Analysis
- max time kernel
150s - max time network
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
28/08/2026, 14:17
General
- Target 2026-08-28_73dd1d470f8592eefc57344aa405d13f_elex_maze_rhadamanthys.exe
- Size 685KB
- Sample260828-rlw2vsygla
- SHA256 14bde706aff7ca10171ff3f29811e8231f900bf2e1a8091e33c1eadc056ec67b
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Executes dropped EXE 1 IoCs
- Drops desktop.ini file(s) 2 IoCs
- Drops file in Windows directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Enumerates system info in registry 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-28_73dd1d470f8592eefc57344aa405d13f_elex_maze_rhadamanthys.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-28_73dd1d470f8592eefc57344aa405d13f_elex_maze_rhadamanthys.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\n3916\s3916.exe"C:\Users\Admin\AppData\Local\Temp\n3916\s3916.exe" 84f802cc6c6dfcf252724e38S/m2L72smmY7SPJ7ThGhpo0qJGbaj1a2wgSdH1kx/GxH7nVbXgpzGdtNPq6AZg4tLFRWgS81x7JyEqmS3ZJcjwf1Y9xYSfQ47BJalhhesEJiEpudXeu/Msznds0BsJzCBpsxxY5xFJX5OmiDeqR5TEHWhmeZbI2QRt5PMx+FTQ== /v "C:\Users\Admin\AppData\Local\Temp\2026-08-28_73dd1d470f8592eefc57344aa405d13f_elex_maze_rhadamanthys.exe"2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
8E4E510F44A56B8C8ECFEC352907C373_CD3564E63D80D5B732156C92DB03DDAD
s3916.exe
memory/6548-40-0x00007FF8EB0E0000-0x00007FF8EBB18000-memory.dmp
memory/6548-43-0x00007FF8EB0E0000-0x00007FF8EBB18000-memory.dmp
memory/6548-12-0x00007FF8EB0E0000-0x00007FF8EBB18000-memory.dmp
memory/6548-33-0x0000000001060000-0x0000000001070000-memory.dmp
memory/6548-36-0x000000001C470000-0x000000001C93E000-memory.dmp
memory/6548-37-0x000000001C9E0000-0x000000001CA7C000-memory.dmp
memory/6548-38-0x00007FF8EB0E0000-0x00007FF8EBB18000-memory.dmp
memory/6548-39-0x000000001CBC0000-0x000000001CC22000-memory.dmp
memory/6548-11-0x00007FF8EB3DA000-0x00007FF8EB3DB000-memory.dmp
memory/6548-41-0x00007FF8EB0E0000-0x00007FF8EBB18000-memory.dmp
memory/6548-42-0x0000000001030000-0x0000000001038000-memory.dmp
memory/6548-26-0x00007FF8EB3DA000-0x00007FF8EB3DB000-memory.dmp
memory/6548-44-0x00007FF8EB0E0000-0x00007FF8EBB18000-memory.dmp
memory/6548-45-0x00007FF8EB0E0000-0x00007FF8EBB18000-memory.dmp
memory/6548-46-0x00007FF8EB0E0000-0x00007FF8EBB18000-memory.dmp
memory/6548-47-0x00007FF8EB0E0000-0x00007FF8EBB18000-memory.dmp
memory/6548-49-0x00000000218B0000-0x0000000021DC0000-memory.dmp
memory/6548-48-0x00007FF8EB0E0000-0x00007FF8EBB18000-memory.dmp
memory/6548-50-0x00007FF8EB0E0000-0x00007FF8EBB18000-memory.dmp
memory/6548-51-0x00007FF8EB0E0000-0x00007FF8EBB18000-memory.dmp
memory/6548-52-0x00007FF8EB0E0000-0x00007FF8EBB18000-memory.dmp