rhadamanthys | c3159d554310d51982d1eaa16b3b5b87e8b5bc90598fd4f1749596d8bd8c9e4b

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
10-12-2024 03:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c3159d554310d51982d1eaa16b3b5b87e8b5bc90598fd4f1749596d8bd8c9e4b.exe
Size

423KB
MD5

9725864712cc93935c58e8908dfa66d2
SHA1

40db5ea80d64ef64ec45d01c5e53767e44aadec0
SHA256

c3159d554310d51982d1eaa16b3b5b87e8b5bc90598fd4f1749596d8bd8c9e4b
SHA512

33727107b4cd3b52656d0f90c43692bb203fe70ff09f11ea3ff3a91ed0768db4863a6e9e2fd4658a0b9d707c3746fe834e2ded711cd531b981cad67d9146ea19
SSDEEP

6144:YAYM3ZEWqf/qwPF7LR5W8ZJ74zmRiOFBbMh9q/JSW3ChNeK06iiRzmi0F9:YWBqf/qq3R5W8ZB4zmRzba5sViRUF9

Score

10^/10

rhadamanthys discovery stealer

Malware Config

Extracted

Family

rhadamanthys

https://193.124.205.63:7390/1d7c07d7f0b063/xtt6wabb.8qt3e

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Rhadamanthys family
rhadamanthys

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c3159d554310d51982d1eaa16b3b5b87e8b5bc90598fd4f1749596d8bd8c9e4b.exe

C:\Users\Admin\AppData\Local\Temp\c3159d554310d51982d1eaa16b3b5b87e8b5bc90598fd4f1749596d8bd8c9e4b.exe
"C:\Users\Admin\AppData\Local\Temp\c3159d554310d51982d1eaa16b3b5b87e8b5bc90598fd4f1749596d8bd8c9e4b.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3012-0-0x0000000000A10000-0x0000000000A8E000-memory.dmp

Filesize
504KB

Download
memory/3012-1-0x0000000000A10000-0x0000000000A8E000-memory.dmp

Filesize
504KB

Download