Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/08/2026, 14:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe
- Size 242KB
- Sample260808-rmcdvasve1
- SHA256 7e0a7b56249a30f0cff577e0621afeba6598ba591abd2837274677f86f93d8ee
- MD5 b1f54daf6ab8e83cbeb0e3a34ec2ea1a
- SHA1 d1ced3f93b8425a15ab9adb0f9712af0be82636d
- SHA512 ffe5b52794325c3220510266e0a0ab09a1ccc5e78d8d0fd2fb301bb70c7cd16e93acc8d4b7ad9d91a4817884caa36c6fd19fba81866de8b9b1784f4ea11e0322
- SSDEEP 3072:D7fV9v1KoQjk4CYIun1d4p4gMR4YfJo70ydaeKDLSt4:Dv1KoQjk47AhAeabSy
- TLSH T11D347D4337D88032E0B34BB1697B93455E36BD350AB2C54E33A8B58D1E71780E6BA797
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\Microsoft.VisualBasic.Forms.resources.tmp 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Controls.Ribbon.resources.dll 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\16\2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Controls.Ribbon.resources.tmp 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_es.properttmp 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ul-oob.xrm-ms 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ul-oob.xrmtmp 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ARCTIC\2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ARCTIC\2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\TellMeOutlookTask.nrr 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\Common Files\System\ado\ja-JP\2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File created C:\Program Files\dotnet\swidtag\2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\id\2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\it\2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ul-oob.xrmtmp 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\ReachFramework.resources.dll 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\Microsoft.VisualBasic.Forms.resources.tmp 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationTypes.resources.dll 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\MEIPreload\2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.tmp 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jre-1.8\bin\2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\fi\2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\sk\2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationTypes.resources.dll 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Controls.Ribbon.resources.tmp 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\ReachFramework.resources.dll 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File created C:\Program Files\7-Zip\7z.exe 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\Internet Explorer\uk-UA\iexplore.exe.mui 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_es.properties 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SATIN\2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File created C:\Program Files\Google\Chrome\2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File created C:\Program Files\7-Zip\7z.tmp 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.tmp 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\Internet Explorer\uk-UA\iexplore.exe.tmp 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jre-1.8\lib\2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.tmp 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\id\2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TellMeOutlookTask.nrr 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\ca\2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.tmp 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\es-ES\ShapeCollector.exe.mui 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe File created C:\Program Files\dotnet\host\fxr\2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4652 2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4652
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\2026-08-08_b1f54daf6ab8e83cbeb0e3a34ec2ea1a_elex_rhadamanthys_stop.ecle
- Size 32KB
- SHA256 ce5306fc9740622a5dd06f751051edbf61bb9ec3cacd38fa006a9b3271d3390e
- MD5 74f1d60711d6a4b9a09115809f3f4c07
- SHA1 c87ba2163ff37ceed7bd708e3cf903f57eb96ded
- SHA512 b512d4ebece673a91ff57a7ae40da9c649afa25cdf9e776b4a39a9d66bb8015f15443338627713f8f4de99c115df1e62e6167ebcabd082936015ce3eb5e3e56d
- SSDEEP 384:OidyDBQVcNEbmCXaQ4x/VC0TSz0gCaNwKdtpFIdUXJ/nCyEUGh6JD004R+i7:LdytQ7bzb0vgCa2Kdtp2dUXFCvEpQIm
- TLSH T1B8E26322F54C847AF214C6F219A9969674263D310A90CD1BB789BF6D2EB40D3B8F071F
- MD5 SHA1 SHA512 SSDEEP TLSH