23005aac6de2406b97fba90bf9d47930d195f14f6155198be53f6ea8b014e3d7

Analysis

max time kernel
149s
max time network
97s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_fb49387cb58f63f948fe605a14378679_elex_rhadamanthys_stop.exe
Size 101KB
Sample260511-pp7xesh12x
SHA256 23005aac6de2406b97fba90bf9d47930d195f14f6155198be53f6ea8b014e3d7
MD5 fb49387cb58f63f948fe605a14378679
SHA1 a88d74e984e6febea1adb0a992dbc0c6e6e4f1f4
SHA512 c6be348cb3ec661f4e962e7572288cd057da6b26569458a9225df66a52f8e2b3529c152476e521bea2009e7d4780b9588db3b3027a7b6d7276b3feedb3904ed9
SSDEEP 768:93YfIBB6ZTBgMtgBKO9/Bxexv6/XWSfRPoE/ayEsHsHBxDm6kv:lYfzZTBgMtgBKOX8eXDfRQpDm6
TLSH
T1B6A32AA1D9C0D5F2F85466B331DA7B629A74F53A032156D3F3942C2168213D53E7B38E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5056	1008	WerFault.exe	78
4260	1008	WerFault.exe	78

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_fb49387cb58f63f948fe605a14378679_elex_rhadamanthys_stop.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-11_fb49387cb58f63f948fe605a14378679_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_fb49387cb58f63f948fe605a14378679_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 232
  2⤵
  - Program crash
  PID:5056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 236
  2⤵
  - Program crash
  PID:4260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1008 -ip 1008
1⤵
PID:5008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1008 -ip 1008
1⤵
PID:3112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads