Analysis
- max time kernel
149s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
14/07/2026, 03:53
General
- Target 2026-07-14_5c594c1009d16a8ffcb51ade13df7224_elex_rhadamanthys_stop.exe
- Size 992KB
- Sample260714-ef6mwsf14s
- SHA256 4352b79a1e27fb322fe969fc7e7d77258ead8bffcc801be62e2a32368d61ae0b
Malware Config
Signatures
- Executes dropped EXE 20 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 26 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 41 IoCs
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 21 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-14_5c594c1009d16a8ffcb51ade13df7224_elex_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-14_5c594c1009d16a8ffcb51ade13df7224_elex_rhadamanthys_stop.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"2⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"3⤵
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\System32\GameInputSvc.exeC:\Windows\System32\GameInputSvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\GameInputSvc.exe"C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_12⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
elevation_service.exe
maintenanceservice.exe
OSE.EXE
elevation_service.exe
ArmReport.ini
ArmReport.ini
RdrManifest2.msi
AdobeARM.log
ArmUI.ini
Tmp35EB.tmp
Tmp4D0F.tmp
Tmp4D2F.tmp
perfhost.exe
AgentService.exe
GameInputSvc.exe
Locator.exe
ssh-agent.exe
PerceptionSimulationService.exe
ReFsDedupSvc.exe
SensorDataService.exe
TieringEngineService.exe
VSSVC.exe
alg.exe
msdtc.exe
snmptrap.exe
vds.exe
wbengine.exe
AppVClient.exe
memory/712-562-0x00000235736D0000-0x0000023573736000-memory.dmp
memory/712-563-0x00000235736D0000-0x0000023573736000-memory.dmp
memory/712-561-0x00007FF711050000-0x00007FF711466000-memory.dmp
memory/1328-599-0x00007FF624690000-0x00007FF6249B0000-memory.dmp
memory/1328-600-0x000002235EAC0000-0x000002235EB26000-memory.dmp
memory/1328-601-0x000002235EAC0000-0x000002235EB26000-memory.dmp
memory/1328-605-0x000002235EAC0000-0x000002235EB26000-memory.dmp
memory/1328-607-0x00007FF624690000-0x00007FF6249B0000-memory.dmp
memory/1468-629-0x00007FF7BA8F0000-0x00007FF7BA99D000-memory.dmp
memory/1468-553-0x000001C3584F0000-0x000001C358556000-memory.dmp
memory/1468-554-0x000001C3584F0000-0x000001C358556000-memory.dmp
memory/1468-552-0x00007FF7BA8F0000-0x00007FF7BA99D000-memory.dmp
memory/1816-583-0x000002016F230000-0x000002016F296000-memory.dmp
memory/1816-582-0x000002016F230000-0x000002016F296000-memory.dmp
memory/1816-581-0x00007FF651E70000-0x00007FF652112000-memory.dmp
memory/1928-573-0x0000023613FB0000-0x0000023614016000-memory.dmp
memory/1928-572-0x0000023613FB0000-0x0000023614016000-memory.dmp
memory/1928-571-0x00007FF7797D0000-0x00007FF779883000-memory.dmp
memory/2984-630-0x00007FF6F8910000-0x00007FF6F8E16000-memory.dmp
memory/2984-631-0x000001F9D1D20000-0x000001F9D1D86000-memory.dmp
memory/2984-632-0x000001F9D1D20000-0x000001F9D1D86000-memory.dmp
memory/3060-523-0x00007FF682FC0000-0x00007FF683109000-memory.dmp
memory/3060-525-0x0000024666410000-0x0000024666476000-memory.dmp
memory/3060-526-0x0000024666410000-0x0000024666476000-memory.dmp
memory/3060-610-0x00007FF682FC0000-0x00007FF683109000-memory.dmp
memory/3144-8-0x00000000030E0000-0x0000000003149000-memory.dmp
memory/3144-6-0x00000000030E0000-0x0000000003149000-memory.dmp
memory/3144-1-0x00000000030E0000-0x0000000003149000-memory.dmp
memory/3144-0-0x0000000002F10000-0x0000000002FF1000-memory.dmp
memory/3588-151-0x00007FF71C1A0000-0x00007FF71C2C2000-memory.dmp
memory/3588-17-0x0000019417120000-0x0000019417186000-memory.dmp
memory/3588-18-0x0000019417120000-0x0000019417186000-memory.dmp
memory/3588-16-0x0000019417120000-0x0000019417186000-memory.dmp
memory/3588-15-0x00007FF71C1A0000-0x00007FF71C2C2000-memory.dmp
memory/3676-589-0x00007FF609E90000-0x00007FF609F58000-memory.dmp
memory/3676-504-0x000001A909E80000-0x000001A909EE6000-memory.dmp
memory/3676-503-0x00007FF609E90000-0x00007FF609F58000-memory.dmp
memory/3676-505-0x000001A909E80000-0x000001A909EE6000-memory.dmp
memory/4152-532-0x0000000000400000-0x00000000004AD000-memory.dmp
memory/4152-533-0x00000000009D0000-0x0000000000A39000-memory.dmp
memory/4152-617-0x0000000000400000-0x00000000004AD000-memory.dmp
memory/4152-538-0x00000000009D0000-0x0000000000A39000-memory.dmp
memory/4396-621-0x00007FF787CA0000-0x00007FF788170000-memory.dmp
memory/4396-622-0x000001BCC7A00000-0x000001BCC7A66000-memory.dmp
memory/4396-620-0x000001BCC7A00000-0x000001BCC7A66000-memory.dmp
memory/4400-591-0x000001A06E2B0000-0x000001A06E316000-memory.dmp
memory/4400-590-0x00007FF688780000-0x00007FF688914000-memory.dmp
memory/4400-592-0x000001A06E2B0000-0x000001A06E316000-memory.dmp
memory/4564-612-0x0000024E47C10000-0x0000024E47C76000-memory.dmp
memory/4564-613-0x0000024E47C10000-0x0000024E47C76000-memory.dmp
memory/4564-611-0x00007FF69E6B0000-0x00007FF69E93A000-memory.dmp
memory/4648-598-0x00007FF6010F0000-0x00007FF601209000-memory.dmp
memory/4648-513-0x0000021C3DBD0000-0x0000021C3DC36000-memory.dmp
memory/4648-511-0x00007FF6010F0000-0x00007FF601209000-memory.dmp
memory/4648-512-0x0000021C3DBD0000-0x0000021C3DC36000-memory.dmp
memory/4708-126-0x000001C6D3540000-0x000001C6D35A6000-memory.dmp
memory/4708-125-0x000001C6D3360000-0x000001C6D341C000-memory.dmp
memory/4708-127-0x000001C6D3540000-0x000001C6D35A6000-memory.dmp
memory/4828-117-0x0000016679800000-0x00000166798BC000-memory.dmp
memory/4828-118-0x00000166799E0000-0x0000016679A46000-memory.dmp
memory/4828-119-0x00000166799E0000-0x0000016679A46000-memory.dmp
memory/5236-580-0x00007FF609E90000-0x00007FF609F58000-memory.dmp
memory/5236-494-0x00007FF609E90000-0x00007FF609F58000-memory.dmp
memory/5236-495-0x000002238D480000-0x000002238D4E6000-memory.dmp
memory/5236-496-0x000002238D480000-0x000002238D4E6000-memory.dmp
memory/5428-145-0x000002ABF5AF0000-0x000002ABF5BAC000-memory.dmp
memory/5428-146-0x000002ABF5C80000-0x000002ABF5CE6000-memory.dmp
memory/5428-147-0x000002ABF5C80000-0x000002ABF5CE6000-memory.dmp
memory/5768-142-0x00007FF7C7EF0000-0x00007FF7C8057000-memory.dmp
memory/5768-133-0x00007FF7C7EF0000-0x00007FF7C8057000-memory.dmp
memory/5768-134-0x0000024A2ED80000-0x0000024A2EDE6000-memory.dmp
memory/5768-135-0x0000024A2ED80000-0x0000024A2EDE6000-memory.dmp
memory/5768-140-0x0000024A2ED80000-0x0000024A2EDE6000-memory.dmp
memory/5912-544-0x00007FF62A980000-0x00007FF62B0C3000-memory.dmp
memory/5912-545-0x000001DF72090000-0x000001DF720F6000-memory.dmp
memory/5912-627-0x00007FF62A980000-0x00007FF62B0C3000-memory.dmp
memory/5912-546-0x000001DF72090000-0x000001DF720F6000-memory.dmp