4417c0fce3c111da77e139b40c8a94e7fbae6a945950b1291ec57d82c0ecefdb

General

Target
2026-06-01_31f27009bb05eef2b778dd8690611bb7_elex_rhadamanthys_stop.exe
Size 339KB
Sample260601-a4ef4acy7j
SHA256 4417c0fce3c111da77e139b40c8a94e7fbae6a945950b1291ec57d82c0ecefdb
MD5 31f27009bb05eef2b778dd8690611bb7
SHA1 ba14978c04e6b65e84bf116f09711b3281f87d7c
SHA512 92142635609444b4b95c70fd26e5afd4049409d24bde1a970b6b97dc07967e41cee6a05e233548fff09e3382686cb6966bd0ea96e841956b7ac7368715b8af53
SSDEEP 3072:5gpgFOdpFd9iKhda0p8gdRZ46aT+TZ4jWYH+YTK9awIi7HQiqCweym0as5ASP:5Wgad99AgdRLBEh729ZIYjKm0ZP
TLSH
T1B47408472D464CC4EC4E5571853C95EB99FF6E6AAFE0818F279873CA0DF239414B31A2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
2364	zgokr00.exe
2540	.2026-06-01_31f27009bb05eef2b778dd8690611bb7_elex_rhadamanthys_stop.exe
888	vshost32.exe
1180	vshost32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Run\ScdBcd = "C:\\Users\\Admin\\AppData\\Roaming\\Dibifu_9\\vshost32.exe"	vshost32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Run\ScdBcd = "C:\\Users\\Admin\\AppData\\Roaming\\Dibifu_9\\vshost32.exe"	vshost32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-01_31f27009bb05eef2b778dd8690611bb7_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zgokr00.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	.2026-06-01_31f27009bb05eef2b778dd8690611bb7_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vshost32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vshost32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3468	2026-06-01_31f27009bb05eef2b778dd8690611bb7_elex_rhadamanthys_stop.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3468	2026-06-01_31f27009bb05eef2b778dd8690611bb7_elex_rhadamanthys_stop.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3468 wrote to memory of 2364	3468	2026-06-01_31f27009bb05eef2b778dd8690611bb7_elex_rhadamanthys_stop.exe	80
PID 3468 wrote to memory of 2540	3468	2026-06-01_31f27009bb05eef2b778dd8690611bb7_elex_rhadamanthys_stop.exe	81
PID 2364 wrote to memory of 888	2364	zgokr00.exe	83
PID 2364 wrote to memory of 1812	2364	zgokr00.exe	84
PID 1812 wrote to memory of 3776	1812	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-06-01_31f27009bb05eef2b778dd8690611bb7_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-01_31f27009bb05eef2b778dd8690611bb7_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3468
- C:\Users\Admin\AppData\Local\Temp\zgokr00.exe
  "C:\Users\Admin\AppData\Local\Temp\zgokr00.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Users\Admin\AppData\Roaming\Dibifu_9\vshost32.exe
    "C:\Users\Admin\AppData\Roaming\Dibifu_9\vshost32.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:888
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del C:\Users\Admin\AppData\Local\Temp\zgokr00.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1812
  - - C:\Windows\SysWOW64\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      System Location Discovery: System Language Discovery
      PID:3776
- C:\Users\Admin\AppData\Local\Temp\.2026-06-01_31f27009bb05eef2b778dd8690611bb7_elex_rhadamanthys_stop.exe
  "C:\Users\Admin\AppData\Local\Temp\.2026-06-01_31f27009bb05eef2b778dd8690611bb7_elex_rhadamanthys_stop.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2540

C:\Users\Admin\AppData\Roaming\Dibifu_9\vshost32.exe
C:\Users\Admin\AppData\Roaming\Dibifu_9\vshost32.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.2026-06-01_31f27009bb05eef2b778dd8690611bb7_elex_rhadamanthys_stop.exe

Path C:\Users\Admin\AppData\Local\Temp\.2026-06-01_31f27009bb05eef2b778dd8690611bb7_elex_rhadamanthys_stop.exe
Size 74KB
SHA256 292d1cbb545f4f8817e5d0c71fbcd77904907a333874174578c2c7ff3e1b0b5d
MD5 eb16d96e39e3bc82edcad6df3ca7e94b
SHA1 66e6d4bc164c8ef4311261241ecf14d066b03104
SHA512 66b300b88c5665b3bdff948107ca137742f9120ce04f9c1fe5137d78aa50e8dc21a06d5a3052f2ea3f1012528c0d3143dadc1d1c85e64d38c133200968db3e5c
SSDEEP 1536:eBpEFySi8XveMWNa5Vjnm0S/N+5AfaDBCH:eweym0as5AS0
TLSH
T17F735A0A7D53D477D8428A7089E4C6C25FBFB8033BA6D0ABFF9506490D922DC563A2B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zgokr00.exe

Path C:\Users\Admin\AppData\Local\Temp\zgokr00.exe
Size 265KB
SHA256 01d3a98beb45bfdf3c549e8ba8aeee267e36b3c8db8cbe101155f100c6803082
MD5 99f5c1e92d17edbea0b10abf2b310f53
SHA1 974d7e572c61ae16ae9b700f015423ef396b7be9
SHA512 adafba8eff594a60708c7aa4410287441438f2ced385419d952bc99e93d717835e7ec92d0320cd15f9ff21764d357a61a075874b803bd91af3fb4d2a8d121a84
SSDEEP 3072:5gpgFOdpFd9iKhda0p8gdRZ46aT+TZ4jWYH+YTK9awIi7HQiq:5Wgad99AgdRLBEh729ZIYj
TLSH
T19144D6572D454CC4EC4E1531853DA9EF99FB5E6EEFE086CE2698B3CA09F279014B3092
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2364-19-0x0000000004CE0000-0x0000000004CF0000-memory.dmp

Download

memory/3468-0-0x0000000000F10000-0x0000000000F58000-memory.dmp

Download

memory/3468-1-0x0000000005FA0000-0x0000000006546000-memory.dmp

Download

memory/3468-2-0x0000000005A90000-0x0000000005B22000-memory.dmp

Download

memory/3468-3-0x0000000005A80000-0x0000000005A90000-memory.dmp

Download

memory/3468-4-0x0000000005A10000-0x0000000005A1A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads