39194b3e72415aecc701b9cfd34e702ece028bfbc38f533713189c0037d68a55

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 07:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_e7e7d3328a24e1adaab916f4123a34d2_elex_rhadamanthys_stop.exe
Size 61KB
Sample260802-jnm8qsfc48
SHA256 39194b3e72415aecc701b9cfd34e702ece028bfbc38f533713189c0037d68a55
MD5 e7e7d3328a24e1adaab916f4123a34d2
SHA1 b4ee93a95b9de12272166c4ec251f27887b9e3e9
SHA512 41437314e4bbdad26c9b2937e4f3dd8367803e2aca6aa28b20ae83cb2638120899282940018ad23ec8f46c3409ae5bbb70d9bf893b4c6bfdfa73056b9eaed687
SSDEEP 1536:cO6skYL5TDbCY7fjPpm7GVOFAwfU5lXa:1kw517fjPQiwfclXa
TLSH
T19A538B85B2F5C076E5E208F07A7DAA91C8FEBD3425A4D4C3D311588B6DB01E2D63A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
6120	sngcd.exe
3884	hh69.exe
1772	hh69.exe
2532	sngcd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\5f42oot = "C:\\Users\\Admin\\AppData\\Roaming\\sngcd.exe"	2026-08-02_e7e7d3328a24e1adaab916f4123a34d2_elex_rhadamanthys_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\kg2cn99 = "C:\\Users\\Admin\\AppData\\Roaming\\hh69.exe"	sngcd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sngcd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_e7e7d3328a24e1adaab916f4123a34d2_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sngcd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hh69.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hh69.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3788 wrote to memory of 6120	3788	2026-08-02_e7e7d3328a24e1adaab916f4123a34d2_elex_rhadamanthys_stop.exe	89
PID 6120 wrote to memory of 3884	6120	sngcd.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-02_e7e7d3328a24e1adaab916f4123a34d2_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_e7e7d3328a24e1adaab916f4123a34d2_elex_rhadamanthys_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3788
- C:\Users\Admin\AppData\Roaming\sngcd.exe
  C:\Users\Admin\AppData\Roaming\sngcd.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6120
- - C:\Users\Admin\AppData\Roaming\hh69.exe
    C:\Users\Admin\AppData\Roaming\hh69.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3884

C:\Users\Admin\AppData\Roaming\hh69.exe
C:\Users\Admin\AppData\Roaming\hh69.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1772

C:\Users\Admin\AppData\Roaming\sngcd.exe
C:\Users\Admin\AppData\Roaming\sngcd.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hh69.exe

Path C:\Users\Admin\AppData\Roaming\hh69.exe
Size 61KB
SHA256 a527611bede508e558fd03404ad5d2b5b0c879b4ca57511ab5346299dfac32cd
MD5 c576e7d08dca23754a876e21157139fa
SHA1 1b70b7710d4c511767dee70e973ef79adcf81281
SHA512 3f7ff894552f8433e1754de7afc604cf4bddbbb6a0aa07fc52fd5977efa2b1e70ae07796dd0cc5d3ddeb80988f5ef75890d5fc6324892b7b47f95381d56c16c3
SSDEEP 1536:RO6skYL5TDbCY7fjPpm7GVOFAwfU5lXa:6kw517fjPQiwfclXa
TLSH
T16C538B85B2F5C076E5E208F07A7DAA91C8FEBD3425A4D4C3D311588B6DB01E2D63A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sngcd.exe

Path C:\Users\Admin\AppData\Roaming\sngcd.exe
Size 61KB
SHA256 e4f801abaab09c4c0bb8e31084d680726138de380dbb174c72eb227ac5b4921b
MD5 3deae898854ff70fa4473b70ae3b6991
SHA1 dc3b9d52d3a80f8f7a54998470c7d03dd2733f55
SHA512 815693a384f76f0e3d1f8d0178b9491abd113545c230eefa6710e5365a89ddb47e4418abc9b620b6059a34696e08c00c07a8de9c4f95110bfece8d9e76a3ddd0
SSDEEP 1536:OO6skYL5TDbCY7fjPpm7GVOFAwfU5lXa:Dkw517fjPQiwfclXa
TLSH
T184538B85B2F5C076E5E208F07A7DAA91C8FEBD3425A4D4C3D311588B6DB01E2D63A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads