689ca804778e8bfbd513e4dd77ded4db8c0cd8528f49bc8f12bdd7af5bab45ff

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/05/2026, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-23_51550f9bb17752c3c4fad1c2f1ac5410_elex_rhadamanthys_stop.exe
Size 61KB
Sample260523-2bmesabw2l
SHA256 689ca804778e8bfbd513e4dd77ded4db8c0cd8528f49bc8f12bdd7af5bab45ff
MD5 51550f9bb17752c3c4fad1c2f1ac5410
SHA1 cd918aefb839cd54cfffe5206220ffa213d8f960
SHA512 5c07fa3b4460c52a3106976c6d24268854b81eeedfccfb7e059e4e10bffc910908c13c59415b2f75086ded47b3f8d91d24204c0dfca99443f3a2262cd5fc03b9
SSDEEP 1536:bO6skYL5TDbCY7fjPpm7GVOFAwfUbblXa:gkw517fjPQiwfilXa
TLSH
T11C538B95B2F5C076E5E208F07A7DAA91C8FEBE3425A0D4C3D351588B6DB0192D23A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
648	jrc0.exe
2808	363sy6qvk.exe
3796	jrc0.exe
2972	363sy6qvk.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Run\qvuu55 = "C:\\Users\\Admin\\AppData\\Roaming\\jrc0.exe"	2026-05-23_51550f9bb17752c3c4fad1c2f1ac5410_elex_rhadamanthys_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Run\ar54ozo = "C:\\Users\\Admin\\AppData\\Roaming\\363sy6qvk.exe"	jrc0.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-23_51550f9bb17752c3c4fad1c2f1ac5410_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jrc0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	363sy6qvk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jrc0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	363sy6qvk.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 648	4920	2026-05-23_51550f9bb17752c3c4fad1c2f1ac5410_elex_rhadamanthys_stop.exe	80
PID 648 wrote to memory of 2808	648	jrc0.exe	81

C:\Users\Admin\AppData\Local\Temp\2026-05-23_51550f9bb17752c3c4fad1c2f1ac5410_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-23_51550f9bb17752c3c4fad1c2f1ac5410_elex_rhadamanthys_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Users\Admin\AppData\Roaming\jrc0.exe
  C:\Users\Admin\AppData\Roaming\jrc0.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:648
- - C:\Users\Admin\AppData\Roaming\363sy6qvk.exe
    C:\Users\Admin\AppData\Roaming\363sy6qvk.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2808

C:\Users\Admin\AppData\Roaming\jrc0.exe
C:\Users\Admin\AppData\Roaming\jrc0.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3796

C:\Users\Admin\AppData\Roaming\363sy6qvk.exe
C:\Users\Admin\AppData\Roaming\363sy6qvk.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

363sy6qvk.exe

Path C:\Users\Admin\AppData\Roaming\363sy6qvk.exe
Size 61KB
SHA256 4ca391af3b0d02dbe42e45ef4304d4cb78cecb592a76f2994276abcf9b3ecc5e
MD5 77d47b5bbd7fede3f5aba8282276ad29
SHA1 afcec3ec0450a1fa7ee3dbcc32d9b7f2ed8933f0
SHA512 0e44fcd50b1ef1212d9f58c4b6c003e057f457cd65d95270c857f4a6740914d51d52931bf8b4612d5170b493df9ed3edfb8215dc84d9ea8188b2a5d2aff6f362
SSDEEP 1536:4O6skYL5TDbCY7fjPpm7GVOFAwfUbblXa:Rkw517fjPQiwfilXa
TLSH
T19D538B95B2F5C076E5E208F07A7DAA91C9FEBE3425A0D4C3D351588B6DB0192D23A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrc0.exe

Path C:\Users\Admin\AppData\Roaming\jrc0.exe
Size 61KB
SHA256 cc867bcced959d790162af0001d0cf3b1780c083acd267f653f0bf758c8225b8
MD5 7c24dc99ff9f55ee915e8e5082400b56
SHA1 d7cefdf4e9d4415b6b999f5dfe01cb403010b519
SHA512 02c4d9f39d6f38ffe5d3cd8ac8fbb42a58fadb44a1edeff2ff2f5cd1bc27767e5dc03b774deabb16f0a297520015148e412dc9dbc72f284f709c1704e06ca9e7
SSDEEP 1536:NO6skYL5TDbCY7fjPpm7GVOFAwfUbblXa:Wkw517fjPQiwfilXa
TLSH
T1B5538B95B2F5C076E5E208F07A7DAA91C8FEBE3425A0D4C3D351588B6DB0192D23A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads