rhadamanthys | 837f6441b7784d5f83e3b1d883cfe0d1ee2b97b0a6ed23300206120b9ec42030

General

Target

Skript.gg.rar
Size

237KB
MD5

a48d76e6d43a698cfdab6ef51b8ae57d
SHA1

ae04f60ef5ca250ae39a86b74f436a67d1f29eab
SHA256

837f6441b7784d5f83e3b1d883cfe0d1ee2b97b0a6ed23300206120b9ec42030
SHA512

16aad32e95abf3ef745439d9ba79045a0c0c7e6f6a826cf81380a19c7cbe36c3ad97a8e6d277a481cc40f3fc33a5b160b5ff810bc294fb8cbda24c76b143d418
SSDEEP

6144:DGudBq3VvupB/6G1drOj15/I7LzbyobPraYz+MEvg1ILCdj7Nx5:iuPewFdrO15/IyoP2JheZNz

Score

10^/10

rhadamanthys discovery stealer

Malware Config

Extracted

Family

rhadamanthys

C2

https://185.125.50.38:3034/739bd3e91cd40ca83/pancake.api

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Rhadamanthys family
rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 444 created 1968	444	RubixLauncher.exe	49
PID 5176 created 1968	5176	RubixLauncher.exe	49

Executes dropped EXE 2 IoCs

pid	Process
444	RubixLauncher.exe
5176	RubixLauncher.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RubixLauncher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dialer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RubixLauncher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dialer.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
444	RubixLauncher.exe
444	RubixLauncher.exe
4444	dialer.exe
4444	dialer.exe
4444	dialer.exe
4444	dialer.exe
5176	RubixLauncher.exe
5176	RubixLauncher.exe
2508	dialer.exe
2508	dialer.exe
2508	dialer.exe
2508	dialer.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	5448	7zFM.exe
Token: 35	5448	7zFM.exe
Token: SeSecurityPrivilege	5448	7zFM.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5448	7zFM.exe
5448	7zFM.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 444 wrote to memory of 4444	444	RubixLauncher.exe	86
PID 444 wrote to memory of 4444	444	RubixLauncher.exe	86
PID 444 wrote to memory of 4444	444	RubixLauncher.exe	86
PID 444 wrote to memory of 4444	444	RubixLauncher.exe	86
PID 444 wrote to memory of 4444	444	RubixLauncher.exe	86
PID 5176 wrote to memory of 2508	5176	RubixLauncher.exe	88
PID 5176 wrote to memory of 2508	5176	RubixLauncher.exe	88
PID 5176 wrote to memory of 2508	5176	RubixLauncher.exe	88
PID 5176 wrote to memory of 2508	5176	RubixLauncher.exe	88
PID 5176 wrote to memory of 2508	5176	RubixLauncher.exe	88

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:1968
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4444
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2508

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Skript.gg.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5448

C:\Users\Admin\Desktop\RubixLauncher.exe
"C:\Users\Admin\Desktop\RubixLauncher.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:444

C:\Users\Admin\Desktop\RubixLauncher.exe
"C:\Users\Admin\Desktop\RubixLauncher.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\RubixLauncher.exe

Filesize
355KB

MD5
8a6f1580a5b9b94d7cd47cc6b1af1b9a

SHA1
e68768afd59e18091d345cb300e859572e8d4c5c

SHA256
bb1464e75c750d90c0c49d148c9e64eefe0c29b2f670d708c8085ddd3104dbfe

SHA512
1663a9e0868b3f5d7e1edd30259024e419c2d190ec8c31e76e66aef0c8a0e02da0c829584214b9e2f76cbd349a53bf77d01d03e9b0e9c8a99eb18021b1d53309

Download Submit
memory/444-24-0x0000000000C60000-0x0000000000CCD000-memory.dmp

Filesize
436KB

Download
memory/444-3-0x0000000000C60000-0x0000000000CCD000-memory.dmp

Filesize
436KB

Download
memory/444-6-0x0000000003B20000-0x0000000003F20000-memory.dmp

Filesize
4.0MB

Download
memory/444-7-0x0000000003B20000-0x0000000003F20000-memory.dmp

Filesize
4.0MB

Download
memory/444-8-0x00007FFB0F6A0000-0x00007FFB0F8A9000-memory.dmp

Filesize
2.0MB

Download
memory/444-13-0x00007FFB0F6A1000-0x00007FFB0F7CA000-memory.dmp

Filesize
1.2MB

Download
memory/444-10-0x0000000077350000-0x00000000775A2000-memory.dmp

Filesize
2.3MB

Download
memory/444-5-0x0000000003B20000-0x0000000003F20000-memory.dmp

Filesize
4.0MB

Download
memory/444-12-0x0000000003B20000-0x0000000003F20000-memory.dmp

Filesize
4.0MB

Download
memory/2508-36-0x0000000077350000-0x00000000775A2000-memory.dmp

Filesize
2.3MB

Download
memory/2508-34-0x00007FFB0F6A0000-0x00007FFB0F8A9000-memory.dmp

Filesize
2.0MB

Download
memory/2508-33-0x00000000021D0000-0x00000000025D0000-memory.dmp

Filesize
4.0MB

Download
memory/4444-15-0x0000000002A20000-0x0000000002E20000-memory.dmp

Filesize
4.0MB

Download
memory/4444-20-0x00007FFB0F6A1000-0x00007FFB0F7CA000-memory.dmp

Filesize
1.2MB

Download
memory/4444-19-0x0000000002A20000-0x0000000002E20000-memory.dmp

Filesize
4.0MB

Download
memory/4444-22-0x0000000002A20000-0x0000000002E20000-memory.dmp

Filesize
4.0MB

Download
memory/4444-21-0x0000000077350000-0x00000000775A2000-memory.dmp

Filesize
2.3MB

Download
memory/4444-16-0x0000000002A20000-0x0000000002E20000-memory.dmp

Filesize
4.0MB

Download
memory/4444-11-0x0000000000B20000-0x0000000000B29000-memory.dmp

Filesize
36KB

Download
memory/4444-17-0x00007FFB0F6A0000-0x00007FFB0F8A9000-memory.dmp

Filesize
2.0MB

Download
memory/5176-25-0x0000000000C60000-0x0000000000CCD000-memory.dmp

Filesize
436KB

Download
memory/5176-27-0x0000000003870000-0x0000000003C70000-memory.dmp

Filesize
4.0MB

Download
memory/5176-28-0x00007FFB0F6A0000-0x00007FFB0F8A9000-memory.dmp

Filesize
2.0MB

Download
memory/5176-30-0x0000000077350000-0x00000000775A2000-memory.dmp

Filesize
2.3MB

Download

Analysis

Sharing