313d592f52976cae9472fe0523c4eeb20b0cff18a300b4c431f65ec3e207fd43

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20250619-en
resource tags

arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2026, 10:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_5f226befeef26555f1ef2a080c8bb06e_elex_rhadamanthys_stop.exe
Size 61KB
Sample260511-mk1lfaft4s
SHA256 313d592f52976cae9472fe0523c4eeb20b0cff18a300b4c431f65ec3e207fd43
MD5 5f226befeef26555f1ef2a080c8bb06e
SHA1 01b1d2786433b5947cabd396dbab73798a8de8cb
SHA512 a1164327a2ca0ced10a7cefb9aa3b8e1be263fcf12aafd2ebacdbef7f7d418eacd317c9d5fff8ed7d8a8e55689d8f477939e5797794365f9c67c5b97af1438f8
SSDEEP 1536:XO6skYL5TDbCY7fjPpm7GVOFAwfU4lXa:skw517fjPQiwf9lXa
TLSH
T1E2537B85B2F5C076E5E208F07A7DEA91C9FEBE3415A4D4C3D351588B6CB01A2D63A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
2868	dlhpb0.exe
3408	ca91oly1l.exe
4124	dlhpb0.exe
3004	ca91oly1l.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bn7e9jf = "C:\\Users\\Admin\\AppData\\Roaming\\dlhpb0.exe"	2026-05-11_5f226befeef26555f1ef2a080c8bb06e_elex_rhadamanthys_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8vf8xcn = "C:\\Users\\Admin\\AppData\\Roaming\\ca91oly1l.exe"	dlhpb0.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ca91oly1l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ca91oly1l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dlhpb0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_5f226befeef26555f1ef2a080c8bb06e_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dlhpb0.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5684 wrote to memory of 2868	5684	2026-05-11_5f226befeef26555f1ef2a080c8bb06e_elex_rhadamanthys_stop.exe	83
PID 2868 wrote to memory of 3408	2868	dlhpb0.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-05-11_5f226befeef26555f1ef2a080c8bb06e_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_5f226befeef26555f1ef2a080c8bb06e_elex_rhadamanthys_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5684
- C:\Users\Admin\AppData\Roaming\dlhpb0.exe
  C:\Users\Admin\AppData\Roaming\dlhpb0.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Users\Admin\AppData\Roaming\ca91oly1l.exe
    C:\Users\Admin\AppData\Roaming\ca91oly1l.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3408

C:\Users\Admin\AppData\Roaming\dlhpb0.exe
C:\Users\Admin\AppData\Roaming\dlhpb0.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4124

C:\Users\Admin\AppData\Roaming\ca91oly1l.exe
C:\Users\Admin\AppData\Roaming\ca91oly1l.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ca91oly1l.exe

Path C:\Users\Admin\AppData\Roaming\ca91oly1l.exe
Size 61KB
SHA256 33f96068881e72d2e17248003fd2f7de7126c82f04c419a65afd78dfc25ad358
MD5 28aae8e2c853c46f58bfe3d1fd2fef52
SHA1 a6d972bc2747f3aa02103dc4117863fca9fb39e5
SHA512 89c9321f1ddb2be09c0a8661d3441da754b685238391cf5f6be4815cbf14be9c6b0a1eee5ead0b62ad8ec86f1e8af7e9d5c19057826925a1af5a62a69a9f5128
SSDEEP 1536:rO6skYL5TDbCY7fjPpm7GVOFAwfU4lXa:wkw517fjPQiwf9lXa
TLSH
T1E0537B85B2F5C076E5E208F07A7DEA91C9FEBE3415A4D4C3D351588B6CB01A2D63A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dlhpb0.exe

Path C:\Users\Admin\AppData\Roaming\dlhpb0.exe
Size 61KB
SHA256 ffffb56fa35d5bd1dcace3c405ef9fd74cef8b10c1e42d9b7451320d16395a6a
MD5 8e4dbdd42d2a80a0920a45ebf59b1b42
SHA1 cd1557890fb7d08f0bf03f5b7861080249826d81
SHA512 0ad89a4e10ba2501c7462c65cb33c08f7e35a21b735752c920db67adeaf98fea827258833214a69ab170df926d90add90d3d24da2bcdfe8bf755970f52756568
SSDEEP 1536:iO6skYL5TDbCY7fjPpm7GVOFAwfU4lXa:Xkw517fjPQiwf9lXa
TLSH
T1FA537B85B2F5C076E5E208F07A7DEA91C9FEBE3415A4D4C3D351588B6CB01A2D63A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads