bf4a5e5c5b73c627a15480b4ff459ab40ab5a2debf0c08034a88334a7bc563b2

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20250619-en
resource tags

arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2026, 08:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-07_9e78806c08f9894344ccf17459a062ea_elex_rhadamanthys_stop.exe
Size 61KB
Sample260507-kppcvsas6s
SHA256 bf4a5e5c5b73c627a15480b4ff459ab40ab5a2debf0c08034a88334a7bc563b2
MD5 9e78806c08f9894344ccf17459a062ea
SHA1 8d3d18a8ad1fe6bb64a977d83a03f51435762b40
SHA512 12f962e23e99b20e6b41c8c53fda72d30826e906021b491a9e9bc7d58344506788c8d70aaf76df8d378f6d081d2fc65f2599947ba9757c6df7a8c975f534fa13
SSDEEP 1536:7O6skYL5TDbCY7fjPpm7GVOFAwfUGlXa:Akw517fjPQiwfHlXa
TLSH
T16D537C95B2F5C076E5E208F07A7DAA91C8FEBE3415A4D4C3D351588B6CB01E2D63A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
1408	dlhpb0.exe
1424	drsh.exe
884	dlhpb0.exe
968	drsh.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bn7e9jf = "C:\\Users\\Admin\\AppData\\Roaming\\dlhpb0.exe"	2026-05-07_9e78806c08f9894344ccf17459a062ea_elex_rhadamanthys_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smqj6jcbq = "C:\\Users\\Admin\\AppData\\Roaming\\drsh.exe"	dlhpb0.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dlhpb0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-07_9e78806c08f9894344ccf17459a062ea_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dlhpb0.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3692 wrote to memory of 1408	3692	2026-05-07_9e78806c08f9894344ccf17459a062ea_elex_rhadamanthys_stop.exe	85
PID 1408 wrote to memory of 1424	1408	dlhpb0.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-05-07_9e78806c08f9894344ccf17459a062ea_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-07_9e78806c08f9894344ccf17459a062ea_elex_rhadamanthys_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Users\Admin\AppData\Roaming\dlhpb0.exe
  C:\Users\Admin\AppData\Roaming\dlhpb0.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\Users\Admin\AppData\Roaming\drsh.exe
    C:\Users\Admin\AppData\Roaming\drsh.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1424

C:\Users\Admin\AppData\Roaming\drsh.exe
C:\Users\Admin\AppData\Roaming\drsh.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:968

C:\Users\Admin\AppData\Roaming\dlhpb0.exe
C:\Users\Admin\AppData\Roaming\dlhpb0.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dlhpb0.exe

Path C:\Users\Admin\AppData\Roaming\dlhpb0.exe
Size 61KB
SHA256 925962b552254e5fd81215cc219dff820fc7590cee7ffa7392734b89159271a1
MD5 71e8f09fcd5a5574fb7753269eea1f62
SHA1 386e1d53b80de387b1c8cccf81982cc5037cc062
SHA512 3a1f63cf43857a44b5e8d543135f184f7a147e26517aaca06eef6923f86cf760d3fd7cd9aabe7de9ea1003db98ca39548044805e2cd19261b6d582c0e58ecd97
SSDEEP 1536:oO6skYL5TDbCY7fjPpm7GVOFAwfUGlXa:Bkw517fjPQiwfHlXa
TLSH
T1A2538C95B2F5C076E5E208F07A7DAA91C8FEBE3415A4D4C3D351588B6CB01E2D63A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drsh.exe

Path C:\Users\Admin\AppData\Roaming\drsh.exe
Size 61KB
SHA256 42c57f35b6a7e46337b26b5038fab513d2a0f5ee055b2b6d0b004d2106c2a6be
MD5 469fb33241e1125899d88023e5fc2175
SHA1 b11dbbf8f805d2fd71481ff79264f287f4871d39
SHA512 4e0a52d3ebadd7d4462c1c93772a474896049b7c5d6ca4f8e4c53970b743be631771953df9ea491d1a83069041e05fde2cea8995a34c313e849ea8a370422c9f
SSDEEP 1536:FO6skYL5TDbCY7fjPpm7GVOFAwfUGlXa:+kw517fjPQiwfHlXa
TLSH
T188538C95B2F5C076E5E208F07A7DAA91C8FEBE3415A4D4C3D351588B6CB01E2D63A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads