rhadamanthys | 689c458a2eff97ed8bda994d4eb86bf4fb9d85fae59557fe2ef1f6b60963d677

General

Target

JaffaCakes118_689c458a2eff97ed8bda994d4eb86bf4fb9d85fae59557fe2ef1f6b60963d677.exe
Size

704.8MB
MD5

9cfe63d830e6f3821ffd5df71a76b268
SHA1

a267e0305fa9a90a0b3461ab4c002eace9bf9cb2
SHA256

689c458a2eff97ed8bda994d4eb86bf4fb9d85fae59557fe2ef1f6b60963d677
SHA512

8bd5cbf130f117d5c8b812206fb84f61d9adf7ea6e0871f091535348203939deb7746416d1d5b30206e73e8409705644d9914ba38e156f68aa4653da14ca9dc9
SSDEEP

49152:yfLu6Wexov67DXJJipU1FGDH8F9ClBX51aqBz0H/wBuLEpqd06GzZ1+WOg/m:ai6Txoi7DmpUOD87qXXWfwB6EpqHG8

Score

10^/10

rhadamanthys discovery stealer

Malware Config

Extracted

Family

rhadamanthys

C2

https://185.17.0.221:3709/96da56a338969138/umtlpn2m.hg4h8

Signatures

Detect rhadamanthys stealer shellcode 5 IoCs

resource	yara_rule
behavioral1/memory/2932-17-0x0000000002380000-0x0000000002780000-memory.dmp	family_rhadamanthys
behavioral1/memory/2932-18-0x0000000002380000-0x0000000002780000-memory.dmp	family_rhadamanthys
behavioral1/memory/2932-19-0x0000000002380000-0x0000000002780000-memory.dmp	family_rhadamanthys
behavioral1/memory/2932-20-0x0000000002380000-0x0000000002780000-memory.dmp	family_rhadamanthys
behavioral1/memory/2932-30-0x0000000002380000-0x0000000002780000-memory.dmp	family_rhadamanthys

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Rhadamanthys family
rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2932 created 1388	2932	vblqaaeshj	20

Executes dropped EXE 1 IoCs

pid	Process
2932	vblqaaeshj

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2124 set thread context of 2932	2124	JaffaCakes118_689c458a2eff97ed8bda994d4eb86bf4fb9d85fae59557fe2ef1f6b60963d677.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vblqaaeshj

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2932	vblqaaeshj
2932	vblqaaeshj
2932	vblqaaeshj
2932	vblqaaeshj

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2932	2124	JaffaCakes118_689c458a2eff97ed8bda994d4eb86bf4fb9d85fae59557fe2ef1f6b60963d677.exe	29
PID 2124 wrote to memory of 2932	2124	JaffaCakes118_689c458a2eff97ed8bda994d4eb86bf4fb9d85fae59557fe2ef1f6b60963d677.exe	29
PID 2124 wrote to memory of 2932	2124	JaffaCakes118_689c458a2eff97ed8bda994d4eb86bf4fb9d85fae59557fe2ef1f6b60963d677.exe	29
PID 2124 wrote to memory of 2932	2124	JaffaCakes118_689c458a2eff97ed8bda994d4eb86bf4fb9d85fae59557fe2ef1f6b60963d677.exe	29
PID 2124 wrote to memory of 2932	2124	JaffaCakes118_689c458a2eff97ed8bda994d4eb86bf4fb9d85fae59557fe2ef1f6b60963d677.exe	29
PID 2124 wrote to memory of 2932	2124	JaffaCakes118_689c458a2eff97ed8bda994d4eb86bf4fb9d85fae59557fe2ef1f6b60963d677.exe	29
PID 2124 wrote to memory of 2932	2124	JaffaCakes118_689c458a2eff97ed8bda994d4eb86bf4fb9d85fae59557fe2ef1f6b60963d677.exe	29
PID 2124 wrote to memory of 2932	2124	JaffaCakes118_689c458a2eff97ed8bda994d4eb86bf4fb9d85fae59557fe2ef1f6b60963d677.exe	29
PID 2124 wrote to memory of 2932	2124	JaffaCakes118_689c458a2eff97ed8bda994d4eb86bf4fb9d85fae59557fe2ef1f6b60963d677.exe	29
PID 2124 wrote to memory of 2932	2124	JaffaCakes118_689c458a2eff97ed8bda994d4eb86bf4fb9d85fae59557fe2ef1f6b60963d677.exe	29
PID 2932 wrote to memory of 2768	2932	vblqaaeshj	31
PID 2932 wrote to memory of 2768	2932	vblqaaeshj	31
PID 2932 wrote to memory of 2768	2932	vblqaaeshj	31
PID 2932 wrote to memory of 2768	2932	vblqaaeshj	31
PID 2932 wrote to memory of 2768	2932	vblqaaeshj	31
PID 2932 wrote to memory of 2768	2932	vblqaaeshj	31

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1388
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_689c458a2eff97ed8bda994d4eb86bf4fb9d85fae59557fe2ef1f6b60963d677.exe
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_689c458a2eff97ed8bda994d4eb86bf4fb9d85fae59557fe2ef1f6b60963d677.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2124
- - C:\Users\Admin\AppData\Local\Temp\3D4B\vblqaaeshj
    "C:\Users\Admin\AppData\Local\Temp\3D4B\vblqaaeshj"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2932
- C:\Windows\system32\certreq.exe
  "C:\Windows\system32\certreq.exe"
  2⤵
  PID:2768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3D4B\vblqaaeshj

Filesize
1.4MB

MD5
aeb47b393079d8c92169f1ef88dd5696

SHA1
633602bae798867894494717268ca818f923ca18

SHA256
d83494cfb155056118365455f5396401e97bd50a156242f2b5025a44c67095b1

SHA512
7ed48d1bf7e514a736a34842a5a3ed18ade06a304b45c0520bd15c53cb95a8bf997c073030a88c1133c7df6e5ad08f44fe1a89ee90c79499e6fd54ce3fcd1ba0

Download Submit
memory/2768-22-0x0000000000060000-0x0000000000063000-memory.dmp

Filesize
12KB

Download
memory/2768-21-0x0000000000060000-0x0000000000063000-memory.dmp

Filesize
12KB

Download
memory/2932-8-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2932-19-0x0000000002380000-0x0000000002780000-memory.dmp

Filesize
4.0MB

Download
memory/2932-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2932-7-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2932-6-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2932-14-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2932-15-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2932-17-0x0000000002380000-0x0000000002780000-memory.dmp

Filesize
4.0MB

Download
memory/2932-18-0x0000000002380000-0x0000000002780000-memory.dmp

Filesize
4.0MB

Download
memory/2932-9-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2932-20-0x0000000002380000-0x0000000002780000-memory.dmp

Filesize
4.0MB

Download
memory/2932-16-0x0000000000100000-0x0000000000107000-memory.dmp

Filesize
28KB

Download
memory/2932-11-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2932-5-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2932-23-0x00000000001B0000-0x00000000001E6000-memory.dmp

Filesize
216KB

Download
memory/2932-29-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2932-30-0x0000000002380000-0x0000000002780000-memory.dmp

Filesize
4.0MB

Download

Analysis

Sharing