-1000:BCXRJFKE\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Program Files (x86)\Sunlogin\SunAnquan.exe
  "C:\Program Files (x86)\Sunlogin\SunAnquan.exe" "C:\Program Files (x86)\Sunlogin\config.ini"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Sunlogin\SunAnquan.exe

Filesize
14KB

MD5
426dfd5ece3b41970773031637cd5539

SHA1
d0fe14f8dab89aaddac8b1c89b1cee48396ec636

SHA256
737f08702f00e78dbe78acbeda63b73d04c1f8e741c5282a9aa1409369b6efa8

SHA512
5c66ea3360115d6dcc71f6d624a886f3c992c5d30338880b0ba48db77dd7fa744b60a3d65fed63427ebb3a8bcf9b204e9ba1521d8c9f0e804ce0db76befa8935

Download Submit
C:\Program Files (x86)\Sunlogin\config.ini

Filesize
910KB

MD5
93c7ca328e30b4142f1d7202f864eba7

SHA1
53dac1968204812a95dedea4b923ed3d1e18b5c1

SHA256
01a668544e0bf9ff0ee12f4c090738a8b460c0d183fb4da0169b93d5c02efa7b

SHA512
9c68adcb1736d4c4606dbe512df78cca08ba262024d104edb17ceba7014d21eb26747942f4b92c6b87bec537d781c0c00031b581010b67d5f21a4f34b7581441

Download Submit
C:\Program Files (x86)\Sunlogin\lua5.1.dll

Filesize
164KB

MD5
24a0d2ef5b931a2a13341a2503b1de80

SHA1
6201347d1ded92d365126a1225768e11c33ee818

SHA256
fbbe7ee073d0290ac13c98b92a8405ea04dcc6837b4144889885dd70679e933f

SHA512
5e06f88bb3920cef40a4941efb3b4d3012edf868cc3042f9dbc1989c76b410b4e2da12c20ae2fbcffe5525b43aeca8875e51167d0ce041864d546fdb2e1fecd2

Download Submit
C:\Program Files (x86)\Sunlogin\sun_config.ini

Filesize
636KB

MD5
fb5c9d4258a310e13712a1a4ec63a5b3

SHA1
4c8db46c25b6ef9071dff884bf2a08e17ea4e384

SHA256
d0c667d6b7ed468f409079dff0ba8d8db8b20df71b1cb52c92a400dba8aa8bfe

SHA512
ad24ee048599f3f32876290e1d010be2d45bd1bea4a4bf2e52f74d01481fdd16bab8dda9eeccc965ac1be8337792778556022b6c530fac4cbff79bd87897fd1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\check_sign_test.log

Filesize
280B

MD5
8394de2d276795e5602db0a28da1fa19

SHA1
cb6ffc6e9ee2bae3f8f10cd36032a3d0eb823ef4

SHA256
0fc2261bdb1256e74ff8ca4aa1d413ce584c325fc1e47ccccb3e40876b97a9a1

SHA512
9baca0f3d91b261e8d52498f8bae2eae0164fa7d130e287add3ea31ad4666c79dd6bbd35eb147641ebad909cd1993840c0c405821d0ea34033a33ab7431c91b4

Download Submit
\Program Files (x86)\Sunlogin\alien\core.dll

Filesize
25KB

MD5
24b6950afd8663a46246044e6b09add8

SHA1
6444dab57d93ce987c22da66b3706d5d7fc226da

SHA256
9aa3ca96a84eb5606694adb58776c9e926020ef184828b6f7e6f9b50498f7071

SHA512
e1967e7e8c3d64b61451254da281415edf9946a6c8a46006f39ae091609c65666c376934b1bdcbd2a7f73adea7aa68e557694f804bf3bc3ce7854fa527e91740

Download Submit
\Users\Admin\AppData\Local\Temp\nsuA999.tmp\INetC.dll

Filesize
25KB

MD5
40d7eca32b2f4d29db98715dd45bfac5

SHA1
124df3f617f562e46095776454e1c0c7bb791cc7

SHA256
85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9

SHA512
5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d

Download Submit
memory/1168-94-0x0000000001F60000-0x0000000001F67000-memory.dmp

Filesize
28KB

Download
memory/1168-92-0x0000000004620000-0x0000000004688000-memory.dmp

Filesize
416KB

Download
memory/1708-102-0x0000000000970000-0x0000000006CC2000-memory.dmp

Filesize
99.3MB

Download
memory/1920-89-0x0000000000970000-0x0000000006CC2000-memory.dmp

Filesize
99.3MB

Download
memory/2000-83-0x0000000077C20000-0x0000000077DC9000-memory.dmp

Filesize
1.7MB

Download
memory/2000-80-0x00000000000D0000-0x00000000000D9000-memory.dmp

Filesize
36KB

Download
memory/2000-82-0x0000000001CD0000-0x00000000020D0000-memory.dmp

Filesize
4.0MB

Download
memory/2000-85-0x0000000075FE0000-0x0000000076027000-memory.dmp

Filesize
284KB

Download
memory/2004-79-0x0000000075FE0000-0x0000000076027000-memory.dmp

Filesize
284KB

Download
memory/2004-77-0x0000000077C20000-0x0000000077DC9000-memory.dmp

Filesize
1.7MB

Download
memory/2004-75-0x0000000001CD0000-0x00000000020D0000-memory.dmp

Filesize
4.0MB

Download
memory/2004-74-0x0000000001CD0000-0x00000000020D0000-memory.dmp

Filesize
4.0MB

Download
memory/2004-73-0x0000000000370000-0x0000000000379000-memory.dmp

Filesize
36KB

Download
memory/2060-76-0x00000000047E0000-0x000000000AB32000-memory.dmp

Filesize
99.3MB

Download
memory/2060-101-0x00000000047E0000-0x000000000AB32000-memory.dmp

Filesize
99.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads