0c6c9a7a7a134c9dca77c17ca8509a430e70e23bbe4867f9f097712c5a3a909f

General

Target
2026-07-28_3ad2002ea3464074e6977936ccdd12be_elex_rhadamanthys_stop.exe
Size 61KB
Sample260728-26b8ascd86
SHA256 0c6c9a7a7a134c9dca77c17ca8509a430e70e23bbe4867f9f097712c5a3a909f
MD5 3ad2002ea3464074e6977936ccdd12be
SHA1 9f1acb1aa5373f7e07f5202800a114d64d862c39
SHA512 d54be4d3ccf26502ab09b3452d229a2157e16cced1e1b0c8ce9a8ebc2b74302ba5fd56f73820bed3c7830c95c0ce23fc64dd95bc98b3759a3d4a60342d5e73fd
SSDEEP 768:eeJIvFKPZo2smEasjcj29NWngAHxcwKppEaxglaX5uA:eQIvEPZo6Ead29NQgA2wzle5
TLSH
T124538D9172F5803AE2B249B56D3E8981C9BEBD7826B0C5C6D3114C8B6DB41C2D93F763
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 7 IoCs

pid	Process
3512	ewiuer2.exe
6084	ewiuer2.exe
244	ewiuer2.exe
3124	ewiuer2.exe
5644	ewiuer2.exe
4976	ewiuer2.exe
1876	ewiuer2.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ewiuer2.exe	ewiuer2.exe
File opened for modification	C:\Windows\SysWOW64\ewiuer2.exe	ewiuer2.exe
File opened for modification	C:\Windows\SysWOW64\ewiuer2.exe	ewiuer2.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ewiuer2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ewiuer2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_3ad2002ea3464074e6977936ccdd12be_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ewiuer2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ewiuer2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ewiuer2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ewiuer2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ewiuer2.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3868 wrote to memory of 3512	3868	2026-07-28_3ad2002ea3464074e6977936ccdd12be_elex_rhadamanthys_stop.exe	89
PID 3512 wrote to memory of 6084	3512	ewiuer2.exe	91
PID 6084 wrote to memory of 244	6084	ewiuer2.exe	92
PID 244 wrote to memory of 3124	244	ewiuer2.exe	93
PID 3124 wrote to memory of 5644	3124	ewiuer2.exe	94
PID 5644 wrote to memory of 4976	5644	ewiuer2.exe	95
PID 4976 wrote to memory of 1876	4976	ewiuer2.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-07-28_3ad2002ea3464074e6977936ccdd12be_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_3ad2002ea3464074e6977936ccdd12be_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3868
- C:\Users\Admin\AppData\Roaming\ewiuer2.exe
  C:\Users\Admin\AppData\Roaming\ewiuer2.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3512
- - C:\Windows\SysWOW64\ewiuer2.exe
    C:\Windows\System32\ewiuer2.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6084
  - - C:\Users\Admin\AppData\Roaming\ewiuer2.exe
      C:\Users\Admin\AppData\Roaming\ewiuer2.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:244
    - - C:\Windows\SysWOW64\ewiuer2.exe
        
        C:\Windows\System32\ewiuer2.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3124
      - C:\Users\Admin\AppData\Roaming\ewiuer2.exe
        
        C:\Users\Admin\AppData\Roaming\ewiuer2.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5644
        
        C:\Windows\SysWOW64\ewiuer2.exe
        
        C:\Windows\System32\ewiuer2.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4976
        
        C:\Users\Admin\AppData\Roaming\ewiuer2.exe
        
        C:\Users\Admin\AppData\Roaming\ewiuer2.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ewiuer2.exe

Path C:\Users\Admin\AppData\Roaming\ewiuer2.exe
Size 61KB
SHA256 13e3b5b55ca6bc04c85c868405d243c22cb89c9d3e37a8b6db6b936521af1a89
MD5 89eff3ddce80d0708db170a84b248909
SHA1 c25967876bfe005e6e216685f97253ad53fd6b28
SHA512 733e9646180f20842158a8d72f89d23c992faa8143d6ff85158413c4f91cca2cd04e17bac8ecadbcce73950a3d42ed32372aeec16f017f31e7d717c880cd80c0
SSDEEP 768:OeJIvFKPZo2smEasjcj29NWngAHxcwKppEaxglaX5uA:OQIvEPZo6Ead29NQgA2wzle5
TLSH
T194538D9172F5803AE2B249B56D3E8981C9BEBD7826B0C5C6D3114C8B6DB41C2D53F763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ewiuer2.exe

Path C:\Users\Admin\AppData\Roaming\ewiuer2.exe
Size 61KB
SHA256 8a6647b7fe591c2b9836f237a172c937efecf90de601d9f68d49db783cecf92f
MD5 c059224e0bf098cbc944cd66904e72a2
SHA1 e6981a4505b16b2f5d8e08d0bcbc10a20be8171a
SHA512 e174a9cff71d6087e2c69bacc8d40c24bbb59f26e0985bce9f7d786eff2d73f5eca4b7f882193411adc91cbb7bae0cdccc19a1e17cf9e52441f1465e60d50ec5
SSDEEP 768:EeJIvFKPZo2smEasjcj29NWngAHxcwKppEaxglaX5uA:EQIvEPZo6Ead29NQgA2wzle5
TLSH
T10E538D9172F5803AE2B249B56D3E8981C9BEBD7826B0C5C6D3114C8B6DB41C2D93F763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ewiuer2.exe

Path C:\Users\Admin\AppData\Roaming\ewiuer2.exe
Size 61KB
SHA256 62866605aaf7e3e433318a7c17261653a4623306d2b5e083fc1474cbbbeed5a8
MD5 48ab33767a4af9ac720049c4576b641e
SHA1 28201252442620347a62516b0153c9856c1932e2
SHA512 b02f93b5bbdbcb44c90a2733fea1171ba937afce6e04d7364d87de8c0c40f1f8c5dd35f6d3417da42fc2eb49526c41dd140138afdbbb0b7d11bf45b075f4c1e0
SSDEEP 768:CeJIvFKPZo2smEasjcj29NWngAHxcwKppEaxglaX5uA:CQIvEPZo6Ead29NQgA2wzle5
TLSH
T1B7538D9172F5803AE2B249B56D3E8981C9BEBD7826B0C5C6D3114C8B6DB41C2D93F763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ewiuer2.exe

Path C:\Users\Admin\AppData\Roaming\ewiuer2.exe
Size 61KB
SHA256 f35d2500450b30787b6dd9d654dbf68d9bb31277ce5655eca8b5f343007c576a
MD5 647edff3eee96f73b879706702a38dd6
SHA1 7635149347742b15c8dab1737da6d1fb6cb513fb
SHA512 7955ef5a29881dc17b07281af33b9d678c15d233d084dc6d27eddc4371b7d52d3ca5c75d9d5f759fefdd3248ae7b48fc67450988983dc7aaa03ce37f89063a82
SSDEEP 768:deJIvFKPZo2smEasjcj29NWngAHxcwKppEaxglaX5uA:dQIvEPZo6Ead29NQgA2wzle5
TLSH
T134538D9172F5803AE2B249B56D3E8981C9BEBD7826B0C5C6D3114C8B6DB41C2D93F763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ewiuer2.exe

Path C:\Windows\SysWOW64\ewiuer2.exe
Size 61KB
SHA256 74f4bc95e948e70f3dcde8554247587375e93c84d9e368be9bca91d5da631d2a
MD5 d2b4462eda2cc94c59622743d00e6092
SHA1 0905cd7e69101f381e4943ba306a1f59f799a17e
SHA512 345c13f0b93479642ab93b2d1ef83e995e259c137fe4b1d0554a1c5a00a38c99e73aa126f08c5de742736e3482a62679c28039da15afc3be5c4917b96ecafb27
SSDEEP 768:seJIvFKPZo2smEasjcj29NWngAHxcwKppEaxglaX5uA:sQIvEPZo6Ead29NQgA2wzle5
TLSH
T140538D9172F5803AE2B249B56D3E8981C9BEBD7826B0C5C6D3114C8B6DB41C2D93F763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ewiuer2.exe

Path C:\Windows\SysWOW64\ewiuer2.exe
Size 61KB
SHA256 6eea711953b3e5e98e3e6f3a6aa4a98cc2d8dee975a4541e18f5480f789256fa
MD5 c8a18f630029ce2a508a28c89d6cc1d0
SHA1 5ce4df777fe0b973125fc92e6ecbdc45e713507d
SHA512 4d3aad340661fc048aee16dcdc05b1d64fd000f53398bc97d146de3a43065f9e99fd24563c9e8682ff2e55d037e5f19e52a470180e1844848053e6c15d1d674d
SSDEEP 768:BeJIvFKPZo2smEasjcj29NWngAHxcwKppEaxglaX5uA:BQIvEPZo6Ead29NQgA2wzle5
TLSH
T17F538D9172F5803AE2B249B56D3E8981C9BEBD7826B0C5C6D3114C8B6DB41C2D93F763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ewiuer2.exe

Path C:\Windows\SysWOW64\ewiuer2.exe
Size 61KB
SHA256 ffbb1e837db130fe22dfdf8b6f5352bf1b9ff529215e974d86d58d650908c6cb
MD5 0428ed3742117b5ceafef7dcb1901fd7
SHA1 e368fa555bd2cf3fba43069a2a84f0d52196ea5a
SHA512 9e23df1df76b3b80128f99226ee82c70ae49ba43230634039bd7f45dcd3d7449398f87544b4e5d1f05edaf38b4d7863ea215b97b93e95cd07d7e9b1e742ca173
SSDEEP 768:aeJIvFKPZo2smEasjcj29NWngAHxcwKppEaxglaX5uA:aQIvEPZo6Ead29NQgA2wzle5
TLSH
T139538D9172F5803AE2B249B56D3E8981C9BEBD7826B0C5C6D3114C8B6DB41C2D93F763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads