rhadamanthys | 560f888fe44146da6d08fda8fe0f6f6f6eaed3cab768096ac195e5d14a85a399

General

Target

kapubvalo.exe
Size

2.0MB
MD5

bc42b228a222e547e199fe8a7ad012d0
SHA1

7f7f2655c3b9fe74a225255f609ba89165be776d
SHA256

560f888fe44146da6d08fda8fe0f6f6f6eaed3cab768096ac195e5d14a85a399
SHA512

b4ce427095453f949b470ba58ba4177206e7512fd4c5fbf11430f1a00df385884c54a601a174a02434d0d2741a69cbb2a19e6ad1a9e83872dc028382646111d8
SSDEEP

49152:5oIdtKEtKNtKAtKGtKvtK2dM0ErvDtKdn:j0E0N0A0G0v0Ak30

Score

10^/10

rhadamanthys persistence stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Rhadamanthys family
rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2784 created 1232	2784	kapubvalo.exe	21

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ilpXvFkRMFKufemDslyNxKAQ\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\ilpXvFkRMFKufemDslyNxKAQ"	drvloader.exe

Executes dropped EXE 1 IoCs

pid	Process
2800	drvloader.exe

Loads dropped DLL 1 IoCs

pid	Process
2784	kapubvalo.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SoftwareDistribution\Download\vac.sys	kapubvalo.exe
File created	C:\Windows\SoftwareDistribution\Download\drvloader.exe	kapubvalo.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2784	kapubvalo.exe
2784	kapubvalo.exe
2760	dialer.exe
2760	dialer.exe
2784	kapubvalo.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
2800	drvloader.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	2800	drvloader.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 2800	2784	kapubvalo.exe	31
PID 2784 wrote to memory of 2800	2784	kapubvalo.exe	31
PID 2784 wrote to memory of 2800	2784	kapubvalo.exe	31
PID 2784 wrote to memory of 2760	2784	kapubvalo.exe	33
PID 2784 wrote to memory of 2760	2784	kapubvalo.exe	33
PID 2784 wrote to memory of 2760	2784	kapubvalo.exe	33
PID 2784 wrote to memory of 2760	2784	kapubvalo.exe	33
PID 2784 wrote to memory of 2760	2784	kapubvalo.exe	33
PID 2784 wrote to memory of 2640	2784	kapubvalo.exe	34
PID 2784 wrote to memory of 2640	2784	kapubvalo.exe	34
PID 2784 wrote to memory of 2640	2784	kapubvalo.exe	34
PID 2784 wrote to memory of 2768	2784	kapubvalo.exe	35
PID 2784 wrote to memory of 2768	2784	kapubvalo.exe	35
PID 2784 wrote to memory of 2768	2784	kapubvalo.exe	35
PID 2784 wrote to memory of 2776	2784	kapubvalo.exe	36
PID 2784 wrote to memory of 2776	2784	kapubvalo.exe	36
PID 2784 wrote to memory of 2776	2784	kapubvalo.exe	36
PID 2784 wrote to memory of 2600	2784	kapubvalo.exe	37
PID 2784 wrote to memory of 2600	2784	kapubvalo.exe	37
PID 2784 wrote to memory of 2600	2784	kapubvalo.exe	37
PID 2784 wrote to memory of 2596	2784	kapubvalo.exe	38
PID 2784 wrote to memory of 2596	2784	kapubvalo.exe	38
PID 2784 wrote to memory of 2596	2784	kapubvalo.exe	38

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1232
- C:\Users\Admin\AppData\Local\Temp\kapubvalo.exe
  "C:\Users\Admin\AppData\Local\Temp\kapubvalo.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Windows\SoftwareDistribution\Download\drvloader.exe
    "C:\Windows\SoftwareDistribution\Download\drvloader.exe" C:\Windows\SoftwareDistribution\Download\vac.sys
    3⤵
    - Sets service image path in registry
    - Executes dropped EXE
    - Suspicious behavior: LoadsDriver
    - Suspicious use of AdjustPrivilegeToken
    PID:2800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c color e
    3⤵
    PID:2640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c color c
    3⤵
    PID:2776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c color c
    3⤵
    PID:2596
- C:\Windows\system32\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SoftwareDistribution\Download\drvloader.exe

Filesize
134KB

MD5
34cfbe3ff70461820ccc31a1afeec0b3

SHA1
5d32e91c039c9a6f723ba3c04c1179d02e6a0ce9

SHA256
6ebcc6896b243c761da4fc28a26249b0c146ae17aff7697c09bc447008e831df

SHA512
1ca4661be645e7e954d89c83f1fd126a5e936533052d4e330c9faccb83bb5942d28265375cee743e468b1625a0c1f10888e7957fe88c718e8501a86a78cdc06e

Download Submit
memory/2760-27-0x0000000077460000-0x0000000077609000-memory.dmp

Filesize
1.7MB

Download
memory/2760-25-0x000007FEFD5B0000-0x000007FEFD61C000-memory.dmp

Filesize
432KB

Download
memory/2760-14-0x0000000000060000-0x000000000006A000-memory.dmp

Filesize
40KB

Download
memory/2760-23-0x0000000077460000-0x0000000077609000-memory.dmp

Filesize
1.7MB

Download
memory/2760-24-0x0000000077340000-0x000000007745F000-memory.dmp

Filesize
1.1MB

Download
memory/2760-17-0x0000000001C40000-0x0000000002040000-memory.dmp

Filesize
4.0MB

Download
memory/2760-20-0x0000000077460000-0x0000000077609000-memory.dmp

Filesize
1.7MB

Download
memory/2760-26-0x0000000077460000-0x0000000077609000-memory.dmp

Filesize
1.7MB

Download
memory/2784-19-0x0000000077461000-0x0000000077562000-memory.dmp

Filesize
1.0MB

Download
memory/2784-11-0x0000000077460000-0x0000000077609000-memory.dmp

Filesize
1.7MB

Download
memory/2784-18-0x0000000001FB0000-0x00000000023B0000-memory.dmp

Filesize
4.0MB

Download
memory/2784-9-0x0000000001FB0000-0x00000000023B0000-memory.dmp

Filesize
4.0MB

Download
memory/2784-1-0x0000000001FB0000-0x00000000023B0000-memory.dmp

Filesize
4.0MB

Download
memory/2784-3-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/2784-12-0x0000000077340000-0x000000007745F000-memory.dmp

Filesize
1.1MB

Download
memory/2784-13-0x000007FEFD5B0000-0x000007FEFD61C000-memory.dmp

Filesize
432KB

Download
memory/2784-15-0x0000000001FB0000-0x00000000023B0000-memory.dmp

Filesize
4.0MB

Download
memory/2784-2-0x0000000000300000-0x0000000000329000-memory.dmp

Filesize
164KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads