d3b1091499ad017fbf116f6a43b0536f6a996e33579b0fa5f43909b4baafe5c2

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 15:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_6d3f7ad8a9deb1e7dfdf60bd7a04d4d4_elex_rhadamanthys_stop_tofsee.exe
Size 1.3MB
Sample260807-tegppsgf84
SHA256 d3b1091499ad017fbf116f6a43b0536f6a996e33579b0fa5f43909b4baafe5c2
MD5 6d3f7ad8a9deb1e7dfdf60bd7a04d4d4
SHA1 d372d8aeba7fe6be3472745aecf9568b03c104d9
SHA512 7894a7f6cfc9194614cdd3eeca03d7f6e38f706936fc70b3068801b2982003f3aed07750c023ba78b504552e9f8e6b2c29b91fcd72cef7daa5a44548a9ebf723
SSDEEP 24576:d7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOo1YA+wE/Ae1mdTqMc:26F0eMpAAYEhpX+hwaudT1c
TLSH
T101557D64F783C4F1E92314F1444BE7FBA530AE2640318D6BFBC9EF11BA72E526529606
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5204	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_6d3f7ad8a9deb1e7dfdf60bd7a04d4d4_elex_rhadamanthys_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 5204	2144	2026-08-07_6d3f7ad8a9deb1e7dfdf60bd7a04d4d4_elex_rhadamanthys_stop_tofsee.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-07_6d3f7ad8a9deb1e7dfdf60bd7a04d4d4_elex_rhadamanthys_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_6d3f7ad8a9deb1e7dfdf60bd7a04d4d4_elex_rhadamanthys_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 1.6MB
SHA256 56d0825b411ee16ea935a905148ddea1b89f722834b2945d449b5abbc1684856
MD5 777dbe0089eb4f45889631ddc837c1a9
SHA1 244c9aa59f49ee561b6b58db9105125ae2049dda
SHA512 e9b5f393fed4d9065820c6661af36f312fb82ecf1d0c2e843a08651f120fe6bd6a1a63bb98bfe6b9c4051550d63e20c13ea5940708cec2e1b6e3e8796f998e27
SSDEEP 24576:97VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO71YA+wPT83npi63i3:W6F0eMpAAYEhps+hwL8XpiMC
TLSH
T197756B50F7C780B1F97316B0496BE7BA5530BD218831C92FE7C8EE09B9B2951A539723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXAD7.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCXAD7.tmp
Size 1.1MB
SHA256 b82b610662736e8f8634e77491485fbc280d7a05a7f8e2b159d4296d303bd964
MD5 22078c75f4ef1fdcbdfbe78f6ef6da5f
SHA1 a39968181ac2152b64744f3931926d2b343aeb51
SHA512 3777e6e55aa786d627fc4140e15e151047f979449f4e1b97bcf67d3498cd8f5317bafe64d8064f7ac0c86e880815fe1a982ba519a1e0f14efcf065763d59aaef
SSDEEP 24576:97VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO81YA+wlP:W6F0eMpAAYEhpf+hwR
TLSH
T185455B54E783C4F5FD2314F0444BEBFBA5309E1A40318D6BFBC8EE11BAB2E526529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 191KB
SHA256 13b98844b2fa4a39a4d8ebb414fc79450d5ab4f0c8f5141ac06d40b2a0431ea4
MD5 94a363cd532d88ac33997c25657a19b5
SHA1 a98f1a8361d0183651c0ef457b9ac4339e429bea
SHA512 3b1c87a67f63e4276453ec1e322f0c13896dd0524ef35f4e4037a481ce354feaa98440f85b784c0b90a900c59ef115654f687457180ea433ea0100427f5c26f5
SSDEEP 3072:fW8KaJvnsgaSIwi/cJimz+zQzBYTBf9pAXAZPuYQOT:0kv1IHyz+zQeTBl2MuyT
TLSH
T1DC147B2072C1C073C023147641B5C7F55ABB78755A65AA8BBBCB1FB90F252D2EB2938D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 463e3d4ea3464ea0c1d0d090677ff3022932c2c50ca6338e77e6c1ef8b8a325f
MD5 f8abfb8bfb1e86d1301d263df9418c61
SHA1 26acb19293c4c11476fbf6e443f19457587fd565
SHA512 03ee1511405f43428c7aba8298829f5099d85d5f5d0a3f26587c63599a9f8cfb6abc69895ea379d6486644db00bbe4dd32eafc6517969d42a9d548a7f754f294
SSDEEP 24576:d7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOo1YA+wE/:26F0eMpAAYEhpX+hwa
TLSH
T185455C54E783C4F5FD2314F0444BEBFBA5309E1A40318D6BFBC8EE11BAB2E526529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 4fe5e374ee9d38438b2eefb8e2c7a3864b358bd6cbbc7194165b977100744922
MD5 7c90a56216bf7395d8ae99d2f02fe63d
SHA1 cc642df2de6bd2c632e0601c1481ee65a2a5cb39
SHA512 994b3bfaa548fb99e7fa3d2a7b04c6dc7dfd9f9120455fac1ca6bde8ac45d1bf71426c13a31cf97e67d57763724b6b5b53e837de197d02ab00b4b4d9c7a310ca
SSDEEP 24576:97VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOh1YA+wqc:W6F0eMpAAYEhpK+hw7
TLSH
T1F3455C54E783C4F5FD2314F0444BEBFBA5309E1A40318D6BFBC8EE11BAB2E526529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2144-152-0x0000000000400000-0x0000000000529000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads