9178c46b50a3833b58ae38f6ab57800f2bee2ecdb0edcc957d982831e0303570

General

Target
2026-08-07_d049790092ea57f4024a48196d557bd9_elex_magniber_maze_rhadamanthys.exe
Size 1.4MB
Sample260807-lt2pessbqb
SHA256 9178c46b50a3833b58ae38f6ab57800f2bee2ecdb0edcc957d982831e0303570
MD5 d049790092ea57f4024a48196d557bd9
SHA1 1792f4b78f53decddd4e433f26890b799d4461a7
SHA512 b66462fb2273a1cd28ba9a84c68a11129312cae1a7818b0656e92360b76e2a6ad6aed01e0c3d0e90d87222ff0434f152b892201894d97a8b9131d2e39750acea
SSDEEP 24576:CaQPcWmn9BM7ex5sAGlR3dDSuHsxDRHg7EK6twCyFxtfm++EZHIfMUs+d5eAMt:CadxXw/DSnD5wk4pjZHzslMt
TLSH
T1C66523223785C1BBDDAB02364CE5AFAD956EF922472199C3B3D80B0A5F602D15F32357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3372	~86ev9l45bt.tmp

Use of msiexec (install) with remote resource 1 IoCs

pid	Process
4632	MSIEXEC.EXE

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_d049790092ea57f4024a48196d557bd9_elex_magniber_maze_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	~86ev9l45bt.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIEXEC.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4632	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	4632	MSIEXEC.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4632	MSIEXEC.EXE
4632	MSIEXEC.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4632	MSIEXEC.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 3372	2828	2026-08-07_d049790092ea57f4024a48196d557bd9_elex_magniber_maze_rhadamanthys.exe	89
PID 3372 wrote to memory of 4632	3372	~86ev9l45bt.tmp	90

C:\Users\Admin\AppData\Local\Temp\2026-08-07_d049790092ea57f4024a48196d557bd9_elex_magniber_maze_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_d049790092ea57f4024a48196d557bd9_elex_magniber_maze_rhadamanthys.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Users\Admin\AppData\Local\Temp\~86ev9l45bt.tmp
  "C:\Users\Admin\AppData\Local\Temp\~86ev9l45bt.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3372
- - C:\Windows\SysWOW64\MSIEXEC.EXE
    MSIEXEC.EXE /i "http://pliuht.cdnpckgs.eu/client/pkgs/planet7/Planet7 Casino20170811125216.msi" DDC_DID=4570118 DDC_RTGURL=http://www.cdnfile.eu/dl/TrackSetup/TrackSetup.aspx?DID=4570118%26CASINONAME=planet7casino DDC_UPDATESTATUSURL=http://190.4.94.8:8080/planet/Lobby.WebServices/Installer.asmx DDC_SIGNUPURL=http://190.4.94.8:8080/planet/Lobby.WebSite/SignUpUnsecure.aspx SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp" SETUPEXENAME="~86ev9l45bt.tmp"
    3⤵
    - Use of msiexec (install) with remote resource
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:4632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_is58BA.tmp

Path C:\Users\Admin\AppData\Local\Temp\_is58BA.tmp
Size 1KB
SHA256 c556c11a1af24c3a8801e8fb32db2ddbedc1a773215fbc8cff81c94f72edde55
MD5 cdd26b80eb7691b435e1615a235955ae
SHA1 e29743892531b5b1ece1589fb807a90697985f75
SHA512 9babe867c1815dce0f4545c54747738e5cbe04b19651f171d068be4ff66664a0e8c6534b5e220950d244efe22b78f3453d2510cac3712e50ff8b295b84537f59
TLSH
T183310CAE3DA119099F51731D67A267EB41D93C7014F4C227DD42C7B944FC006DDDA705
MD5 SHA1 SHA512 TLSH

Submit Download

0x0409.ini

Path C:\Users\Admin\AppData\Local\Temp\{3D3F1F17-0DC4-4A5D-A78B-37F192826310}\0x0409.ini
Size 21KB
SHA256 e994689a13b9448c074f9b471edeec9b524890a0d82925e98ab90b658016d8f3
MD5 be345d0260ae12c5f2f337b17e07c217
SHA1 0976ba0982fe34f1c35a0974f6178e15c238ed7b
SHA512 77040dbee29be6b136a83b9e444d8b4f71ff739f7157e451778fb4fccb939a67ff881a70483de16bcb6ae1fea64a89e00711a33ec26f4d3eea8e16c9e9553eff
SSDEEP 384:CTmyuV//BiTbh/G4AwC2WrP2DBWa/Oa0Mhs+XVgv:CT6V//BiXh/z/lWr0aa0Mhs+XVgv
TLSH
T1FBA2B95667F94219F6F77F50FDB802221E7ABC82AC38D25C1280499D09F1E84D8B1B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ISMSIDEL.INI

Path C:\Users\Admin\AppData\Local\Temp\{3D3F1F17-0DC4-4A5D-A78B-37F192826310}\_ISMSIDEL.INI
Size 20B
SHA256 0a33c5dffabcf31a1f6802026e9e2eef4b285e57fd79d52fdcd98d6502d14b13
MD5 db9af7503f195df96593ac42d5519075
SHA1 1b487531bad10f77750b8a50aca48593379e5f56
SHA512 6839264e14576fe190260a4b82afc11c88e50593a20113483851bf4abfdb7cca9986bef83f4c6b8f98ef4d426f07024cf869e8ab393df6d2b743b9b8e2544e1b
MD5 SHA1 SHA512

Submit Download

~58A7.tmp

Path C:\Users\Admin\AppData\Local\Temp\~58A7.tmp
Size 5KB
SHA256 b4e4396de54d2e01a6b2b0c512b5c3eb22e40a11275841c345cad293e43a6eec
MD5 c9c9717a911aa5a18a945513a7411b8c
SHA1 a51e90d4fba2f5c9d501256af63963fa89c78394
SHA512 6161dcb433a1c12d1ff71b8003e69d0ee88141abf5b8e0f2dd78eec9b3a14b0cbc109aa95313354ae81ba127adbcfee0ea627b80cdbbaf43c66a90f3d7465ec4
SSDEEP 96:rEhkMZ+GEkpsT5Ek5CwU/BbMON/XsEbFWaEPRhS+gWPQPgWRGTwQbPrvnp6kY05d:Yhrkkps1SNvcuQaEZhdxoIWRGcQbPr/l
TLSH
T1BCC1CE172BE6012EF6F35B49DEF5043787267C12682CC65C55E0435A28F2D828A63BFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~86ev9l45bt.tmp

Path C:\Users\Admin\AppData\Local\Temp\~86ev9l45bt.tmp
Size 1.2MB
SHA256 2ebb14c344433019318f7fab7d60239dab384bfd3873b04ab49a4a400880b6ca
MD5 b0db052c27f31cdc9e82df4bc9e1e527
SHA1 d3bee705a98a2d9ff9003afa8ff36a213630f8ed
SHA512 c3a2612c243bbeb240f1a539662e8ad35b8ecb0ab24feeecee4de8097506996e49d4e8c3e696f2eac52df420dd3c4136be51163dfb4a8a2e702928c6246cca79
SSDEEP 24576:QxNlFSIthzcjw4hfvyERsHo0VxvkTbFU7QWFC:Q7KIzyhh5Oo0wTbFcZI
TLSH
T1B0455A1376C1C03FE2B215728C6F9EB846A17D235A30455BB594FE2C2EF4592B923F1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads