405a4509f4ed9c19d2675b2b71c4432311fc49531ecd939413818555e243e8fa

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 08:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_067af0497eda6553ed22afbaf20418b0_coinminer_elex_rhadamanthys_stop.exe
Size 786KB
Sample260804-kgdldsvhpe
SHA256 405a4509f4ed9c19d2675b2b71c4432311fc49531ecd939413818555e243e8fa
MD5 067af0497eda6553ed22afbaf20418b0
SHA1 cbace3f8d91dc691b5ea0443b030b02afa785e16
SHA512 40f3d942e6fbe4a0e1524dad816ea8ea92cc0c9f3e3624d4fa685ce4f6308f59ed29be3f8ea02199b9592f8529b5caa767553d6ff7eccbd2138c3121fbd2ebf2
SSDEEP 12288:pojgbLLjjqnbCMsiI7PSY9oSq4sq3I/0yU5C:pokfjqps37P59oosqZyuC
TLSH
T1D3058E15B75EC23BE8A600B4AEAE874D4D187F309B3804C3F1D59A7D16F06E15B3A627
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 7 IoCs

resource	yara_rule
behavioral2/memory/3500-0-0x0000000000400000-0x00000000004C6000-memory.dmp	UPX
behavioral2/files/0x000d00000001c519-8.dat	UPX
behavioral2/memory/1000-14-0x0000000000400000-0x00000000004C6000-memory.dmp	UPX
behavioral2/memory/1000-10-0x0000000000400000-0x00000000004C6000-memory.dmp	UPX
behavioral2/memory/3500-11-0x0000000000400000-0x00000000004C6000-memory.dmp	UPX
behavioral2/memory/3148-17-0x0000000000400000-0x00000000004C6000-memory.dmp	UPX
behavioral2/memory/1000-18-0x0000000000400000-0x00000000004C6000-memory.dmp	UPX

Deletes itself 1 IoCs

pid	Process
1000	a6046PpMhEoP7538.exe

Executes dropped EXE 2 IoCs

pid	Process
1000	a6046PpMhEoP7538.exe
3148	a6046PpMhEoP7538.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\a6046PpMhEoP7538 = "C:\\ProgramData\\a6046PpMhEoP7538.exe"	a6046PpMhEoP7538.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\a6046PpMhEoP7538 = "C:\\ProgramData\\a6046PpMhEoP7538.exe"	a6046PpMhEoP7538.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3500-0-0x0000000000400000-0x00000000004C6000-memory.dmp	upx
behavioral2/files/0x000d00000001c519-8.dat	upx
behavioral2/memory/1000-14-0x0000000000400000-0x00000000004C6000-memory.dmp	upx
behavioral2/memory/1000-10-0x0000000000400000-0x00000000004C6000-memory.dmp	upx
behavioral2/memory/3500-11-0x0000000000400000-0x00000000004C6000-memory.dmp	upx
behavioral2/memory/3148-17-0x0000000000400000-0x00000000004C6000-memory.dmp	upx
behavioral2/memory/1000-18-0x0000000000400000-0x00000000004C6000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_067af0497eda6553ed22afbaf20418b0_coinminer_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a6046PpMhEoP7538.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a6046PpMhEoP7538.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3500	2026-08-04_067af0497eda6553ed22afbaf20418b0_coinminer_elex_rhadamanthys_stop.exe
3500	2026-08-04_067af0497eda6553ed22afbaf20418b0_coinminer_elex_rhadamanthys_stop.exe
3500	2026-08-04_067af0497eda6553ed22afbaf20418b0_coinminer_elex_rhadamanthys_stop.exe
3500	2026-08-04_067af0497eda6553ed22afbaf20418b0_coinminer_elex_rhadamanthys_stop.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3500	2026-08-04_067af0497eda6553ed22afbaf20418b0_coinminer_elex_rhadamanthys_stop.exe
Token: SeDebugPrivilege	1000	a6046PpMhEoP7538.exe
Token: SeDebugPrivilege	3148	a6046PpMhEoP7538.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1000	a6046PpMhEoP7538.exe
1000	a6046PpMhEoP7538.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3500 wrote to memory of 1000	3500	2026-08-04_067af0497eda6553ed22afbaf20418b0_coinminer_elex_rhadamanthys_stop.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-04_067af0497eda6553ed22afbaf20418b0_coinminer_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_067af0497eda6553ed22afbaf20418b0_coinminer_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3500
- C:\ProgramData\a6046PpMhEoP7538.exe
  "C:\ProgramData\a6046PpMhEoP7538.exe" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_067af0497eda6553ed22afbaf20418b0_coinminer_elex_rhadamanthys_stop.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1000

C:\ProgramData\a6046PpMhEoP7538.exe
C:\ProgramData\a6046PpMhEoP7538.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

a6046PpMhEoP7538

Path C:\ProgramData\a6046PpMhEoP7538
Size 208B
SHA256 f5bd09ee015b6c3705c8c67dccc54b82b6b53fface2f39d1d54a23cf356c3f33
MD5 9bd7e22d8c05f3f32a9d80683cc8f217
SHA1 20479485f1da537cd14d680682c32a8c0c6145a0
SHA512 efd9f330690784e94a3c2d8089962c5c5839c5de29cd69129a422f519b73c37587a46fe0ae547a74858325363ee29eab32d51b749a8e6f851f35e31889546803
TLSH
T1F7D00255F3D3056FC4094531C30012CFD754830941E4404AC57040858FB14F92C54387
MD5 SHA1 SHA512 TLSH

Submit Download

a6046PpMhEoP7538.exe

Path C:\ProgramData\a6046PpMhEoP7538.exe
Size 786KB
SHA256 28c608da39f1104d7fb3775696c4da6592bd9bb5a176eef462129484bf6bc3ad
MD5 5e3e50481c38c68a6eed86eed65c2500
SHA1 e600458b1b6810faea8ac4e41ec91502f794f60c
SHA512 5cb054e33195d048f5800c158b7e4e8459281ff26e523fff45b46b1b499a7091a879bc1f9812e4c479888c2965073e9c122fc6c7eb1d1abb7c27a7ac7c5064dc
SSDEEP 12288:+ojgbLLjjqnbCMsiI7PSY9oSq4sq3I/0yU5C:+okfjqps37P59oosqZyuC
TLSH
T11B058E15B75EC23BE8A600B4AEAE874D4D187F309B3804C3F1D59A7D16F06E15B3A627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1000-14-0x0000000000400000-0x00000000004C6000-memory.dmp

Download

memory/1000-10-0x0000000000400000-0x00000000004C6000-memory.dmp

Download

memory/1000-18-0x0000000000400000-0x00000000004C6000-memory.dmp

Download

memory/3148-17-0x0000000000400000-0x00000000004C6000-memory.dmp

Download

memory/3500-0-0x0000000000400000-0x00000000004C6000-memory.dmp

Download

memory/3500-1-0x0000000000459000-0x000000000045A000-memory.dmp

Download

memory/3500-11-0x0000000000400000-0x00000000004C6000-memory.dmp

Download