654ec553fd9227fe61d66369a7cd6f117ac5c841ecd675a4121f34e981130fea

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 22:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-12_72de6119efa06715c77633e8b5eeff47_elex_rhadamanthys_stop.exe
Size 61KB
Sample260812-19acfafb44
SHA256 654ec553fd9227fe61d66369a7cd6f117ac5c841ecd675a4121f34e981130fea
MD5 72de6119efa06715c77633e8b5eeff47
SHA1 356a96e001f10b7f1cb8fc7210e2707557f55fe1
SHA512 2440c921485b0cfbc4311259ba42c0fd412dbf29a01271d6f7efb55ae90026718fed8d8af1cc170740d20417202891db720a35275fa17f77b4776c2ddc4e90cc
SSDEEP 1536:kttdse4OcUmWQIvEPZo6E5sEFd29NQgA2w6TNle5:cdse4OlQZo6EKEFdGM29le5
TLSH
T1A3538C55B2E9C075E5A309F17A3D9A91C9FEBD3826A0D1C7D3111C8B6EB0192D23938B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
600	ewiuer2.exe
2248	ewiuer2.exe
5956	ewiuer2.exe
4792	ewiuer2.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ewiuer2.exe	ewiuer2.exe
File opened for modification	C:\Windows\SysWOW64\ewiuer2.exe	ewiuer2.exe
File opened for modification	C:\Windows\SysWOW64\viesazm.mpk	ewiuer2.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ewiuer2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ewiuer2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ewiuer2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-12_72de6119efa06715c77633e8b5eeff47_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ewiuer2.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 600	800	2026-08-12_72de6119efa06715c77633e8b5eeff47_elex_rhadamanthys_stop.exe	89
PID 600 wrote to memory of 2248	600	ewiuer2.exe	91
PID 2248 wrote to memory of 5956	2248	ewiuer2.exe	92
PID 5956 wrote to memory of 4792	5956	ewiuer2.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-08-12_72de6119efa06715c77633e8b5eeff47_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_72de6119efa06715c77633e8b5eeff47_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:800
- C:\Users\Admin\AppData\Roaming\ewiuer2.exe
  C:\Users\Admin\AppData\Roaming\ewiuer2.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:600
- - C:\Windows\SysWOW64\ewiuer2.exe
    C:\Windows\System32\ewiuer2.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2248
  - - C:\Users\Admin\AppData\Roaming\ewiuer2.exe
      C:\Users\Admin\AppData\Roaming\ewiuer2.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5956
    - - C:\Windows\SysWOW64\ewiuer2.exe
        
        C:\Windows\System32\ewiuer2.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ewiuer2.exe

Path C:\Users\Admin\AppData\Roaming\ewiuer2.exe
Size 61KB
SHA256 28682e75ad83e9c41294a9544fa4961ae1cabf4c36cc670521577f47c0b046f7
MD5 499c774a555482a5face345dfeae6683
SHA1 eb0aa7f6708bfaab3f9fee005da86d019e296b50
SHA512 7fb64aeafedc0ea51434fc2a63ea971604dcd740bf2d9a9f042ce0c2dd51b45ece73241e6dc993a793711698c59f93ee31f0757b1fc80ca05f5b376933d31245
SSDEEP 1536:2ttdse4OcUmWQIvEPZo6E5sEFd29NQgA2w6TNle5:udse4OlQZo6EKEFdGM29le5
TLSH
T10D538C55B2E9C075E5A209F17A3D9A91C9FEBD3826A0D1C7D3111C8B6EB0192D23938B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ewiuer2.exe

Path C:\Users\Admin\AppData\Roaming\ewiuer2.exe
Size 61KB
SHA256 d41e371508c03b538752d993ceb434778491ad9f1b95f73ae50829cec41f1d1d
MD5 0d43ba0b46eda2026249cb7bdd11107d
SHA1 85c582f297a5d03de38c30bd8b3f02cac48a17fd
SHA512 445e54c20b3b9034c6247ad07776f4f1a4390590abfae43511c2ea4be705419b9f4b602948f8cbcab532019e724d93ab1829dbae3dc4ae07da2b9198f39a229b
SSDEEP 1536:Ittdse4OcUmWQIvEPZo6E5sEFd29NQgA2w6TNle5:4dse4OlQZo6EKEFdGM29le5
TLSH
T1F1538C55B2E9C075E5A209F17A3D9A91C9FEBD3826A0D1C7D3111C8B6EB0192D23938B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ewiuer2.exe

Path C:\Windows\SysWOW64\ewiuer2.exe
Size 61KB
SHA256 a22b4029e2a0fb0d55401150c092d4bd895b8b47f4bf1db833f2847d9d70a1ba
MD5 ebe815526ec846cf3c0ee627f940b69b
SHA1 006d384d0abad55af57d5de925debe8289dd1cb1
SHA512 3d140bcc4d3391a47c7a9f48bc809868ca8e6d27130d0ca14320a85bc782927863978f9fe60a3f2d910f067c7bb8605c8e97bdb7626e2829ab4b46b7a42fe1fc
SSDEEP 1536:Vttdse4OcUmWQIvEPZo6E5sEFd29NQgA2w6TNle5:9dse4OlQZo6EKEFdGM29le5
TLSH
T128538C55B2E9C075E5A209F17A3DDA91C9FEBD3826A0D1C7D3111C8B6EB0192D23938B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ewiuer2.exe

Path C:\Windows\SysWOW64\ewiuer2.exe
Size 61KB
SHA256 906226925ae329b71d08676697ee2e40bd8e689ccab25be5a2b38931c8eedc00
MD5 6952b5db15672073e4ce2cab304db1ee
SHA1 6c32c3917006e95d7c162d0b98a47a665fa13941
SHA512 588b741481b4da0624d8b87e9ec626125be84fa685bc12b1123345bcc59c17056c84899fa27f6c17399ce7d896e8f7b868a0f598c5bf5ea89b4bbbe0d0ce87bd
SSDEEP 1536:Gttdse4OcUmWQIvEPZo6E5sEFd29NQgA2w6TNle5:edse4OlQZo6EKEFdGM29le5
TLSH
T172538C55B2E9C075E5A209F17A3D9A91C9FEBD3826A0D1C7D3111C8B6EB0192D23938B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads