Analysis
- max time kernel
141s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
20/07/2026, 02:22
General
- Target 2026-07-20_f845cadd64419dec00fd3a3b846bdc2d_elex_rhadamanthys_stop.exe
- Size 992KB
- Sample260720-ctq39ae16t
- SHA256 10b18a5fe877034ef2916d6539be35ce4216e26ac5ebc2b834c722be2bf484bf
Malware Config
Signatures
- Executes dropped EXE 21 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 25 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 41 IoCs
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 24 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_f845cadd64419dec00fd3a3b846bdc2d_elex_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_f845cadd64419dec00fd3a3b846bdc2d_elex_rhadamanthys_stop.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"3⤵
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\System32\GameInputSvc.exeC:\Windows\System32\GameInputSvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\GameInputSvc.exe"C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_12⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
elevation_service.exe
maintenanceservice.exe
7z.exe
7zFM.exe
7zG.exe
Uninstall.exe
AppVShNotify.exe
IntegratedOffice.exe
MavInject32.exe
OfficeC2RClient.exe
appvcleaner.exe
LICLUA.EXE
OSE.EXE
VSTOInstaller.exe
chrmstp.exe
setup.exe
chrome_pwa_launcher.exe
elevated_tracing_service.exe
elevation_service.exe
notification_helper.exe
os_update_handler.exe
chrome_proxy.exe
appletviewer.exe
extcheck.exe
idlj.exe
jabswitch.exe
jar.exe
jarsigner.exe
java-rmi.exe
java.exe
javac.exe
javadoc.exe
javafxpackager.exe
javah.exe
javap.exe
javapackager.exe
javaw.exe
javaws.exe
jcmd.exe
jconsole.exe
dotnet.exe
ArmReport.ini
RdrManifest2.msi
AdobeARM.log
ArmUI.ini
TmpA157.tmp
TmpB8C9.tmp
TmpB8E9.tmp
perfhost.exe
AgentService.exe
GameInputSvc.exe
Locator.exe
ssh-agent.exe
ReFsDedupSvc.exe
SearchIndexer.exe
SensorDataService.exe
TieringEngineService.exe
VSSVC.exe
alg.exe
msdtc.exe
snmptrap.exe
vds.exe
WmiApSrv.exe
wbengine.exe
AppVClient.exe
PerceptionSimulationService.exe
memory/892-533-0x0000000000860000-0x00000000008C9000-memory.dmp
memory/892-527-0x0000000000400000-0x00000000004AD000-memory.dmp
memory/892-528-0x0000000000860000-0x00000000008C9000-memory.dmp
memory/892-608-0x0000000000400000-0x00000000004AD000-memory.dmp
memory/1184-580-0x00007FF777280000-0x00007FF777522000-memory.dmp
memory/1184-647-0x00007FF777280000-0x00007FF777522000-memory.dmp
memory/1184-582-0x00000289E2380000-0x00000289E23E6000-memory.dmp
memory/1184-581-0x00000289E2380000-0x00000289E23E6000-memory.dmp
memory/1260-619-0x0000023B49300000-0x0000023B49366000-memory.dmp
memory/1260-618-0x0000023B49300000-0x0000023B49366000-memory.dmp
memory/1260-617-0x00007FF7C1DC0000-0x00007FF7C2290000-memory.dmp
memory/1344-148-0x000001468A990000-0x000001468A9F6000-memory.dmp
memory/1344-147-0x000001468A990000-0x000001468A9F6000-memory.dmp
memory/1344-146-0x000001468A7A0000-0x000001468A861000-memory.dmp
memory/1360-570-0x00007FF762C50000-0x00007FF762D03000-memory.dmp
memory/1360-571-0x000001D323190000-0x000001D3231F6000-memory.dmp
memory/1360-572-0x000001D323190000-0x000001D3231F6000-memory.dmp
memory/1360-644-0x00007FF762C50000-0x00007FF762D03000-memory.dmp
memory/1620-649-0x00007FF797C30000-0x00007FF797F6E000-memory.dmp
memory/1620-648-0x0000019A27120000-0x0000019A27186000-memory.dmp
memory/1620-650-0x0000019A27120000-0x0000019A27186000-memory.dmp
memory/1660-588-0x00007FF79A1D0000-0x00007FF79A2E9000-memory.dmp
memory/1660-508-0x0000014E2C1B0000-0x0000014E2C216000-memory.dmp
memory/1660-507-0x0000014E2C1B0000-0x0000014E2C216000-memory.dmp
memory/1660-506-0x00007FF79A1D0000-0x00007FF79A2E9000-memory.dmp
memory/2252-637-0x00007FF78E680000-0x00007FF78E7AE000-memory.dmp
memory/2252-638-0x00000211BA8F0000-0x00000211BA956000-memory.dmp
memory/2252-639-0x00000211BA8F0000-0x00000211BA956000-memory.dmp
memory/2256-118-0x0000019B306E0000-0x0000019B30746000-memory.dmp
memory/2256-117-0x0000019B30610000-0x0000019B306D1000-memory.dmp
memory/2256-119-0x0000019B306E0000-0x0000019B30746000-memory.dmp
memory/2352-502-0x00000233B5D90000-0x00000233B5DF6000-memory.dmp
memory/2352-501-0x00007FF7B3530000-0x00007FF7B35F8000-memory.dmp
memory/2352-503-0x00000233B5D90000-0x00000233B5DF6000-memory.dmp
memory/2352-579-0x00007FF7B3530000-0x00007FF7B35F8000-memory.dmp
memory/2412-589-0x00007FF7A2900000-0x00007FF7A2A94000-memory.dmp
memory/2412-697-0x00007FF7A2900000-0x00007FF7A2A94000-memory.dmp
memory/2412-591-0x000001A1AC640000-0x000001A1AC6A6000-memory.dmp
memory/2412-590-0x000001A1AC640000-0x000001A1AC6A6000-memory.dmp
memory/2612-492-0x00007FF7B3530000-0x00007FF7B35F8000-memory.dmp
memory/2612-493-0x000002AB3FCF0000-0x000002AB3FD56000-memory.dmp
memory/2612-494-0x000002AB3FCF0000-0x000002AB3FD56000-memory.dmp
memory/2612-569-0x00007FF7B3530000-0x00007FF7B35F8000-memory.dmp
memory/3360-702-0x00007FF63CC10000-0x00007FF63CE9A000-memory.dmp
memory/3360-609-0x00007FF63CC10000-0x00007FF63CE9A000-memory.dmp
memory/3360-611-0x0000025453B40000-0x0000025453BA6000-memory.dmp
memory/3360-610-0x0000025453B40000-0x0000025453BA6000-memory.dmp
memory/3472-133-0x00007FF7E8C00000-0x00007FF7E8D22000-memory.dmp
memory/3472-17-0x0000023FC7E10000-0x0000023FC7E76000-memory.dmp
memory/3472-18-0x0000023FC7E10000-0x0000023FC7E76000-memory.dmp
memory/3472-15-0x00007FF7E8C00000-0x00007FF7E8D22000-memory.dmp
memory/3472-16-0x0000023FC7E10000-0x0000023FC7E76000-memory.dmp
memory/3500-7-0x0000000001A50000-0x0000000001AB9000-memory.dmp
memory/3500-0-0x0000000001A50000-0x0000000001AB9000-memory.dmp
memory/3500-3-0x0000000003270000-0x0000000003394000-memory.dmp
memory/3500-6-0x0000000001A50000-0x0000000001AB9000-memory.dmp
memory/4196-136-0x0000022436870000-0x00000224368D6000-memory.dmp
memory/4196-143-0x00007FF62EA90000-0x00007FF62EBF7000-memory.dmp
memory/4196-141-0x0000022436870000-0x00000224368D6000-memory.dmp
memory/4196-134-0x00007FF62EA90000-0x00007FF62EBF7000-memory.dmp
memory/4196-135-0x0000022436870000-0x00000224368D6000-memory.dmp
memory/5092-521-0x000002A727710000-0x000002A727776000-memory.dmp
memory/5092-597-0x00007FF634540000-0x00007FF634689000-memory.dmp
memory/5092-518-0x00007FF634540000-0x00007FF634689000-memory.dmp
memory/5092-520-0x000002A727710000-0x000002A727776000-memory.dmp
memory/5316-559-0x00007FF71EAA0000-0x00007FF71EEB6000-memory.dmp
memory/5316-560-0x0000022204F00000-0x0000022204F66000-memory.dmp
memory/5316-561-0x0000022204F00000-0x0000022204F66000-memory.dmp
memory/5316-698-0x0000022204F00000-0x0000022204F66000-memory.dmp
memory/5316-700-0x00007FF71EAA0000-0x00007FF71EEB6000-memory.dmp
memory/5316-636-0x00007FF71EAA0000-0x00007FF71EEB6000-memory.dmp
memory/5324-598-0x00000152D8FE0000-0x00000152D9046000-memory.dmp
memory/5324-599-0x00000152D8FE0000-0x00000152D9046000-memory.dmp
memory/5324-603-0x00000152D8FE0000-0x00000152D9046000-memory.dmp
memory/5324-605-0x00007FF6A1E30000-0x00007FF6A2150000-memory.dmp
memory/5324-701-0x00007FF6A1E30000-0x00007FF6A2150000-memory.dmp
memory/5436-125-0x000002C75EE40000-0x000002C75EF01000-memory.dmp
memory/5436-126-0x000002C75EF60000-0x000002C75EFC6000-memory.dmp
memory/5436-127-0x000002C75EF60000-0x000002C75EFC6000-memory.dmp
memory/5568-625-0x00007FF658490000-0x00007FF658BD3000-memory.dmp
memory/5568-543-0x0000021850320000-0x0000021850386000-memory.dmp
memory/5568-544-0x0000021850320000-0x0000021850386000-memory.dmp
memory/5568-542-0x00007FF658490000-0x00007FF658BD3000-memory.dmp
memory/5960-626-0x0000024040AD0000-0x0000024040B36000-memory.dmp
memory/5960-629-0x0000024040AD0000-0x0000024040B36000-memory.dmp
memory/5960-627-0x00007FF687DA0000-0x00007FF6882A6000-memory.dmp
memory/6028-550-0x00007FF69B410000-0x00007FF69B4BD000-memory.dmp
memory/6028-551-0x0000013D4B730000-0x0000013D4B796000-memory.dmp
memory/6028-552-0x0000013D4B730000-0x0000013D4B796000-memory.dmp
memory/6028-628-0x00007FF69B410000-0x00007FF69B4BD000-memory.dmp