e249bc0003f6f0046b0c663e67209b4a90e8dad3d27006faaa547410fa0d56f1

Analysis

max time kernel
148s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 09:16

Target
2026-07-20_95e1220bf880f14ef00caf6ca8cd9fbe_elex_rhadamanthys_stop.exe
Size 148KB
Sample260720-k8rx4afv2z
SHA256 e249bc0003f6f0046b0c663e67209b4a90e8dad3d27006faaa547410fa0d56f1
MD5 95e1220bf880f14ef00caf6ca8cd9fbe
SHA1 ab21b13f4df33d5df405f20264447f568d85e53c
SHA512 a2af90c3303feed4c36191b4927d54cb8659d45159729c9f0c0204cbdfbf6c88cbfe06058aa4ff619ef291a1a373274a87cdf70fbc9b9833370de3106f6fd4e8
SSDEEP 1536:hkwph3LEMqIsk+DEDhqSrteUv3UC0rr9l8LFe5rV6Et7Ec9Eccdk1yq+Me61BW+n:zNqDVke5r/t7nXAq+MJLWFXkGN1sa31Y
TLSH
T1FFE3390279818272D83C0DF061FBCAD2CE3AEC8E66EDF053AFC84D560A512C157EA597
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

Disable or Modify System Firewall

pid	Process
4196	netsh.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_95e1220bf880f14ef00caf6ca8cd9fbe_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CheckNetIsolation.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CheckNetIsolation.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CheckNetIsolation.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 4196	4920	2026-07-20_95e1220bf880f14ef00caf6ca8cd9fbe_elex_rhadamanthys_stop.exe	88
PID 4920 wrote to memory of 3088	4920	2026-07-20_95e1220bf880f14ef00caf6ca8cd9fbe_elex_rhadamanthys_stop.exe	91
PID 4920 wrote to memory of 444	4920	2026-07-20_95e1220bf880f14ef00caf6ca8cd9fbe_elex_rhadamanthys_stop.exe	93
PID 4920 wrote to memory of 1472	4920	2026-07-20_95e1220bf880f14ef00caf6ca8cd9fbe_elex_rhadamanthys_stop.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-07-20_95e1220bf880f14ef00caf6ca8cd9fbe_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_95e1220bf880f14ef00caf6ca8cd9fbe_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name = "AnySign4PC" dir=in action=allow program="C:\Program Files (x86)\SoftForum\XecureWeb\AnySign\dll\AnySign4PC.exe" enable=yes
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4196
- C:\Windows\SysWOW64\CheckNetIsolation.exe
  "C:\Windows\System32\CheckNetIsolation.exe" LoopbackExempt -a -n=microsoft.microsoftedge_8wekyb3d8bbwe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3088
- C:\Windows\SysWOW64\CheckNetIsolation.exe
  "C:\Windows\System32\CheckNetIsolation.exe" LoopbackExempt -a -n=windows_ie_ac_001
  2⤵
  - System Location Discovery: System Language Discovery
  PID:444
- C:\Windows\SysWOW64\CheckNetIsolation.exe
  "C:\Windows\System32\CheckNetIsolation.exe" LoopbackExempt -a -n=windows_ie_ac_122
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1472