Analysis
- max time kernel
150s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/04/2026, 12:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe
- Size 173KB
- Sample260416-p3llcaax41
- SHA256 67ba53128d764ad0c8d8c0594b1745ae8603e83f547b8c9feb142199501d3ffb
- MD5 4ee315d279badb77b708b44b73abeeeb
- SHA1 0d946596f9df9cf4281cd22c7280f21c2a2448d4
- SHA512 bcecf389826f825fd34e15fca999b0d21a28fad148a3de4bb3c44c088ea8a87e87024d3241e3e23332b645b54de3ee2a4bf3609c871e3717dc9b2147ac58a33b
- SSDEEP 3072:gCSjGoLpWM6VsBEjxeZdi6r1Pg9uCRFRzsxeuPo10JOSdBkK:WXqoEupPmRFJs0ug1MOc5
- TLSH T1C2046C26B6ACF372D0E255B88E5CF2E16D3D7E300F2548C772982B9D9E712C15A38356
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Renames multiple (256) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts rundl132.exe File opened for modification C:\Windows\system32\drivers\etc\hosts 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe - Executes dropped EXE 3 IoCs
pid Process 1756 Logo1_.exe 5680 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 2532 rundl132.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" Logo1_.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Mozilla Firefox\private_browsing.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\RCXD8EB.tmp Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\RCXDABD.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\RCXDACE.tmp Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe.Exe Logo1_.exe File opened for modification C:\Program Files\dotnet\dotnet.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe Logo1_.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe Logo1_.exe File opened for modification C:\Program Files\dotnet\dotnet.exe Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe.Exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RCXD2FF.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\RCXC62A.tmp Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.Exe Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\uninstall\rundl132.exe 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe File created C:\Windows\Logo1_.exe 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe File opened for modification C:\Windows\uninstall\rundl132.exe Logo1_.exe File created C:\Windows\RichDll.dll Logo1_.exe - System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundl132.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4908 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 4908 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 4908 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 4908 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 4908 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 4908 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 4908 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 4908 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 4908 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 4908 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 4908 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 4908 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 4908 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 4908 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 4908 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 4908 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 4908 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 4908 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 4908 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 4908 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 4908 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 4908 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 4908 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 4908 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 4908 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 4908 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 1756 Logo1_.exe 1756 Logo1_.exe 1756 Logo1_.exe 1756 Logo1_.exe 1756 Logo1_.exe 1756 Logo1_.exe 1756 Logo1_.exe 1756 Logo1_.exe 1756 Logo1_.exe 1756 Logo1_.exe 1756 Logo1_.exe 1756 Logo1_.exe 1756 Logo1_.exe 1756 Logo1_.exe 1756 Logo1_.exe 1756 Logo1_.exe 1756 Logo1_.exe 1756 Logo1_.exe 1756 Logo1_.exe 1756 Logo1_.exe 1756 Logo1_.exe 1756 Logo1_.exe 1756 Logo1_.exe 1756 Logo1_.exe 1756 Logo1_.exe 1756 Logo1_.exe 1756 Logo1_.exe 1756 Logo1_.exe 1756 Logo1_.exe 1756 Logo1_.exe 1756 Logo1_.exe 1756 Logo1_.exe 1756 Logo1_.exe 1756 Logo1_.exe 1756 Logo1_.exe 1756 Logo1_.exe 1756 Logo1_.exe 1756 Logo1_.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4908 wrote to memory of 4860 4908 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 85 PID 4860 wrote to memory of 5112 4860 net.exe 87 PID 4908 wrote to memory of 5956 4908 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 88 PID 4908 wrote to memory of 1756 4908 2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe 89 PID 1756 wrote to memory of 2912 1756 Logo1_.exe 91 PID 2912 wrote to memory of 5380 2912 net.exe 93 PID 5956 wrote to memory of 5680 5956 cmd.exe 94 PID 1756 wrote to memory of 2412 1756 Logo1_.exe 97 PID 2412 wrote to memory of 5892 2412 net.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
PID:5112
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a38AF.bat2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\Users\Admin\AppData\Local\Temp\2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5680
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:5380
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:5892
-
-
-
-
C:\Windows\uninstall\rundl132.exeC:\Windows\uninstall\rundl132.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2532
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RCXD33F.tmp
- Size 156KB
- SHA256 a15fe0e3ed4e53655ff4c822b2af5d6d160786f6556e31a9e24aa04d88be281d
- MD5 335fb9816ed60b8a808c285703403d32
- SHA1 19484fc5928c0146c026011df93888db4201afd0
- SHA512 84ad993be47968bc760e4dce37572131d38c8b88c2f7909296768a385a2cee64b0efc40a0389f64e82e5653acaf66d37a8c5fd7b6227445ef7c570480e0e488d
- SSDEEP 1536:w7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx58SXzpn9t6HNz:hCSjGoLpWM6VsBEjx5ZdaZ
- TLSH T175F3B36EB18FB3F2D3E1597C8D1DF2A5ED28FE20CE19285B75993B0E9A760C31508191
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXD4E7.tmp
- Size 94KB
- SHA256 e093a064fc3ad7440bedd983429d8358b8b874fd5825f9b671805f1fad10c708
- MD5 539f0b95a332901532c4419fe3ecd04b
- SHA1 37ed20aa9a3c821c3aaf3b149d195d465ab6ed39
- SHA512 cb248968894a9388f6d7fa48f83abb7bb6a0a83953a2ae6c4aed0cc04ec2d4f7b204bfe5063e571e4d67a6090c87996ea37f9760b9e6f2d2e77dd2088deb079b
- SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx+8SXzpn9t6YND:gCSjGoLpWM6VsBEjx+Zd5p
- TLSH T180933A5AB18CB3B2D0E159BC8E0FF2E5BD297E200E1D189F759A2F0DEE761C1190C285
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\RCXD90C.tmp
- Size 103KB
- SHA256 076d8270d7ad5c2a377eee81ea500890afa3a7e11ba2fb686a444012a94b24bf
- MD5 069fd566849329f46c5218f65022202e
- SHA1 ee2e6b4922963c39bb76a7de0ae991dbe634080c
- SHA512 34f9e83d27e7c142dbcc00e43ef0cd29f7caa6b94053a3d1e1d978e0d9d1c57cb1feabe578d6c9ff1a637486729c71e653efc84fa1bd808e7d1475075f61dffd
- SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx78SXzpn9t6M1XkSPsULMHiSNQ:gCSjGoLpWM6VsBEjx7ZdddtPlLqDu
- TLSH T19DA36C6AB68DB372D0F149B88E0DF2E57D387E300F1A185FB69E1F0E9A765C1190C196
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RCXDA99.tmp
- Size 91KB
- SHA256 3f9ef42982a7d0ea1b08b6134f1031b29979692a7b6dfbe89880ceb2fa09d725
- MD5 9e3d7580c0d94ef7c38d202d970f9150
- SHA1 5c47e90ac686767a71a5a7e1899429cd882b6032
- SHA512 4573eee4c4b3cca8073ea940df05ce312aa1d67f020a0eb61650d7433b4c0957c28b9b3b0b825b721814dd10c5c9cb05557b9889bcd870b5fbd1f44809f3fdf5
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxZ8SXzpn9t6nNT:YCSjGoLpWM6VsBEjxZZda5
- TLSH T165935C6AB28DB376D0F259B88E0DF2E5BD387E300E19185FB5AE2F0DDA761C1190C191
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXD7FD.tmp
- Size 118KB
- SHA256 89cbb2cf478f880adbc3526dfc3e7ce14145993269bd0fe89d1bb9d01a8ad0c6
- MD5 c49403c3412b8de8014cb9921775ef4b
- SHA1 01caf92f58345a157e13c5ef562eff93a48a7971
- SHA512 45f50c338af3a2ac101bf1d44e22e6dd58d709d1f387cec26b7c16e7a03920602f582cb270f3779655b8991b7efa5ed0105c84969379a66cfaade9f5b4f49aa3
- SSDEEP 1536:Y7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxZ8SXzpn9t6x4GZjzQwK5WW7VCnk:JCSjGoLpWM6VsBEjxZZdQe5BV0oH
- TLSH T184C3AE6AB68CB377C0E259B88E0DF2E57D697E300E19085FB59E2F0DDA7B5C1190C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe.Exe
- Size 642KB
- SHA256 f11b437080a61c66202028d81b56285916b2179d8d94d452c26b1ea7f6570a91
- MD5 1707625293a696734e66eb7af9d38281
- SHA1 b8aba91aa31f01f35643b0c773e815cb61086f0a
- SHA512 422b46ed8bed9e462bf46bbe7f706cb852db6d0851f8f116fd20de405e81b9fa1679a0a3f4f712c8b9f74a90c6a1e387eaa8b5b58193fced20e12a7b1859ad8a
- SSDEEP 6144:WXqoEuoXREiNYVLKZn56Vq2UjCpd0v5prE6v0GSxWUPZl1JP+1Lix7NGZIVuXQ8F:NXZNYVLeyUji0h90ZD0wxpGZIVuKrHs
- TLSH T19CE40715F66CB331D0F2C0B9C9DEB68AED713C411B3089CB5286876C6E676E6853A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe.Exe
- Size 783KB
- SHA256 cdc635d2036b6557b0dd776ae141cf71ab5bd32f7daa12d626bfe096e50e2c3c
- MD5 f4ecb416088d07f5ddb62fce4910cb27
- SHA1 67d9dd9ac59d061471c7e9d2794138996bae015f
- SHA512 12f49847c9824f4c259b1fd8e66aaa33f8e38090751673bcd7b3984bee2fcd1a584aaa7d7aebd4b8faea7c9d7ff563781928a005edc2087c0cef3c5d30dfad26
- SSDEEP 12288:yVJjBq33vb5O8M+l1D0hwsEBoW/lx4Zf0Im98:yVbqPb88hv/l+7
- TLSH T12105F766F56CB331D0F2C0B9C5DEB69AEE323C414B318ACB1246972C2E676D58636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\RCXCA39.tmp
- Size 91KB
- SHA256 06edeaa13e7da0d3ab56bdb400e8a80023f0a5fb3b950b8a9a062f933adcefdf
- MD5 ad942e07105b3aff7a979cadf80ebd0f
- SHA1 5f4611e459477c0b5e76bef377ae9a3d7c6d4b78
- SHA512 2d791e435a69c845f9832c772799aafa2f1ea4b60d1e4817d5aa700305ba1ebb5a39b91a26792857cc23f7a8feaaae386e164b9978c9855fba0ce0b691ffd6a4
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxm8SXzpn9t6FNL:YCSjGoLpWM6VsBEjxmZdcx
- TLSH T13E935C59B29CB376D0E259B8CD0DF2E5BD297E700E19089F75AE3F1DDA761C1190C281
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\RCXCABD.tmp
- Size 100KB
- SHA256 9f9ce258018d0df5ae050da060a8e7c6c8db2bea312ebbe730e1f27048966a09
- MD5 7c8ec887570a252159e349c7106e31c9
- SHA1 4fb990e2099289d15ef8a26f0821e018c21db969
- SHA512 2cb9d78e78a19624eec4b03266776b565996245e7a1f3f943c7face1966ce7a2e279f00eb41b04bec9151b2f362908243c3bd0937d0e9723b5e3d3f20de4dca4
- SSDEEP 1536:B7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxQ8SXzpn9t6eqkSZZZ3fNj:oCSjGoLpWM6VsBEjxQZdJUfJ
- TLSH T12AA35B5AB69CB3B2D0F189B89D0DF3E5BD397E300E59185BB2AD3B0E9A77181190C185
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\VideoLAN\VLC\RCXCAEF.tmp
- Size 92KB
- SHA256 fd5bc4a06d2120babcb85a02cbf5c8616f7589100837f95b618322ca03ed2266
- MD5 ad9f706c4206805574c7016a868a4f9c
- SHA1 bc17073cc7c60ac586be2ce5b74c3a83f315e8dc
- SHA512 f726d831e2f4f3ea1b50b33eedbeeab41dd1864881b2bb0d3b4dedd1af3e5a202804ead68ae89e81f7d4aee43900b165e86c9189aadc2c2c6fb548093a564b2d
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx+8SXzpn9t6lND:YCSjGoLpWM6VsBEjx+Zdop
- TLSH T1F4934C69B29CB376D0EE59BC8E0DF2E5BD297E300E19085B759E2F0DDA7A1C1190C18D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$a38AF.bat
- Size 842B
- SHA256 86fce928aa86da2bacc436035fd996d1f1d4488b2045c09e84131e35cb2fb38e
- MD5 bb3cb4c1c99d327b9de9f90bc94516b8
- SHA1 5a2b439404a744c07963c267f07fd0e5887343b5
- SHA512 cba254b1da3e3133f004a5634ac8e25024c6dc54462b45c742777cbf48d39f578db3fd19029320affe202a260bce8e0a1c6fddddaa203d9bfc1793ecbc8d4826
- TLSH T14301E9445E6E143A0F57850F09F6F9CF825696F417813B927F20870D23F6A09A5BB5F2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2026-04-16_4ee315d279badb77b708b44b73abeeeb_amadey_elex_manuscrypt_rhadamanthys_stop.exe.exe
- Size 80KB
- SHA256 06222f5319945568d31610d9397bad55125d7dce62f6cfcd3f0e4737324379e6
- MD5 51f9aa41b0bb9022c11c26559562443d
- SHA1 876e47c5bd34dd12805f8dc7548a08366cffa107
- SHA512 b49121fa0afe3a8b800ab6b26d80af2c2aa65e2c782a7bdd230aa22f9943d7fce1714eaa84d6471409881440f2a8adc6b300295fc50a4df37496368ddb22c621
- SSDEEP 1536:UlZ1PNq9uCUOFVSiHdq+sxne2FPo1065sPMgurHdCOSdBXke1:Ur1Pg9uCRFRzsxeuPo10JOSdBkK
- TLSH T193835B2179A0C132D8E355B449ECE2621A3E7A724B758CC3379413EE9EB03D19BB5367
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logo1_.exe
- Size 93KB
- SHA256 9f46acf000c40dbbcde70bde3cbfafea3dae71f2997665786d7bb17fea5d59c2
- MD5 09cd1b8c9a1334731ada1b70a4655328
- SHA1 71908d114eee3f2d7e12497daa8d691faa0368ac
- SHA512 40348402ba744a9868faff89ce50298d4d4143bcbdc7a7c0d4a525052a09281eaaf62b795d229093ed48d7e3d9f8c469c7191e0f3c0d37b496bd7d5dcf22c7bb
- SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxe8SXzpn9t6HN:gCSjGoLpWM6VsBEjxeZdi
- TLSH T1A9935C6AB29CB3B6D0F559B88E0DF2E5BD387E300F19185B75AE2F0DDA761C1190C186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 842B
- SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
- MD5 6f4adf207ef402d9ef40c6aa52ffd245
- SHA1 4b05b495619c643f02e278dede8f5b1392555a57
- SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
- TLSH T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
- MD5 SHA1 SHA512 TLSH