rhadamanthys | 560f888fe44146da6d08fda8fe0f6f6f6eaed3cab768096ac195e5d14a85a399

General

Target

kapubvalo.exe
Size

2.0MB
MD5

bc42b228a222e547e199fe8a7ad012d0
SHA1

7f7f2655c3b9fe74a225255f609ba89165be776d
SHA256

560f888fe44146da6d08fda8fe0f6f6f6eaed3cab768096ac195e5d14a85a399
SHA512

b4ce427095453f949b470ba58ba4177206e7512fd4c5fbf11430f1a00df385884c54a601a174a02434d0d2741a69cbb2a19e6ad1a9e83872dc028382646111d8
SSDEEP

49152:5oIdtKEtKNtKAtKGtKvtK2dM0ErvDtKdn:j0E0N0A0G0v0Ak30

Score

10^/10

rhadamanthys persistence stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Rhadamanthys family
rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4776 created 2996	4776	kapubvalo.exe	50

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\JwsYIEWZaUvWGZXOm\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\JwsYIEWZaUvWGZXOm"	drvloader.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Control Panel\International\Geo\Nation	kapubvalo.exe

Executes dropped EXE 1 IoCs

pid	Process
3492	drvloader.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SoftwareDistribution\Download\vac.sys	kapubvalo.exe
File created	C:\Windows\SoftwareDistribution\Download\drvloader.exe	kapubvalo.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4776	kapubvalo.exe
4776	kapubvalo.exe
3512	openwith.exe
3512	openwith.exe
4776	kapubvalo.exe
4776	kapubvalo.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
3492	drvloader.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	3492	drvloader.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 3512	4776	kapubvalo.exe	87
PID 4776 wrote to memory of 3512	4776	kapubvalo.exe	87
PID 4776 wrote to memory of 3512	4776	kapubvalo.exe	87
PID 4776 wrote to memory of 3512	4776	kapubvalo.exe	87
PID 4776 wrote to memory of 3492	4776	kapubvalo.exe	88
PID 4776 wrote to memory of 3492	4776	kapubvalo.exe	88
PID 4776 wrote to memory of 4912	4776	kapubvalo.exe	90
PID 4776 wrote to memory of 4912	4776	kapubvalo.exe	90
PID 4776 wrote to memory of 3144	4776	kapubvalo.exe	91
PID 4776 wrote to memory of 3144	4776	kapubvalo.exe	91
PID 4776 wrote to memory of 2188	4776	kapubvalo.exe	92
PID 4776 wrote to memory of 2188	4776	kapubvalo.exe	92
PID 4776 wrote to memory of 4604	4776	kapubvalo.exe	101
PID 4776 wrote to memory of 4604	4776	kapubvalo.exe	101
PID 4776 wrote to memory of 4380	4776	kapubvalo.exe	102
PID 4776 wrote to memory of 4380	4776	kapubvalo.exe	102

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2996
- C:\Windows\system32\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3512

C:\Users\Admin\AppData\Local\Temp\kapubvalo.exe
"C:\Users\Admin\AppData\Local\Temp\kapubvalo.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Checks computer location settings
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Windows\SoftwareDistribution\Download\drvloader.exe
  "C:\Windows\SoftwareDistribution\Download\drvloader.exe" C:\Windows\SoftwareDistribution\Download\vac.sys
  2⤵
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:3492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c color e
  2⤵
  PID:4912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c color c
  2⤵
  PID:2188
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c color c
  2⤵
  PID:4380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SoftwareDistribution\Download\drvloader.exe

Filesize
134KB

MD5
34cfbe3ff70461820ccc31a1afeec0b3

SHA1
5d32e91c039c9a6f723ba3c04c1179d02e6a0ce9

SHA256
6ebcc6896b243c761da4fc28a26249b0c146ae17aff7697c09bc447008e831df

SHA512
1ca4661be645e7e954d89c83f1fd126a5e936533052d4e330c9faccb83bb5942d28265375cee743e468b1625a0c1f10888e7957fe88c718e8501a86a78cdc06e

Download Submit
memory/3512-26-0x00007FFEAB770000-0x00007FFEAB965000-memory.dmp

Filesize
2.0MB

Download
memory/3512-27-0x00007FFEAB190000-0x00007FFEAB24E000-memory.dmp

Filesize
760KB

Download
memory/3512-30-0x000002AAF8E50000-0x000002AAF9250000-memory.dmp

Filesize
4.0MB

Download
memory/3512-29-0x000002AAF8E50000-0x000002AAF9250000-memory.dmp

Filesize
4.0MB

Download
memory/3512-28-0x00007FFEA8E90000-0x00007FFEA9159000-memory.dmp

Filesize
2.8MB

Download
memory/3512-23-0x000002AAF8E50000-0x000002AAF9250000-memory.dmp

Filesize
4.0MB

Download
memory/3512-24-0x000002AAF8E50000-0x000002AAF9250000-memory.dmp

Filesize
4.0MB

Download
memory/3512-13-0x000002AAF73D0000-0x000002AAF73DA000-memory.dmp

Filesize
40KB

Download
memory/4776-6-0x00000159506E0000-0x0000015950AE0000-memory.dmp

Filesize
4.0MB

Download
memory/4776-3-0x00000159501B0000-0x00000159501D9000-memory.dmp

Filesize
164KB

Download
memory/4776-8-0x00007FFEAB770000-0x00007FFEAB965000-memory.dmp

Filesize
2.0MB

Download
memory/4776-4-0x00000159501E0000-0x00000159501E9000-memory.dmp

Filesize
36KB

Download
memory/4776-11-0x00007FFEA8E90000-0x00007FFEA9159000-memory.dmp

Filesize
2.8MB

Download
memory/4776-9-0x00007FFEAB190000-0x00007FFEAB24E000-memory.dmp

Filesize
760KB

Download
memory/4776-10-0x00000159506E0000-0x0000015950AE0000-memory.dmp

Filesize
4.0MB

Download
memory/4776-5-0x00000159506E0000-0x0000015950AE0000-memory.dmp

Filesize
4.0MB

Download
memory/4776-7-0x00000159506E0000-0x0000015950AE0000-memory.dmp

Filesize
4.0MB

Download
memory/4776-31-0x00000159506E0000-0x0000015950AE0000-memory.dmp

Filesize
4.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads