2ea979baba9ae917a70bbeda65c04f7e4f28cead5c56c86ecd4b69a58b85f5ea

Analysis

max time kernel
149s
max time network
138s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/04/2026, 08:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-16_33a6acff45e5d9858f474431866b111a_elex_rhadamanthys_stop.exe
Size 61KB
Sample260416-kffdlabt3m
SHA256 2ea979baba9ae917a70bbeda65c04f7e4f28cead5c56c86ecd4b69a58b85f5ea
MD5 33a6acff45e5d9858f474431866b111a
SHA1 427d80949bfe8ca8ca7931f2bcec98280b7bb8bc
SHA512 0531b8e97d5666fe06b6bf54c0716fa3e067571a3456eef126128b5c4f3c88fd5394509ecded20dc47df720b948ca28b7eb1643e206f8732135197d3ca3543f5
SSDEEP 1536:HO6skYL5TDbCY7fjPpm7GVOFAwfU5lXa:ckw517fjPQiwfclXa
TLSH
T161538B85B2F5C076E5E208F07A7DAA91C8FEBD3425A4D4C3D311588B6DB01E2D63A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
5008	1g6ga.exe
4848	6pavzg6.exe
3448	1g6ga.exe
4808	6pavzg6.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Windows\CurrentVersion\Run\r4suaw6h = "C:\\Users\\Admin\\AppData\\Roaming\\6pavzg6.exe"	1g6ga.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Windows\CurrentVersion\Run\dz9rkd = "C:\\Users\\Admin\\AppData\\Roaming\\1g6ga.exe"	2026-04-16_33a6acff45e5d9858f474431866b111a_elex_rhadamanthys_stop.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-16_33a6acff45e5d9858f474431866b111a_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1g6ga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6pavzg6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1g6ga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6pavzg6.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 5008	996	2026-04-16_33a6acff45e5d9858f474431866b111a_elex_rhadamanthys_stop.exe	78
PID 5008 wrote to memory of 4848	5008	1g6ga.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-04-16_33a6acff45e5d9858f474431866b111a_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-16_33a6acff45e5d9858f474431866b111a_elex_rhadamanthys_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:996
- C:\Users\Admin\AppData\Roaming\1g6ga.exe
  C:\Users\Admin\AppData\Roaming\1g6ga.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5008
- - C:\Users\Admin\AppData\Roaming\6pavzg6.exe
    C:\Users\Admin\AppData\Roaming\6pavzg6.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4848

C:\Users\Admin\AppData\Roaming\1g6ga.exe
C:\Users\Admin\AppData\Roaming\1g6ga.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3448

C:\Users\Admin\AppData\Roaming\6pavzg6.exe
C:\Users\Admin\AppData\Roaming\6pavzg6.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1g6ga.exe

Path C:\Users\Admin\AppData\Roaming\1g6ga.exe
Size 61KB
SHA256 3339c6cb2f21da06989bc33ae9b3dd3b92018a603d8113ace1a7b28d9fb6f881
MD5 aa737905d21402963cc620bc1f7fab8f
SHA1 080c763e8bc4919d7cb1ff1c2ad4c4f21d51f75d
SHA512 5eca485d2b6b7d9804517aef7b2b67c097173ae04e7fc62d5a8c50329546afb96af5d4b07c6781ab6b811a4dd7304cfd839c223d7f1b0acee437ee6c3191f63f
SSDEEP 1536:3O6skYL5TDbCY7fjPpm7GVOFAwfU5lXa:Mkw517fjPQiwfclXa
TLSH
T17C537B85B2F5C076E5E208F07A7DAA91C8FEBD3425A4D4C3D311588B6DB01E2D63A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6pavzg6.exe

Path C:\Users\Admin\AppData\Roaming\6pavzg6.exe
Size 61KB
SHA256 33b09efb70615c61df515ce5ae7b4664fb18c2cd9d5913fe80ed4a6877aa5ffb
MD5 2221762d5068b8315e6e850fa7dc7e9f
SHA1 00a4d25cc77a633edcbda712792fcb2ca6389622
SHA512 15f3d04372de0b162e0a354bf9b991a6f4ef800bb2c2cd5b62ada72367171fcc8b7c96b3211e407c342b4476da8a108594bf26eb93817e516d224b0c64b73387
SSDEEP 1536:DO6skYL5TDbCY7fjPpm7GVOFAwfU5lXa:4kw517fjPQiwfclXa
TLSH
T1AC538B95B2F5C076E5E208F07A7DAA91C8FEBD3425A4D4C3D311588B6DB01E2D63A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3448-11-0x0000000000870000-0x0000000000931000-memory.dmp

Download

memory/4808-12-0x0000000002400000-0x00000000024C1000-memory.dmp

Download

memory/4848-10-0x0000000002490000-0x0000000002551000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads