rhadamanthys | 082295c461e34ed85b72085bd019266618ad4add3468fe33f536b9c17ba3eadd

General

Target

update.txt.ps1
Size

140KB
MD5

3de0be17305e0c5464aecc55e30a35e9
SHA1

56bec554aced0aeebf27880d9cd616910f27d1d2
SHA256

082295c461e34ed85b72085bd019266618ad4add3468fe33f536b9c17ba3eadd
SHA512

ba619e85e42a583845a3de4c8b643ca9f5126a83737ae2b8efca88cb241be888bb2e300924cf09fd40bd477e84527a2c5cef2f06e38121ead1e597aa7e394749
SSDEEP

3072:aDuvEvYSQ9CALeDmxktgO7uq9RI65hYF84ctSnjhye5uHdR7U:atNQEmKbuq9uRoeMdR7U

Score

10^/10

Malware Config

Signatures

Detects Rhadamanthys payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0008000000024210-19.dat	Rhadamanthys_v8
behavioral2/memory/5824-30-0x0000000000620000-0x0000000000742000-memory.dmp	Rhadamanthys_v8

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Rhadamanthys family
rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 5824 created 2560	5824	rh_0.9.0.exe	42

Blocklisted process makes network request 1 IoCs

flow	pid	Process
14	6108	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
14	6108	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
5824	rh_0.9.0.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
6108	powershell.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
6108	powershell.exe
6108	powershell.exe
5824	rh_0.9.0.exe
5824	rh_0.9.0.exe
5824	rh_0.9.0.exe
5824	rh_0.9.0.exe
5776	fontdrvhost.exe
5776	fontdrvhost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	6108	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 6108 wrote to memory of 5824	6108	powershell.exe	95
PID 6108 wrote to memory of 5824	6108	powershell.exe	95
PID 5824 wrote to memory of 5776	5824	rh_0.9.0.exe	96
PID 5824 wrote to memory of 5776	5824	rh_0.9.0.exe	96
PID 5824 wrote to memory of 5776	5824	rh_0.9.0.exe	96
PID 5824 wrote to memory of 5776	5824	rh_0.9.0.exe	96

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2560
- C:\Windows\System32\fontdrvhost.exe
  "C:\Windows\System32\fontdrvhost.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5776

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\update.txt.ps1
1⤵
- Blocklisted process makes network request
- Downloads MZ/PE file
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6108
- C:\Users\Admin\AppData\Roaming\rh_0.9.0.exe
  "C:\Users\Admin\AppData\Roaming\rh_0.9.0.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5jsb3ci4.qe2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\rh_0.9.0.exe

Filesize
1.1MB

MD5
3a08637bdabaeeb9c73aceb6356091d4

SHA1
9cf9559fffdec60958d0e74e0dce37c18cab6c27

SHA256
4168d5d67851c82298922b24e2c31811c009d4fb66542081484295ef42cf7a08

SHA512
836fda49f8d9db94482a0b9027ff7a75ed55b1f01e0f5daaa427fb4fe5a16fe670a29070afa920e1c79a12a0ff0c79b3bb179d087c8ef9c68b6624404fb7df3b

Download Submit
memory/5776-48-0x00007FFFCCBF0000-0x00007FFFCCEB9000-memory.dmp

Filesize
2.8MB

Download
memory/5776-45-0x00007FFFCEE70000-0x00007FFFCF065000-memory.dmp

Filesize
2.0MB

Download
memory/5776-44-0x000001F6CA340000-0x000001F6CA740000-memory.dmp

Filesize
4.0MB

Download
memory/5776-49-0x000001F6CA340000-0x000001F6CA740000-memory.dmp

Filesize
4.0MB

Download
memory/5776-46-0x00007FFFCCEC0000-0x00007FFFCCF7E000-memory.dmp

Filesize
760KB

Download
memory/5776-43-0x000001F6CA340000-0x000001F6CA740000-memory.dmp

Filesize
4.0MB

Download
memory/5776-40-0x000001F6CA120000-0x000001F6CA12A000-memory.dmp

Filesize
40KB

Download
memory/5824-30-0x0000000000620000-0x0000000000742000-memory.dmp

Filesize
1.1MB

Download
memory/5824-34-0x00007FFFB0DD0000-0x00007FFFB1891000-memory.dmp

Filesize
10.8MB

Download
memory/5824-32-0x00000000028B0000-0x00000000028C0000-memory.dmp

Filesize
64KB

Download
memory/5824-31-0x00000000028A0000-0x00000000028A8000-memory.dmp

Filesize
32KB

Download
memory/5824-33-0x000000001B520000-0x000000001B920000-memory.dmp

Filesize
4.0MB

Download
memory/5824-38-0x00007FFFCCEC0000-0x00007FFFCCF7E000-memory.dmp

Filesize
760KB

Download
memory/5824-35-0x000000001B520000-0x000000001B920000-memory.dmp

Filesize
4.0MB

Download
memory/5824-47-0x00007FFFB0DD0000-0x00007FFFB1891000-memory.dmp

Filesize
10.8MB

Download
memory/5824-37-0x00007FFFCEE70000-0x00007FFFCF065000-memory.dmp

Filesize
2.0MB

Download
memory/5824-29-0x00007FFFB0DD0000-0x00007FFFB1891000-memory.dmp

Filesize
10.8MB

Download
memory/5824-39-0x00007FFFCCBF0000-0x00007FFFCCEB9000-memory.dmp

Filesize
2.8MB

Download
memory/5824-36-0x00007FFFB0DD0000-0x00007FFFB1891000-memory.dmp

Filesize
10.8MB

Download
memory/6108-11-0x00007FFFB0DD0000-0x00007FFFB1891000-memory.dmp

Filesize
10.8MB

Download
memory/6108-14-0x00007FFFB0DD0000-0x00007FFFB1891000-memory.dmp

Filesize
10.8MB

Download
memory/6108-13-0x00007FFFB0DD0000-0x00007FFFB1891000-memory.dmp

Filesize
10.8MB

Download
memory/6108-0-0x00007FFFB0DD3000-0x00007FFFB0DD5000-memory.dmp

Filesize
8KB

Download
memory/6108-12-0x00007FFFB0DD0000-0x00007FFFB1891000-memory.dmp

Filesize
10.8MB

Download
memory/6108-1-0x0000028FE6160000-0x0000028FE6182000-memory.dmp

Filesize
136KB

Download
memory/6108-28-0x00007FFFB0DD0000-0x00007FFFB1891000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing