rhadamanthys | 92f15aca3c8a18dc413b61ae62fa88f601c1a3d7d5d682c1384c0229396da603

General

Target

quanto.exe.bin.exe
Size

4.6MB
MD5

8903a3a26cd448747ae51dc64e359211
SHA1

198b3ea699183d292e95748300acc176773f6834
SHA256

92f15aca3c8a18dc413b61ae62fa88f601c1a3d7d5d682c1384c0229396da603
SHA512

4cbaa5e0c267f39baa8f9e07d6c13563ce25b7c4f8ef474388588bf9868d56713ebc663eaecfdb134aadc6d2e8e3802dff10c3ba5f86f335b42d813ff066bc5b
SSDEEP

98304:MKaAh0jTZCMVjTec6LVdMi8SJblSEbWAj3FUn3v8n9VuIf9u3:/laRCMVa7dP82lSuzBkq/uIU3

Score

10^/10

Malware Config

Signatures

Detects Rhadamanthys payload 3 IoCs

resource	yara_rule
behavioral2/memory/5924-47-0x0000000000EB0000-0x0000000000F33000-memory.dmp	Rhadamanthys_v8
behavioral2/memory/5924-49-0x0000000000EB0000-0x0000000000F33000-memory.dmp	Rhadamanthys_v8
behavioral2/memory/5924-59-0x0000000000EB0000-0x0000000000F33000-memory.dmp	Rhadamanthys_v8

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Rhadamanthys family
rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 5924 created 2512	5924	explorer.exe	44

Executes dropped EXE 3 IoCs

pid	Process
3600	quanto.exe.bin.exe
2220	WiseTurbo.exe
532	WiseTurbo.exe

Loads dropped DLL 3 IoCs

pid	Process
3600	quanto.exe.bin.exe
2220	WiseTurbo.exe
532	WiseTurbo.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 532 set thread context of 4036	532	WiseTurbo.exe	94

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	quanto.exe.bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	quanto.exe.bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WiseTurbo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WiseTurbo.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2220	WiseTurbo.exe
532	WiseTurbo.exe
532	WiseTurbo.exe
4036	cmd.exe
4036	cmd.exe
5924	explorer.exe
5924	explorer.exe
5924	explorer.exe
5924	explorer.exe
4564	svchost.exe
4564	svchost.exe
4564	svchost.exe
4564	svchost.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
532	WiseTurbo.exe
4036	cmd.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 3600	1668	quanto.exe.bin.exe	86
PID 1668 wrote to memory of 3600	1668	quanto.exe.bin.exe	86
PID 1668 wrote to memory of 3600	1668	quanto.exe.bin.exe	86
PID 3600 wrote to memory of 2220	3600	quanto.exe.bin.exe	88
PID 3600 wrote to memory of 2220	3600	quanto.exe.bin.exe	88
PID 3600 wrote to memory of 2220	3600	quanto.exe.bin.exe	88
PID 2220 wrote to memory of 532	2220	WiseTurbo.exe	92
PID 2220 wrote to memory of 532	2220	WiseTurbo.exe	92
PID 2220 wrote to memory of 532	2220	WiseTurbo.exe	92
PID 532 wrote to memory of 4036	532	WiseTurbo.exe	94
PID 532 wrote to memory of 4036	532	WiseTurbo.exe	94
PID 532 wrote to memory of 4036	532	WiseTurbo.exe	94
PID 532 wrote to memory of 4036	532	WiseTurbo.exe	94
PID 4036 wrote to memory of 5924	4036	cmd.exe	114
PID 4036 wrote to memory of 5924	4036	cmd.exe	114
PID 4036 wrote to memory of 5924	4036	cmd.exe	114
PID 4036 wrote to memory of 5924	4036	cmd.exe	114
PID 5924 wrote to memory of 4564	5924	explorer.exe	116
PID 5924 wrote to memory of 4564	5924	explorer.exe	116
PID 5924 wrote to memory of 4564	5924	explorer.exe	116
PID 5924 wrote to memory of 4564	5924	explorer.exe	116
PID 5924 wrote to memory of 4564	5924	explorer.exe	116

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2512
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4564

C:\Users\Admin\AppData\Local\Temp\quanto.exe.bin.exe
"C:\Users\Admin\AppData\Local\Temp\quanto.exe.bin.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\TEMP\{4B46E2AA-8BA8-4235-8857-7A2EEC25AC34}\.cr\quanto.exe.bin.exe
  "C:\Windows\TEMP\{4B46E2AA-8BA8-4235-8857-7A2EEC25AC34}\.cr\quanto.exe.bin.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\quanto.exe.bin.exe" -burn.filehandle.attached=664 -burn.filehandle.self=648
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3600
- - C:\Windows\TEMP\{C8233B4F-5598-4C39-B448-91BDB586E548}\.ba\WiseTurbo.exe
    C:\Windows\TEMP\{C8233B4F-5598-4C39-B448-91BDB586E548}\.ba\WiseTurbo.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2220
  - - C:\Users\Admin\AppData\Roaming\serverAuth\WiseTurbo.exe
      C:\Users\Admin\AppData\Roaming\serverAuth\WiseTurbo.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:532
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\SysWOW64\cmd.exe
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:4036
      - C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\52f6041c

Filesize
1.1MB

MD5
898f718be684d84b0be675d5b1f6d6b8

SHA1
364e8da24bec4b274a1ce034da1e1d20ca6ac12e

SHA256
28f46d468d856a04824e85fee7e1b14791e97016c332dca815efc7ca351e9771

SHA512
6b87116650200870460e6b9fef6fd80913f85d279c9aae134de8450510197e54568cacb3acdd055e2eef6c3d609b253441f9431736b8a3e1cd8dae34b2bd8753

Download Submit
C:\Windows\TEMP\{C8233B4F-5598-4C39-B448-91BDB586E548}\.ba\lilt.iso

Filesize
863KB

MD5
0905b3ca4c3989e8dd6222736ae3a151

SHA1
bee40c368333c70272b3f0c60cd0ae3383f909d8

SHA256
1672e7fa812259cf9ffb95bb24ebd6139fc40381a4f34267b5955f96b549ee20

SHA512
2e1da1157d0b774688c658bc711480b6950d3c98ef5deb64899f4d6bf9d93f0465a7cb53c23019ce2e1f60c9c24f41728411ff781ff5a2366a4d9841bfbbb68e

Download Submit
C:\Windows\TEMP\{C8233B4F-5598-4C39-B448-91BDB586E548}\.ba\sqlite3.dll

Filesize
891KB

MD5
f18535f3edbc5a948cbe169b32532cd4

SHA1
54575320f198626ef74f08b17022671e05c09df0

SHA256
72b214770043bce3c69b35803f8c83bb04cd88561af4571ce5c13b68ce9f38f6

SHA512
2f4322043f55406772e6b16bc97e1c94c4f537ae6d8a238535a50717b7cb2eaa5ea1a7bd5fd184ffa6f1cf54e88f5a9128c51f77eb6b4a5d1368e6dd9737ddef

Download Submit
C:\Windows\Temp\{4B46E2AA-8BA8-4235-8857-7A2EEC25AC34}\.cr\quanto.exe.bin.exe

Filesize
4.5MB

MD5
c785d6c4511b8577ab1a17de6452f063

SHA1
7f7dc6e303d7ae0bf9ed48da70b1dc1bfe408305

SHA256
42019eb9f6c1c9420ef67e323139047ef07e9c14dc0ee109126cfa24ebbdfba7

SHA512
d767fcf9211b92685f41529b5842f8bef46d61a45549923f6a176f0d08b45c0d77099913df5adc8a506d35e14f9c51b05be68f7756d8d67d7ca79385dcef2130

Download Submit
C:\Windows\Temp\{C8233B4F-5598-4C39-B448-91BDB586E548}\.ba\Precursor.dll

Filesize
203KB

MD5
edd36228f691d9528e7a4a99ae237d0b

SHA1
90c234e0a27bffc9414e49743648f249e467287e

SHA256
a2c80f88af00d526b10c3b18c8403ff5ac6353ea229ed86c441303b6a6f9fcba

SHA512
30a4882a30255ca7869eb631ec56e0fbee5090cdad634efc0145d0e211082576ea8e3b9031a5a05b56513faf8849c21f2f890606dc6650820507c289aada87ad

Download Submit
C:\Windows\Temp\{C8233B4F-5598-4C39-B448-91BDB586E548}\.ba\WiseTurbo.exe

Filesize
8.7MB

MD5
1f166f5c76eb155d44dd1bf160f37a6a

SHA1
cd6f7aa931d3193023f2e23a1f2716516ca3708c

SHA256
2d13424b09ba004135a26ccd60b64cdd6917d80ce43070cbc114569eae608588

SHA512
38ad8f1308fe1aae3ddf7dbc3b1c5442663571137390b3e31e2527b8fec70e7266b06df295df0c411fcc500424022f274fd467d36040def2e1a4feff88c749b7

Download Submit
C:\Windows\Temp\{C8233B4F-5598-4C39-B448-91BDB586E548}\.ba\caftan.bmp

Filesize
67KB

MD5
bd42648e3937a646fc2e5b71614a499e

SHA1
1d8bb75712dda9b26a035c8abfc96e6e1c182ba3

SHA256
406557b203253097558ce7b29367628a5e079667eba1c96aa5cfbc1da7159a4d

SHA512
c11f12036a35d3ef0b0acd00dd298caf146bbcc5435c4bf21f7c6b642e458b8e756652099da8b5e4eb40cb2293c2cae2bfc6dfbb63496edf7a7bb98b9cf50dab

Download Submit
memory/532-35-0x0000000000400000-0x0000000000D48000-memory.dmp

Filesize
9.3MB

Download
memory/532-33-0x0000000073370000-0x00000000734EB000-memory.dmp

Filesize
1.5MB

Download
memory/532-40-0x0000000073370000-0x00000000734EB000-memory.dmp

Filesize
1.5MB

Download
memory/532-34-0x00007FFBFEBB0000-0x00007FFBFEDA5000-memory.dmp

Filesize
2.0MB

Download
memory/2220-19-0x0000000073370000-0x00000000734EB000-memory.dmp

Filesize
1.5MB

Download
memory/2220-20-0x00007FFBFEBB0000-0x00007FFBFEDA5000-memory.dmp

Filesize
2.0MB

Download
memory/2220-27-0x0000000000400000-0x0000000000D48000-memory.dmp

Filesize
9.3MB

Download
memory/4036-44-0x00007FFBFEBB0000-0x00007FFBFEDA5000-memory.dmp

Filesize
2.0MB

Download
memory/4036-45-0x0000000073370000-0x00000000734EB000-memory.dmp

Filesize
1.5MB

Download
memory/4564-60-0x0000000000E00000-0x0000000001200000-memory.dmp

Filesize
4.0MB

Download
memory/4564-63-0x0000000076AF0000-0x0000000076D05000-memory.dmp

Filesize
2.1MB

Download
memory/4564-61-0x00007FFBFEBB0000-0x00007FFBFEDA5000-memory.dmp

Filesize
2.0MB

Download
memory/4564-56-0x0000000000560000-0x000000000056A000-memory.dmp

Filesize
40KB

Download
memory/5924-49-0x0000000000EB0000-0x0000000000F33000-memory.dmp

Filesize
524KB

Download
memory/5924-59-0x0000000000EB0000-0x0000000000F33000-memory.dmp

Filesize
524KB

Download
memory/5924-55-0x0000000076AF0000-0x0000000076D05000-memory.dmp

Filesize
2.1MB

Download
memory/5924-52-0x0000000002FA0000-0x00000000033A0000-memory.dmp

Filesize
4.0MB

Download
memory/5924-51-0x0000000002FA0000-0x00000000033A0000-memory.dmp

Filesize
4.0MB

Download
memory/5924-48-0x00007FFBFEBB0000-0x00007FFBFEDA5000-memory.dmp

Filesize
2.0MB

Download
memory/5924-47-0x0000000000EB0000-0x0000000000F33000-memory.dmp

Filesize
524KB

Download

Analysis

Sharing