d41e371508c03b538752d993ceb434778491ad9f1b95f73ae50829cec41f1d1d

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 15:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_0d43ba0b46eda2026249cb7bdd11107d_elex_rhadamanthys_stop.exe
Size 61KB
Sample260813-s2fkgstbnd
SHA256 d41e371508c03b538752d993ceb434778491ad9f1b95f73ae50829cec41f1d1d
MD5 0d43ba0b46eda2026249cb7bdd11107d
SHA1 85c582f297a5d03de38c30bd8b3f02cac48a17fd
SHA512 445e54c20b3b9034c6247ad07776f4f1a4390590abfae43511c2ea4be705419b9f4b602948f8cbcab532019e724d93ab1829dbae3dc4ae07da2b9198f39a229b
SSDEEP 1536:Ittdse4OcUmWQIvEPZo6E5sEFd29NQgA2w6TNle5:4dse4OlQZo6EKEFdGM29le5
TLSH
T1F1538C55B2E9C075E5A209F17A3D9A91C9FEBD3826A0D1C7D3111C8B6EB0192D23938B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
852	ewiuer2.exe
3692	ewiuer2.exe
3764	ewiuer2.exe
2020	ewiuer2.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ewiuer2.exe	ewiuer2.exe
File opened for modification	C:\Windows\SysWOW64\ewiuer2.exe	ewiuer2.exe
File opened for modification	C:\Windows\SysWOW64\viesazm.mpk	ewiuer2.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_0d43ba0b46eda2026249cb7bdd11107d_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ewiuer2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ewiuer2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ewiuer2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ewiuer2.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 852	2764	2026-08-13_0d43ba0b46eda2026249cb7bdd11107d_elex_rhadamanthys_stop.exe	89
PID 852 wrote to memory of 3692	852	ewiuer2.exe	91
PID 3692 wrote to memory of 3764	3692	ewiuer2.exe	92
PID 3764 wrote to memory of 2020	3764	ewiuer2.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-08-13_0d43ba0b46eda2026249cb7bdd11107d_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_0d43ba0b46eda2026249cb7bdd11107d_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Users\Admin\AppData\Roaming\ewiuer2.exe
  C:\Users\Admin\AppData\Roaming\ewiuer2.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:852
- - C:\Windows\SysWOW64\ewiuer2.exe
    C:\Windows\System32\ewiuer2.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3692
  - - C:\Users\Admin\AppData\Roaming\ewiuer2.exe
      C:\Users\Admin\AppData\Roaming\ewiuer2.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3764
    - - C:\Windows\SysWOW64\ewiuer2.exe
        
        C:\Windows\System32\ewiuer2.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ewiuer2.exe

Path C:\Users\Admin\AppData\Roaming\ewiuer2.exe
Size 61KB
SHA256 10d47e84d5cd2b175cf5386aa7be1420487f1bbcee303f306ed8a1422eda91db
MD5 0a964defaaf9928c472e7674df794082
SHA1 1c4a4a1db9559764ff6cd03cb224632b8d5ee951
SHA512 2dc63fd5856ea46a3a505fa81ca1da9d8099c297d40590620e937f3d5058514d39745a4660723588ef628f18305bba7b58c8fc71da5b063f1e1dea022e57f065
SSDEEP 1536:attdse4OcUmWQIvEPZo6E5sEFd29NQgA2w6TNle5:6dse4OlQZo6EKEFdGM29le5
TLSH
T1E0538C55B2E9C075E5A209F17A3D9A91C9FEBD3826A0D1C7D3111C8B6EB0192D23938B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ewiuer2.exe

Path C:\Users\Admin\AppData\Roaming\ewiuer2.exe
Size 61KB
SHA256 8288206fb952a201f2ca0f1d29e60db2b25bf8b89f9754fa49ddcd867bde755b
MD5 e8bb0cb21cfef211a08d4988297e28af
SHA1 71ad8ce0a126558d80e67c59cd24629127537c99
SHA512 6abe8265ac80e2924f39bc9aacaa71dfb76527434748ce331a3a6081cde746fba38b077781be4e2f9febb247a2cdb4a195e868f3c65041beaff696fd12627429
SSDEEP 1536:Mttdse4OcUmWQIvEPZo6E5sEFd29NQgA2w6TNle5:Udse4OlQZo6EKEFdGM29le5
TLSH
T1E2538C55B2E9C075E5A209F17A3D9A91C9FEBD3826A0D1C7D3111C8B6EB0192D23938B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ewiuer2.exe

Path C:\Windows\SysWOW64\ewiuer2.exe
Size 61KB
SHA256 c04c30d528cf0e811ad8a1a79e92cf7ae94ef5722d44c5573d1b8ef9258ab32e
MD5 d341afbcce05fa8533ac6faf9cb4c58b
SHA1 de0d43b8d34dafb473ce975dbc8758d8e8ded793
SHA512 96b1027a7483d80e671a83b7b60037d1dd08483d9a82e8b5ee9d24979fd67869075e8ee4afee75922d50b730a95ea8967c851edb97a917401354e774efa5077e
SSDEEP 1536:+ttdse4OcUmWQIvEPZo6E5sEFd29NQgA2w6TNle5:mdse4OlQZo6EKEFdGM29le5
TLSH
T137538C55B2E9C075E5A209F17A3D9A91C9FEBD3826A0D1C7D3111C8B6EB0192D23938B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ewiuer2.exe

Path C:\Windows\SysWOW64\ewiuer2.exe
Size 61KB
SHA256 f643a7bddc4a22db70c1facd74022e4973b3a864ca50ecca3b4477083d0a31a4
MD5 7b0d2a5897f764f0b11e88c866b09604
SHA1 ffd3d5919ce2610b507ce5f8b1cc71427b3786d8
SHA512 98527171c11c33929e261a95a1372e242401576736c06c39426e63d912e2daef628f31344292b85608a39e3c557b5dee6c3380d3383d4dbc39e404d166b66c29
SSDEEP 1536:Sttdse4OcUmWQIvEPZo6E5sEFd29NQgA2w6TNle5:Cdse4OlQZo6EKEFdGM29le5
TLSH
T16C538C55B2E9C075E5A209F17A3D9A91C9FEBD3826A0D1C7D3111C8B6EB0192D23938B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads