rhadamanthys | 689c458a2eff97ed8bda994d4eb86bf4fb9d85fae59557fe2ef1f6b60963d677

General

Target

JaffaCakes118_689c458a2eff97ed8bda994d4eb86bf4fb9d85fae59557fe2ef1f6b60963d677.exe
Size

704.8MB
MD5

9cfe63d830e6f3821ffd5df71a76b268
SHA1

a267e0305fa9a90a0b3461ab4c002eace9bf9cb2
SHA256

689c458a2eff97ed8bda994d4eb86bf4fb9d85fae59557fe2ef1f6b60963d677
SHA512

8bd5cbf130f117d5c8b812206fb84f61d9adf7ea6e0871f091535348203939deb7746416d1d5b30206e73e8409705644d9914ba38e156f68aa4653da14ca9dc9
SSDEEP

49152:yfLu6Wexov67DXJJipU1FGDH8F9ClBX51aqBz0H/wBuLEpqd06GzZ1+WOg/m:ai6Txoi7DmpUOD87qXXWfwB6EpqHG8

Score

10^/10

rhadamanthys discovery stealer

Malware Config

Extracted

Family

rhadamanthys

C2

https://185.17.0.221:3709/96da56a338969138/umtlpn2m.hg4h8

Signatures

Detect rhadamanthys stealer shellcode 4 IoCs

resource	yara_rule
behavioral2/memory/1044-14-0x0000000002C50000-0x0000000003050000-memory.dmp	family_rhadamanthys
behavioral2/memory/1044-16-0x0000000002C50000-0x0000000003050000-memory.dmp	family_rhadamanthys
behavioral2/memory/1044-17-0x0000000002C50000-0x0000000003050000-memory.dmp	family_rhadamanthys
behavioral2/memory/1044-25-0x0000000002C50000-0x0000000003050000-memory.dmp	family_rhadamanthys

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Rhadamanthys family
rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1044 created 3500	1044	lnqhiolrga	56

Executes dropped EXE 1 IoCs

pid	Process
1044	lnqhiolrga

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 956 set thread context of 1044	956	JaffaCakes118_689c458a2eff97ed8bda994d4eb86bf4fb9d85fae59557fe2ef1f6b60963d677.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lnqhiolrga

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1044	lnqhiolrga
1044	lnqhiolrga
1044	lnqhiolrga
1044	lnqhiolrga

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 2088	956	JaffaCakes118_689c458a2eff97ed8bda994d4eb86bf4fb9d85fae59557fe2ef1f6b60963d677.exe	82
PID 956 wrote to memory of 2088	956	JaffaCakes118_689c458a2eff97ed8bda994d4eb86bf4fb9d85fae59557fe2ef1f6b60963d677.exe	82
PID 956 wrote to memory of 2088	956	JaffaCakes118_689c458a2eff97ed8bda994d4eb86bf4fb9d85fae59557fe2ef1f6b60963d677.exe	82
PID 956 wrote to memory of 1044	956	JaffaCakes118_689c458a2eff97ed8bda994d4eb86bf4fb9d85fae59557fe2ef1f6b60963d677.exe	83
PID 956 wrote to memory of 1044	956	JaffaCakes118_689c458a2eff97ed8bda994d4eb86bf4fb9d85fae59557fe2ef1f6b60963d677.exe	83
PID 956 wrote to memory of 1044	956	JaffaCakes118_689c458a2eff97ed8bda994d4eb86bf4fb9d85fae59557fe2ef1f6b60963d677.exe	83
PID 956 wrote to memory of 1044	956	JaffaCakes118_689c458a2eff97ed8bda994d4eb86bf4fb9d85fae59557fe2ef1f6b60963d677.exe	83
PID 956 wrote to memory of 1044	956	JaffaCakes118_689c458a2eff97ed8bda994d4eb86bf4fb9d85fae59557fe2ef1f6b60963d677.exe	83
PID 956 wrote to memory of 1044	956	JaffaCakes118_689c458a2eff97ed8bda994d4eb86bf4fb9d85fae59557fe2ef1f6b60963d677.exe	83
PID 956 wrote to memory of 1044	956	JaffaCakes118_689c458a2eff97ed8bda994d4eb86bf4fb9d85fae59557fe2ef1f6b60963d677.exe	83
PID 956 wrote to memory of 1044	956	JaffaCakes118_689c458a2eff97ed8bda994d4eb86bf4fb9d85fae59557fe2ef1f6b60963d677.exe	83
PID 956 wrote to memory of 1044	956	JaffaCakes118_689c458a2eff97ed8bda994d4eb86bf4fb9d85fae59557fe2ef1f6b60963d677.exe	83
PID 1044 wrote to memory of 1468	1044	lnqhiolrga	88
PID 1044 wrote to memory of 1468	1044	lnqhiolrga	88
PID 1044 wrote to memory of 1468	1044	lnqhiolrga	88
PID 1044 wrote to memory of 1468	1044	lnqhiolrga	88

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3500
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_689c458a2eff97ed8bda994d4eb86bf4fb9d85fae59557fe2ef1f6b60963d677.exe
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_689c458a2eff97ed8bda994d4eb86bf4fb9d85fae59557fe2ef1f6b60963d677.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:956
- - C:\Users\Admin\AppData\Local\Temp\5BBC\wzkpxfxcgh
    "C:\Users\Admin\AppData\Local\Temp\5BBC\wzkpxfxcgh"
    3⤵
    PID:2088
- - C:\Users\Admin\AppData\Local\Temp\eB1CdDdD\lnqhiolrga
    "C:\Users\Admin\AppData\Local\Temp\eB1CdDdD\lnqhiolrga"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1044
- C:\Windows\system32\certreq.exe
  "C:\Windows\system32\certreq.exe"
  2⤵
  PID:1468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\eB1CdDdD\lnqhiolrga

Filesize
1.4MB

MD5
aeb47b393079d8c92169f1ef88dd5696

SHA1
633602bae798867894494717268ca818f923ca18

SHA256
d83494cfb155056118365455f5396401e97bd50a156242f2b5025a44c67095b1

SHA512
7ed48d1bf7e514a736a34842a5a3ed18ade06a304b45c0520bd15c53cb95a8bf997c073030a88c1133c7df6e5ad08f44fe1a89ee90c79499e6fd54ce3fcd1ba0

Download Submit
memory/1044-6-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1044-12-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1044-10-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1044-13-0x0000000001120000-0x0000000001127000-memory.dmp

Filesize
28KB

Download
memory/1044-14-0x0000000002C50000-0x0000000003050000-memory.dmp

Filesize
4.0MB

Download
memory/1044-16-0x0000000002C50000-0x0000000003050000-memory.dmp

Filesize
4.0MB

Download
memory/1044-17-0x0000000002C50000-0x0000000003050000-memory.dmp

Filesize
4.0MB

Download
memory/1044-19-0x0000000003B10000-0x0000000003B46000-memory.dmp

Filesize
216KB

Download
memory/1044-25-0x0000000002C50000-0x0000000003050000-memory.dmp

Filesize
4.0MB

Download
memory/1468-18-0x0000015AA80C0000-0x0000015AA80C3000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing