Analysis
- max time kernel
105s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20250610-en - resource tags
- submitted
13/09/2025, 18:45
General
- Target eLoad.exe
- Size 2.7MB
- Sample250913-xekcdafm21
- SHA256 a34b6a0f667b145a5034d2a7c0cd96eb1636b0ba98055c490dce3fc3fa89d2a9
Malware Config
Signatures
- Detects Rhadamanthys Payload 2 IoCs
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
- Rhadamanthys family
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Deletes itself 1 IoCs
- Themida packer 5 IoCs
Detects Themida, an advanced Windows software protection system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\SysWOW64\openwith.exe"C:\Windows\system32\openwith.exe"2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\eLoad.exe"C:\Users\Admin\AppData\Local\Temp\eLoad.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1796-11-0x0000000001090000-0x000000000109A000-memory.dmp
memory/1796-21-0x0000000002D30000-0x0000000003130000-memory.dmp
memory/1796-18-0x0000000002D30000-0x0000000003130000-memory.dmp
memory/1796-20-0x00000000762D0000-0x00000000764E5000-memory.dmp
memory/1796-17-0x00007FF985BD0000-0x00007FF985DC5000-memory.dmp
memory/1796-15-0x0000000002D30000-0x0000000003130000-memory.dmp
memory/1796-16-0x0000000002D30000-0x0000000003130000-memory.dmp
memory/3324-4-0x0000000002DA0000-0x00000000031A0000-memory.dmp
memory/3324-8-0x00007FF985BD0000-0x00007FF985DC5000-memory.dmp
memory/3324-10-0x00000000762D0000-0x00000000764E5000-memory.dmp
memory/3324-7-0x0000000002DA0000-0x00000000031A0000-memory.dmp
memory/3324-14-0x0000000000400000-0x0000000000A2E000-memory.dmp
memory/3324-5-0x0000000002DA0000-0x00000000031A0000-memory.dmp
memory/3324-6-0x0000000002DA0000-0x00000000031A0000-memory.dmp
memory/3324-0-0x0000000000400000-0x0000000000A2E000-memory.dmp
memory/3324-2-0x0000000000400000-0x0000000000A2E000-memory.dmp
memory/3324-3-0x0000000000400000-0x0000000000A2E000-memory.dmp
memory/3324-1-0x0000000000400000-0x0000000000A2E000-memory.dmp