1e527b5f9fd9664f417a9e3b932421218c94a13baec654a70d52663f964acea8

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_0d26d20f78162595614cbf4bff9ffa04_elex_rhadamanthys_stop.exe
Size 61KB
Sample260730-wtqx2add49
SHA256 1e527b5f9fd9664f417a9e3b932421218c94a13baec654a70d52663f964acea8
MD5 0d26d20f78162595614cbf4bff9ffa04
SHA1 d202ff84db06ff95c9c2ff74ec35fc4c3b7b2912
SHA512 3ba070f925cfb98d5159221fd10246d1ddb06795ef3921a3be6ba897bed0e17a52d37f190aa39de341f0e1b0ca3dd2dc84b9006eb9af12408e6ec9f0a0e928b1
SSDEEP 1536:Zttdse4OcUmWQIvEPZo6E5sEFd29NQgA2w6TNle5:Zdse4OlQZo6EKEFdGM29le5
TLSH
T144538C55B2E9C075E5A209F17A3D9A91C9FEBD3826A0D1C7D3111C876EB0192D23938B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
2672	ewiuer2.exe
2468	ewiuer2.exe
4896	ewiuer2.exe
5660	ewiuer2.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ewiuer2.exe	ewiuer2.exe
File opened for modification	C:\Windows\SysWOW64\ewiuer2.exe	ewiuer2.exe
File opened for modification	C:\Windows\SysWOW64\viesazm.mpk	ewiuer2.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_0d26d20f78162595614cbf4bff9ffa04_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ewiuer2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ewiuer2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ewiuer2.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5908 wrote to memory of 2672	5908	2026-07-30_0d26d20f78162595614cbf4bff9ffa04_elex_rhadamanthys_stop.exe	88
PID 2672 wrote to memory of 2468	2672	ewiuer2.exe	91
PID 2468 wrote to memory of 4896	2468	ewiuer2.exe	92
PID 4896 wrote to memory of 5660	4896	ewiuer2.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-07-30_0d26d20f78162595614cbf4bff9ffa04_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_0d26d20f78162595614cbf4bff9ffa04_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5908
- C:\Users\Admin\AppData\Roaming\ewiuer2.exe
  C:\Users\Admin\AppData\Roaming\ewiuer2.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Windows\SysWOW64\ewiuer2.exe
    C:\Windows\System32\ewiuer2.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2468
  - - C:\Users\Admin\AppData\Roaming\ewiuer2.exe
      C:\Users\Admin\AppData\Roaming\ewiuer2.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4896
    - - C:\Windows\SysWOW64\ewiuer2.exe
        
        C:\Windows\System32\ewiuer2.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ewiuer2.exe

Path C:\Users\Admin\AppData\Roaming\ewiuer2.exe
Size 61KB
SHA256 194d3e4867acf01b57486dd97ab14fd6a18d6d1a2a048542344b4bdaa2db135c
MD5 aa6b57d2efe2b26c09975103ea03a2b0
SHA1 9d8ecd252fede730c15b0454defc310269948aa7
SHA512 c68c53c910c5f7c808cbfe398336f403b93d9f9957b6d78a0321b4da1cc3a2c6f8329bf8631b6c2b8a048dfe650eedb071d89d9bac2c6160465077b2c995159a
SSDEEP 1536:Ittdse4OcUmWQIvEPZo6E5sEFd29NQgA2w6TNle5:4dse4OlQZo6EKEFdGM29le5
TLSH
T190538C55B2E9C075E5A209F17A3D9A91C9FEBD3826A0D1C7D3111C8B6EB0192D23938B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ewiuer2.exe

Path C:\Users\Admin\AppData\Roaming\ewiuer2.exe
Size 61KB
SHA256 61a8ae97366ec25e73d5e661e39d96c8e3384067beca1404ee4816af819a3c01
MD5 4965a7ef31c89db3a55acb910cc0f915
SHA1 a9cdaf0e00bc752b80d40a0fc4b6ff0943b4298f
SHA512 71b2eb1e970f8edc65d9e2bdbf6f9a3021291e0eb844db87981d4491fed0b42626ce19bb46fab521c553a5857d0463f1b683fcd0fd2edac6b070b5b33e4b377c
SSDEEP 1536:Vttdse4OcUmWQIvEPZo6E5sEFd29NQgA2w6TNle5:9dse4OlQZo6EKEFdGM29le5
TLSH
T1BC538C55B2E9C075E5A209F17A3D9A91C9FEBD3826A0D1C7D3111C8B6EB0192D23938B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ewiuer2.exe

Path C:\Windows\SysWOW64\ewiuer2.exe
Size 61KB
SHA256 5a87ba527ba13e02dc3e030f6cf405f983c646c673b84fad2ab1cfd12855a5b0
MD5 fd92e213c54ca795c44d5dee3be55a62
SHA1 bc9277b12131fb2f9bc3d9fa13bf16fa4d0db343
SHA512 619918aa3997ebd4e974c54ca83268bed34a1149d1c0cf3ab24a740157f6d36abd694e5f80b163a8e1924aa622c2cae9412e9b2628c378e44278bfaf13486320
SSDEEP 1536:Lttdse4OcUmWQIvEPZo6E5sEFd29NQgA2w6TNle5:7dse4OlQZo6EKEFdGM29le5
TLSH
T1E8538C55B2E9C075E5A209F17A3D9A91C9FEBD3826A0D1C7D3111C8B6EB0192D23938B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ewiuer2.exe

Path C:\Windows\SysWOW64\ewiuer2.exe
Size 61KB
SHA256 21f6ce0ae1fbda7d5dd2423b5bd249ae1060600b179decd09c41c9576ed52639
MD5 e3aeee609843abd41b3b22c26eddb802
SHA1 e0bf559b530bfdb0ac757507aacc4defff605ce9
SHA512 b7ce08007872d4ac1fc8307859abfa194470693d0aafbe2b8ce03209ad31b7aef424abeed4a38fc2d786cc51ab4051a8545414c62a845265a2efe8b37e84de34
SSDEEP 1536:kttdse4OcUmWQIvEPZo6E5sEFd29NQgA2w6TNle5:cdse4OlQZo6EKEFdGM29le5
TLSH
T15E538C55B2E9C075E5A309F17A3D9A91C9FEBD3826A0D1C7D3111C8B6EB0192D23938B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads