Analysis
- max time kernel
149s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
08/08/2026, 04:07
General
- Target 2026-08-08_11c98ef29312466c99e2334c75f4f4ef_elex_rhadamanthys_stop.exe
- Size 996KB
- Sample260808-eptdxszejg
- SHA256 ceae37e799d6b01d07de11862e2151c2017d09854464684617b46950c303162e
Malware Config
Signatures
- Executes dropped EXE 21 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 25 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 41 IoCs
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 24 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_11c98ef29312466c99e2334c75f4f4ef_elex_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_11c98ef29312466c99e2334c75f4f4ef_elex_rhadamanthys_stop.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"2⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"3⤵
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\System32\GameInputSvc.exeC:\Windows\System32\GameInputSvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\GameInputSvc.exe"C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_12⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
elevation_service.exe
maintenanceservice.exe
OSE.EXE
elevation_service.exe
ArmReport.ini
ArmReport.ini
RdrManifest2.msi
AdobeARM.log
ArmUI.ini
Tmp87C4.tmp
TmpA159.tmp
TmpA1B8.tmp
perfhost.exe
AgentService.exe
GameInputSvc.exe
Locator.exe
ssh-agent.exe
PerceptionSimulationService.exe
ReFsDedupSvc.exe
SensorDataService.exe
TieringEngineService.exe
VSSVC.exe
alg.exe
msdtc.exe
snmptrap.exe
vds.exe
WmiApSrv.exe
wbengine.exe
AppVClient.exe
memory/400-591-0x00007FF725850000-0x00007FF7259E4000-memory.dmp
memory/400-592-0x000001CED6A00000-0x000001CED6A66000-memory.dmp
memory/400-593-0x000001CED6A00000-0x000001CED6A66000-memory.dmp
memory/712-580-0x00007FF6B0230000-0x00007FF6B02F8000-memory.dmp
memory/712-496-0x000001AF93300000-0x000001AF93366000-memory.dmp
memory/712-497-0x000001AF93300000-0x000001AF93366000-memory.dmp
memory/712-495-0x00007FF6B0230000-0x00007FF6B02F8000-memory.dmp
memory/1092-643-0x0000021AC9330000-0x0000021AC9396000-memory.dmp
memory/1092-642-0x00007FF64A030000-0x00007FF64A15E000-memory.dmp
memory/1092-644-0x0000021AC9330000-0x0000021AC9396000-memory.dmp
memory/1096-613-0x000001818DDD0000-0x000001818DE36000-memory.dmp
memory/1096-612-0x00007FF633210000-0x00007FF63349A000-memory.dmp
memory/1096-614-0x000001818DDD0000-0x000001818DE36000-memory.dmp
memory/1288-534-0x00000000009B0000-0x0000000000A19000-memory.dmp
memory/1288-533-0x0000000000400000-0x00000000004AE000-memory.dmp
memory/1288-620-0x0000000000400000-0x00000000004AE000-memory.dmp
memory/1288-539-0x00000000009B0000-0x0000000000A19000-memory.dmp
memory/1416-611-0x00007FF7FA360000-0x00007FF7FA4A9000-memory.dmp
memory/1416-524-0x00007FF7FA360000-0x00007FF7FA4A9000-memory.dmp
memory/1416-526-0x000001C22D320000-0x000001C22D386000-memory.dmp
memory/1416-527-0x000001C22D320000-0x000001C22D386000-memory.dmp
memory/1680-119-0x000002CE8E530000-0x000002CE8E596000-memory.dmp
memory/1680-117-0x000002CE8E2F0000-0x000002CE8E410000-memory.dmp
memory/1680-118-0x000002CE8E530000-0x000002CE8E596000-memory.dmp
memory/1940-573-0x000002579D700000-0x000002579D766000-memory.dmp
memory/1940-571-0x00007FF62E920000-0x00007FF62E9D3000-memory.dmp
memory/1940-572-0x000002579D700000-0x000002579D766000-memory.dmp
memory/1940-641-0x00007FF62E920000-0x00007FF62E9D3000-memory.dmp
memory/2640-590-0x00007FF6B0230000-0x00007FF6B02F8000-memory.dmp
memory/2640-506-0x00000158E0970000-0x00000158E09D6000-memory.dmp
memory/2640-504-0x00007FF6B0230000-0x00007FF6B02F8000-memory.dmp
memory/2640-505-0x00000158E0970000-0x00000158E09D6000-memory.dmp
memory/2744-630-0x00007FF774670000-0x00007FF774B76000-memory.dmp
memory/2744-632-0x0000028863B30000-0x0000028863B96000-memory.dmp
memory/2744-631-0x0000028863B30000-0x0000028863B96000-memory.dmp
memory/3028-125-0x0000020037940000-0x0000020037A60000-memory.dmp
memory/3028-126-0x0000020037B80000-0x0000020037BE6000-memory.dmp
memory/3028-127-0x0000020037B80000-0x0000020037BE6000-memory.dmp
memory/3204-5-0x0000000002FD0000-0x0000000003157000-memory.dmp
memory/3204-0-0x0000000003290000-0x00000000032F9000-memory.dmp
memory/3204-7-0x0000000003290000-0x00000000032F9000-memory.dmp
memory/3204-6-0x0000000003290000-0x00000000032F9000-memory.dmp
memory/3840-623-0x000002C86B270000-0x000002C86B2D6000-memory.dmp
memory/3840-621-0x00007FF667420000-0x00007FF6678F0000-memory.dmp
memory/3840-622-0x000002C86B270000-0x000002C86B2D6000-memory.dmp
memory/3972-146-0x000001D022670000-0x000001D022790000-memory.dmp
memory/3972-147-0x000001D0228E0000-0x000001D022946000-memory.dmp
memory/3972-148-0x000001D0228E0000-0x000001D022946000-memory.dmp
memory/4172-629-0x00007FF627930000-0x00007FF628073000-memory.dmp
memory/4172-547-0x00007FF627930000-0x00007FF628073000-memory.dmp
memory/4172-545-0x000001EF1A000000-0x000001EF1A066000-memory.dmp
memory/4172-546-0x000001EF1A000000-0x000001EF1A066000-memory.dmp
memory/4212-17-0x000001E8F4380000-0x000001E8F43E6000-memory.dmp
memory/4212-18-0x000001E8F4380000-0x000001E8F43E6000-memory.dmp
memory/4212-15-0x00007FF7E1500000-0x00007FF7E1622000-memory.dmp
memory/4212-16-0x000001E8F4380000-0x000001E8F43E6000-memory.dmp
memory/4212-133-0x00007FF7E1500000-0x00007FF7E1622000-memory.dmp
memory/4308-142-0x00000241AEB50000-0x00000241AEBB6000-memory.dmp
memory/4308-135-0x00000241AEB50000-0x00000241AEBB6000-memory.dmp
memory/4308-143-0x00007FF764EA0000-0x00007FF765008000-memory.dmp
memory/4308-134-0x00007FF764EA0000-0x00007FF765008000-memory.dmp
memory/4308-136-0x00000241AEB50000-0x00000241AEBB6000-memory.dmp
memory/4340-637-0x00007FF7C43D0000-0x00007FF7C47E6000-memory.dmp
memory/4340-564-0x00000202511F0000-0x0000020251256000-memory.dmp
memory/4340-563-0x00007FF7C43D0000-0x00007FF7C47E6000-memory.dmp
memory/4340-562-0x00000202511F0000-0x0000020251256000-memory.dmp
memory/4608-602-0x000001D2B3580000-0x000001D2B35E6000-memory.dmp
memory/4608-606-0x000001D2B3580000-0x000001D2B35E6000-memory.dmp
memory/4608-608-0x00007FF676630000-0x00007FF676950000-memory.dmp
memory/4608-600-0x000001D2B3580000-0x000001D2B35E6000-memory.dmp
memory/4608-601-0x00007FF676630000-0x00007FF676950000-memory.dmp
memory/4920-584-0x0000017946380000-0x00000179463E6000-memory.dmp
memory/4920-581-0x00007FF638090000-0x00007FF638333000-memory.dmp
memory/4920-583-0x0000017946380000-0x00000179463E6000-memory.dmp
memory/5496-553-0x00007FF7D1EB0000-0x00007FF7D1F5D000-memory.dmp
memory/5496-555-0x00000273D9160000-0x00000273D91C6000-memory.dmp
memory/5496-636-0x00007FF7D1EB0000-0x00007FF7D1F5D000-memory.dmp
memory/5496-554-0x00000273D9160000-0x00000273D91C6000-memory.dmp
memory/6092-599-0x00007FF7ABAC0000-0x00007FF7ABBD9000-memory.dmp
memory/6092-513-0x000002B596490000-0x000002B5964F6000-memory.dmp
memory/6092-514-0x000002B596490000-0x000002B5964F6000-memory.dmp
memory/6092-512-0x00007FF7ABAC0000-0x00007FF7ABBD9000-memory.dmp