8b1ab62437eed88402ce35af8c0c58a408f3f158cbecfaabb7d91644220c0282

General

Target
2026-05-08_479abfb8e4158edb4c1f953cc75f645c_elex_rhadamanthys_stop.exe
Size 217KB
Sample260508-1yllbsey8z
SHA256 8b1ab62437eed88402ce35af8c0c58a408f3f158cbecfaabb7d91644220c0282
MD5 479abfb8e4158edb4c1f953cc75f645c
SHA1 a780c50f1143b8b8acb5dd6f732156c37ce38b7d
SHA512 e47e2b933df9c27bfa9a27f7942ebc510577c9f9af41b9359c6b821aec2ad0ccfbda10403153f6316fbdd42f520728768228be11934026298cc8c82952ff6959
SSDEEP 3072:vr+FuiRj/n1Y4p4giOctUhcl9aWxM7714eyAhdcv:+Rj/9gtUNWxDidcv
TLSH
T165247B13F640C0B1C442023544AAF746863EFE95CAB155D33AE5738E6D32796AA37B8F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery upx

Malware Config

Signatures

Custom signature

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral1/files/0x000a00000002166e-7.dat	UPX
behavioral1/memory/6028-12-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

Drops file in Drivers directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\winlogon.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\drivers\winlogon.exe	2026-05-08_479abfb8e4158edb4c1f953cc75f645c_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\SysWOW64\drivers\winlogon.exe	winlogon.exe
File created	C:\Windows\SysWOW64\drivers\Msvbvm60.dll	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Msvbvm60.dll	winlogon.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	2026-05-08_479abfb8e4158edb4c1f953cc75f645c_elex_rhadamanthys_stop.exe
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	winlogon.exe

Executes dropped EXE 3 IoCs

pid	Process
6028	AE 0124 BE.exe
5780	winlogon.exe
3200	winlogon.exe

Loads dropped DLL 1 IoCs

pid	Process
3200	winlogon.exe

Drops autorun.inf file 1 TTPs 24 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	\??\N:\Autorun.inf	winlogon.exe
File opened for modification	\??\P:\Autorun.inf	winlogon.exe
File opened for modification	\??\T:\Autorun.inf	winlogon.exe
File opened for modification	\??\W:\Autorun.inf	winlogon.exe
File opened for modification	D:\Autorun.inf	winlogon.exe
File opened for modification	F:\Autorun.inf	winlogon.exe
File opened for modification	\??\I:\Autorun.inf	winlogon.exe
File opened for modification	\??\L:\Autorun.inf	winlogon.exe
File opened for modification	\??\M:\Autorun.inf	winlogon.exe
File opened for modification	\??\O:\Autorun.inf	winlogon.exe
File opened for modification	\??\Q:\Autorun.inf	winlogon.exe
File opened for modification	\??\U:\Autorun.inf	winlogon.exe
File opened for modification	\??\H:\Autorun.inf	winlogon.exe
File opened for modification	\??\R:\Autorun.inf	winlogon.exe
File opened for modification	\??\S:\Autorun.inf	winlogon.exe
File opened for modification	\??\V:\Autorun.inf	winlogon.exe
File opened for modification	\??\X:\Autorun.inf	winlogon.exe
File opened for modification	\??\Y:\Autorun.inf	winlogon.exe
File opened for modification	\??\Z:\Autorun.inf	winlogon.exe
File opened for modification	\??\E:\Autorun.inf	winlogon.exe
File opened for modification	\??\K:\Autorun.inf	winlogon.exe
File opened for modification	C:\Autorun.inf	winlogon.exe
File opened for modification	\??\G:\Autorun.inf	winlogon.exe
File opened for modification	\??\J:\Autorun.inf	winlogon.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000a00000002166e-7.dat	upx
behavioral1/memory/6028-12-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\AE 0124 BE.exe	2026-05-08_479abfb8e4158edb4c1f953cc75f645c_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\AE 0124 BE.exe	2026-05-08_479abfb8e4158edb4c1f953cc75f645c_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Msvbvm60.dll	2026-05-08_479abfb8e4158edb4c1f953cc75f645c_elex_rhadamanthys_stop.exe
File created	C:\Windows\Msvbvm60.dll	2026-05-08_479abfb8e4158edb4c1f953cc75f645c_elex_rhadamanthys_stop.exe
File created	C:\Windows\AE 0124 BE.exe	winlogon.exe
File opened for modification	C:\Windows\Msvbvm60.dll	winlogon.exe
File created	C:\Windows\AE 0124 BE.exe	winlogon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AE 0124 BE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-08_479abfb8e4158edb4c1f953cc75f645c_elex_rhadamanthys_stop.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	2026-05-08_479abfb8e4158edb4c1f953cc75f645c_elex_rhadamanthys_stop.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1352	2026-05-08_479abfb8e4158edb4c1f953cc75f645c_elex_rhadamanthys_stop.exe
5780	winlogon.exe
3200	winlogon.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 6028	1352	2026-05-08_479abfb8e4158edb4c1f953cc75f645c_elex_rhadamanthys_stop.exe	86
PID 1352 wrote to memory of 5780	1352	2026-05-08_479abfb8e4158edb4c1f953cc75f645c_elex_rhadamanthys_stop.exe	87
PID 5780 wrote to memory of 3200	5780	winlogon.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-05-08_479abfb8e4158edb4c1f953cc75f645c_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-08_479abfb8e4158edb4c1f953cc75f645c_elex_rhadamanthys_stop.exe"
1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Windows\AE 0124 BE.exe
  "C:\Windows\AE 0124 BE.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6028
- C:\Windows\SysWOW64\drivers\winlogon.exe
  "C:\Windows\System32\drivers\winlogon.exe"
  2⤵
  - Drops file in Drivers directory
  - Checks computer location settings
  - Executes dropped EXE
  - Drops autorun.inf file
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5780
- - C:\Windows\SysWOW64\drivers\winlogon.exe
    "C:\Windows\System32\drivers\winlogon.exe"
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AE 0124 BE.exe

Path C:\Windows\AE 0124 BE.exe
Size 217KB
SHA256 4344629b2132b0f749e92329c83bce504c94f4956d80a99c0106e1800222e47b
MD5 cced7f901f44d19e39164c66c28412e7
SHA1 c7e3c192733075db6ee7cac0e61ee14ae3a9e075
SHA512 bd0547e16323dfe2d8651db7c09254cf4705ccc0fa1a13ff595b784b8d058c975d7f0ac5970ee253fc3ccc7af594abb1275c9bda5a7400728e9f05cedc691443
SSDEEP 3072:PiVj/n1Y4p4gdOctUhcl9aWxM7714eyAhdcv:KVj/9xtUNWxDidcv
TLSH
T147248C13F650D0B1C402023940AAF706567DEE95CAB054D33EE5B28E6D32796A73BB8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Msvbvm60.dll

Path C:\Windows\Msvbvm60.dll
Size 1.4MB
SHA256 898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
MD5 25f62c02619174b35851b0e0455b3d94
SHA1 4e8ee85157f1769f6e3f61c0acbe59072209da71
SHA512 f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
SSDEEP 24576:/NqrWz23mmOittiMQVZb2NOTGTZg2REA7qc+vM597KXNWU8fSV2z3PNGvCQSIjuT:/NQimtzbQVB2PpEVa2XNWUISV20AIq
TLSH
T102659E1337D08162D7A3653449176379B7BC6D119836ED4BAFA0394F2D33B01A72BB2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winlogon.exe

Path C:\Windows\SysWOW64\drivers\winlogon.exe
Size 235KB
SHA256 8b52ea46a040d5652c0af4d8180fea9098e413217ff4a9a01c481c33b71b6ebb
MD5 9c3480ce0cf6fdb26c0488c04b65f407
SHA1 c7f79a969c6de1795469e340e5860d35adcdad3c
SHA512 79f4708c847bf5974e5cb017016cee01e863494ee1f63e9c941a2c4311023527b9cc03bd4aeb7a7446d6564960fae1a3fcdb93ce078845b46a21cf2f34627518
SSDEEP 3072:vr+FuiRj/n1Y4p4gEiOctUhcl9aWxM7714eyAhdv6I+Hn:+Rj/9VtUNWxDidvOHn
TLSH
T1C5348B13F741C0B1C442023944AAF746427EBE95CAA155D33AE5738F2D32796AA3BB4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B1uv3nth3x1.diz

Path \??\c:\B1uv3nth3x1.diz
Size 21B
SHA256 814649b436ea43dd2abb99693e06019d4079ee74d02a0395913add0ba92d0189
MD5 9cceaa243c5d161e1ce41c7dad1903dd
SHA1 e3da72675df53fffa781d4377d1d62116eafb35b
SHA512 af9b75dc9a0b39d12d48bf6d40eb7d778eb9dd976302792271d8d4245a916027cf4e705d6cd7a5e6582ba94953346f291122f27d377b2c1a86e45f49e92efb5b
MD5 SHA1 SHA512

Submit Download

memory/6028-12-0x0000000000400000-0x000000000040A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads