9e11cf32c70b6555e6be68cf3da3546e9e57107b1811feea1550e4fe10c28ce3

General

Target
2026-09-06_913b76c1b0d5cf07fec0d36d2bc9078d_elex_rhadamanthys_stop_tofsee.exe
Size 1.4MB
Sample260906-2jd4dade85
SHA256 9e11cf32c70b6555e6be68cf3da3546e9e57107b1811feea1550e4fe10c28ce3
MD5 913b76c1b0d5cf07fec0d36d2bc9078d
SHA1 70d08028dc2b156abb55b640db54b13b53426f04
SHA512 c8e2ef6c7704a27a7208881db6ac81b9ac81dc9cc278bea7866fb2bbd36c028d8c172ded0fc4b477a29a8f0c4106c382f4ec0311ee3aceb3f38a92973a9dbf20
SSDEEP 24576:s7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOcnv7YA+wvDAe1mdTqMG:v6F0eMpAAYEhp5nshwbudT1G
TLSH
T18E656C54F783C5F3E92310F0844BE7FA6530AE2580318D67FBC9FF51BA72A5225A9606
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3036	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-06_913b76c1b0d5cf07fec0d36d2bc9078d_elex_rhadamanthys_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 3036	4940	2026-09-06_913b76c1b0d5cf07fec0d36d2bc9078d_elex_rhadamanthys_stop_tofsee.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-09-06_913b76c1b0d5cf07fec0d36d2bc9078d_elex_rhadamanthys_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-06_913b76c1b0d5cf07fec0d36d2bc9078d_elex_rhadamanthys_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
Size 1.6MB
SHA256 04de92fb91b4d18e88d368b451c84684ca30aaf1264ec0cc44733ed1641d42e2
MD5 c79e3b910f05694fa8681593e5bf4d8b
SHA1 a16621271e868581154f07c0ebdc58c09d2f4f25
SHA512 912626d38342a96241b9e3c71f1da125d49e5fa2d0bcd6f12999d012cae85a8cd3a42061042379391a39edd5fa7e78b86c9d843085d152dc08178f247a4ce9b9
SSDEEP 24576:c7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsONnv7YA+w95nMYenGJiKEb7:/6F0eMpAAYEhpInshwDMPnRWt4d
TLSH
T1E2858E64E683C5F3E92310F1840BE7F669349E1980318C67FBC4FF15BA7295276BA606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDrive.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
Size 3.5MB
SHA256 2774274313d1c4bc8692d0b46297ad73b92892fec564b77fb6650f2aa21c8106
MD5 74466ccebabaa935da22f2e0c01aa0ca
SHA1 f22e2113e815cb31011603719d4953cf345db3d6
SHA512 7921830cb3ad73fe04e7c1df18328e78beb85bcd80a997212f363a9ed3c3f7a437fcee5c6d7152e0bca7a6e298f3f09bf37287e210d44fef5ac3ac80e6215793
SSDEEP 24576:/7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOQq2yRs47WXnueVulvspdbl:E6F0eMpAAYEhp9ql37WXnu6ulvKdfLMq
TLSH
T1B4F539E2BE92F0B1E4D20CB1390BE6BED5237C348C238997B783F72D6573651562A116
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX23E.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX23E.tmp
Size 1.2MB
SHA256 7b44cda13c6749f24446ba20db5eb32714fa4a7c7ad192ba44fe7945a0583efc
MD5 59257241d6f95b7af320ef1684aba364
SHA1 ca12a37b226295c721e01865591197175851943d
SHA512 da27c22c4a11e711321e56f998bdea6e66946884b1ac77ef83353a1542d3e42a519a18270f34331d0484d20f4428bda4c58f3d8e2041c07b586f585cb49c5381
SSDEEP 24576:U7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOAnv7YA+w9p:X6F0eMpAAYEhp5nshwz
TLSH
T1B9456D54E747C6F7E92310F0844BE7FB65309E1980318D67FBC8FE01BAB2E5225A9616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX2EE.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX2EE.tmp
Size 1.2MB
SHA256 232ad4b5e5ee34941ce02569a264c01fb2c6f0c0396fcd0ad54ebf5e0bcdb763
MD5 eda403adb6b27fabaf9bfbe95c5f59ab
SHA1 bf3af7853ec5a712dc37b49e1828a4a29d9ec57b
SHA512 6301009e902634e78ad80ce96cab7bc6e8ab686371fefd6e8d399e157b851b3898f946e21bcd8944d9732263eee6651ce610d912d289fdf2037a3983b650b059
SSDEEP 24576:07VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOknv7YA+wvT:36F0eMpAAYEhp9nshwr
TLSH
T1F2456C54E747C6F7E92310F0844BE7FB65309E1980318D67FBC8FE01BAB2E5225A9616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXFF7E.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCXFF7E.tmp
Size 1.2MB
SHA256 c782f285f6dd594f7d0446e8d6e6e21891508fbbce71f170ec1a209cb5ef8508
MD5 001fb077c9668ae928864c23a550c9ae
SHA1 780baf23bdb09511ce71d1846cad29998014cd8f
SHA512 eab75d01a19ad0bd7acace359ca1769e9b3c84df2ea9c84f753e1abce8c30de551be63b0fbde5ed9eca0703cad747dd748205722a1126945b5dadf5628f378c6
SSDEEP 24576:s7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOcnv7YA+wvD:v6F0eMpAAYEhp5nshwb
TLSH
T167456D54E747C6F7E92310F0844BE7FB65309E1980318D67FBC8FE01BAB2E5225A9616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 191KB
SHA256 13b98844b2fa4a39a4d8ebb414fc79450d5ab4f0c8f5141ac06d40b2a0431ea4
MD5 94a363cd532d88ac33997c25657a19b5
SHA1 a98f1a8361d0183651c0ef457b9ac4339e429bea
SHA512 3b1c87a67f63e4276453ec1e322f0c13896dd0524ef35f4e4037a481ce354feaa98440f85b784c0b90a900c59ef115654f687457180ea433ea0100427f5c26f5
SSDEEP 3072:fW8KaJvnsgaSIwi/cJimz+zQzBYTBf9pAXAZPuYQOT:0kv1IHyz+zQeTBl2MuyT
TLSH
T1DC147B2072C1C073C023147641B5C7F55ABB78755A65AA8BBBCB1FB90F252D2EB2938D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4940-274-0x0000000000400000-0x000000000053E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads