f6c73348ebb30780781093c82f39d9d263c4e5ca598fdc16e6ad042596f03c81

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 22:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_8910f98329a7ea63e194c5e7ca85b1e1_elex_rhadamanthys_stop.exe
Size 61KB
Sample260806-2vxpvsbq6v
SHA256 f6c73348ebb30780781093c82f39d9d263c4e5ca598fdc16e6ad042596f03c81
MD5 8910f98329a7ea63e194c5e7ca85b1e1
SHA1 1d53fdc72d6f55c98c4f159be0b724250b2c272c
SHA512 15a7ae2bd38ec97d10b2f537f436135a6e890786732f9e571f1a9191b650b33b5a1b27dca0ffec90227bd8216f40e0790ef4a206c4a2a6300a76ae3b33503a0f
SSDEEP 1536:4O6skYL5TDbCY7fjPpm7GVOFAwfUklXa:Rkw517fjPQiwfplXa
TLSH
T154538C94B2F5C076E5E208F07A7DAA91C8FEBE3415A4D5C3D351588B6CB01E2D63A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
4624	sngcd.exe
4796	pmmnz.exe
2228	pmmnz.exe
2496	sngcd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\5f42oot = "C:\\Users\\Admin\\AppData\\Roaming\\sngcd.exe"	2026-08-06_8910f98329a7ea63e194c5e7ca85b1e1_elex_rhadamanthys_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\h32u6 = "C:\\Users\\Admin\\AppData\\Roaming\\pmmnz.exe"	sngcd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_8910f98329a7ea63e194c5e7ca85b1e1_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sngcd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmmnz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmmnz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sngcd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 4624	4748	2026-08-06_8910f98329a7ea63e194c5e7ca85b1e1_elex_rhadamanthys_stop.exe	89
PID 4624 wrote to memory of 4796	4624	sngcd.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-06_8910f98329a7ea63e194c5e7ca85b1e1_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_8910f98329a7ea63e194c5e7ca85b1e1_elex_rhadamanthys_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Users\Admin\AppData\Roaming\sngcd.exe
  C:\Users\Admin\AppData\Roaming\sngcd.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4624
- - C:\Users\Admin\AppData\Roaming\pmmnz.exe
    C:\Users\Admin\AppData\Roaming\pmmnz.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4796

C:\Users\Admin\AppData\Roaming\pmmnz.exe
C:\Users\Admin\AppData\Roaming\pmmnz.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2228

C:\Users\Admin\AppData\Roaming\sngcd.exe
C:\Users\Admin\AppData\Roaming\sngcd.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

pmmnz.exe

Path C:\Users\Admin\AppData\Roaming\pmmnz.exe
Size 61KB
SHA256 439ebfc6948b2866cd4d097aea9d6a54ce497cb981547f214e6c244ff414b2a6
MD5 e69b710e6f591a762379d1245d8e7ccd
SHA1 bc6f8c016579ecc5a82ae6798e50fedf3cf09505
SHA512 3935fb1709452f2db1a1e549df1d557d640eb08a7f8cc4b3180bb9a4f00efb4f812c15513a9e0b8aca7aee9ae3c8ce54f4a14e5c2a6c5cb65f34e2729508a763
SSDEEP 1536:2O6skYL5TDbCY7fjPpm7GVOFAwfUklXa:7kw517fjPQiwfplXa
TLSH
T1E2538C94B2F5C076E5E208F07A7DAA91C8FEBE3415A4D5C3D351588B6CB01E2D63A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sngcd.exe

Path C:\Users\Admin\AppData\Roaming\sngcd.exe
Size 61KB
SHA256 2060f90e6ae33f172c3b34244b850a273b526624d0733394d726ad9cab9a3d79
MD5 04566b5a2a168528b33e0fc040fb797f
SHA1 cb744f5c939229958ada02fd9501a0612f5e2c5e
SHA512 07ee08d29fe59419b85748adcfaffe3eda8d4535d84ab4e99c06f9ff24760af7744f185581f8dadb6e8f4ba7b7d37883fe0a5d8bfc9fe580a3c4701661c3b69a
SSDEEP 1536:oO6skYL5TDbCY7fjPpm7GVOFAwfUklXa:Bkw517fjPQiwfplXa
TLSH
T1C1538C94B2F5C076E5E208F07A7DAA91C8FEBE3415A4D5C3D351588B6CB01E2D63A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads