181930f90e61adcb16f805969b813727a4c1457107a6fb2793b2b5868d8af621

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 22:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_92bfd5813ce33e2c17e04b696f432c62_elex_maze_rhadamanthys_stealc_stop.exe
Size 2.5MB
Sample260710-19acfacw6l
SHA256 181930f90e61adcb16f805969b813727a4c1457107a6fb2793b2b5868d8af621
MD5 92bfd5813ce33e2c17e04b696f432c62
SHA1 1db7f15d6e23e8f3dc12cbc01def74255e99a28f
SHA512 f0c96e3ed48d68454a0774d63032b5c03e40e20d6149a8c53d49cd8e6c9ea82004b81eeab0c5727b58418181c96ff334f2b99f5468711128c236e5f79087cf01
SSDEEP 24576:Y/GNTPXNF0L+v4qG0j71Unr78BvBa2E5FnLq6BOzmGFv/9F6f6ogCzGjdnNT82ck:BNTPX++vgpoZ1r6Aw9dUny0o
TLSH
T1ADC53B527609B2CFD8862578D5A3CD82996D07BA4B2048C3AD6CB97E7E33CC115F6D38
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2364	4824	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_92bfd5813ce33e2c17e04b696f432c62_elex_maze_rhadamanthys_stealc_stop.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-10_92bfd5813ce33e2c17e04b696f432c62_elex_maze_rhadamanthys_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_92bfd5813ce33e2c17e04b696f432c62_elex_maze_rhadamanthys_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4824
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 344
  2⤵
  - Program crash
  PID:2364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 4824 -ip 4824
1⤵
PID:1524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4824-0-0x0000000000B50000-0x0000000000DD4000-memory.dmp

Download

memory/4824-1-0x0000000000B50000-0x0000000000DD4000-memory.dmp