Overview

overview

7

Static

static

3

2026-07-30...op.exe

windows10-2004-x64

7

2026-07-30...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/07/2026, 16:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-30_f5ae5b60c06852f95d4a694c740f46b4_elex_rhadamanthys_stop.exe
  • Size 12.8MB
  • Sample260730-t88ehssdlb
  • SHA256 19327bade3cc1f78f9605b7454b9914a4a43fd1eb49df749d452f78d0448beaf
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwarediscoverypersistencespyware

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 20 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 38 IoCs
  • Drops file in Windows directory 14 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 21 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_f5ae5b60c06852f95d4a694c740f46b4_elex_rhadamanthys_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-30_f5ae5b60c06852f95d4a694c740f46b4_elex_rhadamanthys_stop.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:916
    • C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\setup32.exe
      setup32.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5216
      • C:\Windows\SysWOW64\msiexec.exe
        "C:\Windows\System32\msiexec.exe" /i "C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonToolbar.msi" /q /le+ "C:\Users\Admin\AppData\Roaming\Babylon\log_file.txt" REBOOT=ReallySuppress
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:3584
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5088
    • C:\Windows\syswow64\MsiExec.exe
      "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Babylon\Babylon Toolbar\BabylonIEToolBar.dll"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:5608
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding C8BB9E4F63C2B747CCDE622E597BC297
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3736
  • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
    "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
    1⤵
    • System Location Discovery: System Language Discovery
    PID:1060
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3664
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3664 CREDAT:17410 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:3044

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        e5ae3fc.rbs
        • Path C:\Config.Msi\e5ae3fc.rbs
        • Size 8KB
        • SHA256 6cfcab790e52d9c3cc799b572ed9645b3e7e24c7857cf3c6282fa365510f89df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BabylonIEToolBar.dll
        • Path C:\Program Files (x86)\Babylon\Babylon Toolbar\BabylonIEToolBar.dll
        • Size 258KB
        • SHA256 90e1ab5fa9f61722fccca5073981088b25991098adfda0f3b3620f9c2ff92c11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Babylon_English.bdc
        • Path C:\Program Files (x86)\Babylon\Babylon-Pro\Gloss\Babylon_English.bdc
        • Size 33.4MB
        • SHA256 82c038ada052597b977c3befe2c6fc6577b2084187f2995c77906f71718118b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Lookup_1d32.tmp
        • Path C:\Program Files (x86)\Babylon\Babylon-Pro\Gloss\Lookup_1d32.tmp
        • Size 67KB
        • SHA256 d0ad7ec5cad8ed150cffa3a3eb3d9f388bf9dcca59e21992ed3a9945e3e02820
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Lookup_64f2.tmp
        • Path C:\Program Files (x86)\Babylon\Babylon-Pro\Gloss\Lookup_64f2.tmp
        • Size 605KB
        • SHA256 7e5a696ee3e869c072882f711007ed3eef034aebbc0589ddcf8c194e7385bf66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bab_hlp_static.bdc
        • Path C:\Program Files (x86)\Babylon\Babylon-Pro\Gloss\bab_hlp_static.bdc
        • Size 495KB
        • SHA256 a87a15fcca19edb0e1562f6b45d20a1ed73bec372b0495923071d12387ef5a4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BContentServer.dll
        • Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\BContentServer.dll
        • Size 2.0MB
        • SHA256 be08ad1c597b95d32ff9a730501d52669ebb881d1acf4a8e070fccdf45e7b7de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BException.dll
        • Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\BException.dll
        • Size 99KB
        • SHA256 67379917c10d87811064176a90b72f7627f32db07a1fa7df282920fd79629b62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BabyServices.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\BabyServices.DLL
        • Size 866KB
        • SHA256 ef5aafa48a61557f2a50452c242dc93b8e20b343ae4c37827cb28d8250309ecf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Babylon.chm
        • Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\Babylon.chm
        • Size 64KB
        • SHA256 4127c015b738c57d70b793a705812b64ef3ee727678cd1396f4b79ffdab80987
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Babylon.dat
        • Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\Babylon.dat
        • Size 18KB
        • SHA256 0f0558e57fd42c964e84c0740c919b8a0c2aea116ef4f67c10de1aaf88749618
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Babylon.exe
        • Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\Babylon.exe
        • Size 2.9MB
        • SHA256 c3fe5576a5ef51595a443ab48cbde841560ec19b954af7d4d16d42936d94301b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BabylonIEPI.dll
        • Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\BabylonIEPI.dll
        • Size 119KB
        • SHA256 14da7e08620daf1428a32ddd948011bce6271329b4bc67dcceb0c1eb112350a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BabylonOfficePI.dll
        • Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\BabylonOfficePI.dll
        • Size 175KB
        • SHA256 554b692be56eafa68768580c14f3aafde250380178618fcce1e8374a65a4ead1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BabylonRPI.api
        • Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\BabylonRPI.api
        • Size 140KB
        • SHA256 51904cd4b6292ae295ebfd385728c9203977b1b260a55c990d23ddfb4b17673b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BabylonToolbar.msi
        • Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\BabylonToolbar.msi
        • Size 645KB
        • SHA256 b73cd4bcb58fd675485cb54f2fc505901c6972b6a5fe6736badfc6083d6c5ada
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Babylon_English.BGL
        • Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\Babylon_English.BGL
        • Size 6.9MB
        • SHA256 c233f80d598b45b4a55d2afb4d3d3d0d29da2f1361a8a9e7770346b7de73821c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CSConfig.dat
        • Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\CSConfig.dat
        • Size 917B
        • SHA256 e4f6e83a9bc9aa404462c36f21890ba57b6964fe967ab87a83d1c34b124c85ee
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ConciseOxfordEnglishDict_sub.BGL
        • Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\ConciseOxfordEnglishDict_sub.BGL
        • Size 1.1MB
        • SHA256 4148a6a081bbc7ecee9abefb3a0c6b5775302f4312082e73560221fb9064e006
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ConciseOxfordThesaurus_sub.BGL
        • Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\ConciseOxfordThesaurus_sub.BGL
        • Size 95KB
        • SHA256 8a456b10c588797831a4f0c88d45c1ec8b056a32d57f182b96e5e164c787ee5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Convert.dat
        • Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\Convert.dat
        • Size 17KB
        • SHA256 e42af808b1ca6adc9fc1983547be67d2dcabb0725bd62d996cadd6ea782c5f54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        EULA.rtf
        • Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\EULA.rtf
        • Size 102KB
        • SHA256 63e24c56e4a2d9e829e0b0971089d4190323218072ba68d3f18b263085754f31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Features.dat
        • Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\Features.dat
        • Size 19KB
        • SHA256 7b00088db34e2eedf478874a0162a64d53c6ece1bc11e880f1764a5a7dfa0e55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        FileNames.dat
        • Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\FileNames.dat
        • Size 1KB
        • SHA256 9d79b3611b1e947b4ca3a26fc9b50b8e7b62ae1da0c94eadbee947bec9bbac67
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Metaphone.dat
        • Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\Metaphone.dat
        • Size 46KB
        • SHA256 3fa1acfc63fd3dbcf4be34d81b98eb5ae39e04bd166189b33701dda33312e87b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Rates.dat
        • Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\Rates.dat
        • Size 3KB
        • SHA256 20b0fcf60e0a6a3bc38473d6d6aaf3d5e90ca50217cd48aa18e334bf5d1b4111
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Setup32.exe
        • Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\Setup32.exe
        • Size 644KB
        • SHA256 e0a731eb6a8e1b61d3d67ed40af4efcd816095476152ed8b0b763be790dce76d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Strings.dat
        • Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\Strings.dat
        • Size 256KB
        • SHA256 080a0a5561fd933c7971472e20dde4dcc78bc14e8440c780eea68525a97ae444
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bab_hlp_static.bgl
        • Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\bab_hlp_static.bgl
        • Size 172KB
        • SHA256 4bd96abb3c180787750199a7229b0f4fe408dc0bbba3e852b1e0c53f20f82644
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        babca.dat
        • Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\babca.dat
        • Size 193B
        • SHA256 d84d012919d1da86a488ce57e234087613a54fe4bfd905937095dbb54dcb56c0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        captlib.dll
        • Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\captlib.dll
        • Size 174KB
        • SHA256 571339f304eae7007196fe3bf45e33dd7dde39092db569fb9c11dab53918b819
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        uninstbb.exe
        • Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\uninstbb.exe
        • Size 294KB
        • SHA256 4dc391c9f308fbe115a217861036e9f40619d4308fc1aa31c695b7912d3e7d47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        log_file.txt
        • Path C:\Users\Admin\AppData\Roaming\Babylon\log_file.txt
        • Size 4KB
        • SHA256 0412518a090a3fae3db8dbeda705ca6ca5fdf723149c6b5741e230779de1b7b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/5216-65-0x0000000007160000-0x0000000007183000-memory.dmp
        Download

        memory/5216-73-0x0000000007160000-0x0000000007190000-memory.dmp
        Download

        memory/5216-81-0x0000000007160000-0x0000000007188000-memory.dmp
        Download

        memory/5216-89-0x0000000007650000-0x000000000785B000-memory.dmp
        Download

        memory/5216-44-0x00000000034B0000-0x00000000034B1000-memory.dmp
        Download

        memory/5216-38-0x0000000002F80000-0x000000000305E000-memory.dmp
        Download