9e11cf32c70b6555e6be68cf3da3546e9e57107b1811feea1550e4fe10c28ce3

General

Target
2026-09-06_913b76c1b0d5cf07fec0d36d2bc9078d_elex_rhadamanthys_stop_tofsee.exe
Size 1.4MB
Sample260906-2jd4dade85
SHA256 9e11cf32c70b6555e6be68cf3da3546e9e57107b1811feea1550e4fe10c28ce3
MD5 913b76c1b0d5cf07fec0d36d2bc9078d
SHA1 70d08028dc2b156abb55b640db54b13b53426f04
SHA512 c8e2ef6c7704a27a7208881db6ac81b9ac81dc9cc278bea7866fb2bbd36c028d8c172ded0fc4b477a29a8f0c4106c382f4ec0311ee3aceb3f38a92973a9dbf20
SSDEEP 24576:s7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOcnv7YA+wvDAe1mdTqMG:v6F0eMpAAYEhp5nshwbudT1G
TLSH
T18E656C54F783C5F3E92310F0844BE7FA6530AE2580318D67FBC9FF51BA72A5225A9606
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5036	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-06_913b76c1b0d5cf07fec0d36d2bc9078d_elex_rhadamanthys_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5784 wrote to memory of 5036	5784	2026-09-06_913b76c1b0d5cf07fec0d36d2bc9078d_elex_rhadamanthys_stop_tofsee.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-09-06_913b76c1b0d5cf07fec0d36d2bc9078d_elex_rhadamanthys_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-06_913b76c1b0d5cf07fec0d36d2bc9078d_elex_rhadamanthys_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5784
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX941C.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX941C.tmp
Size 1.2MB
SHA256 04d88ca6b7adc17e962dcdee71ee3d9b8aba144dce06bbee98358e3de1371786
MD5 8eb24462d6ed80b851fbc8d3169c81c2
SHA1 65c5f18646870510007555b0fbc8c47397d17a1e
SHA512 07e9c3d4fb8e52af8ff9e7468c1c3029c39b878d62b27de77f0096b30dec4e9a41b6fd1162f5a0f03aeb67d3bfe0bb34cdef09e42771f09bce4900a3c54c24fc
SSDEEP 24576:c7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsONnv7YA+w95:/6F0eMpAAYEhpInshwD
TLSH
T1DE456C54E747C6F7E92310F0844BE7FB65309E1980318D67FBC8FE01BAB2E5225A9616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 191KB
SHA256 13b98844b2fa4a39a4d8ebb414fc79450d5ab4f0c8f5141ac06d40b2a0431ea4
MD5 94a363cd532d88ac33997c25657a19b5
SHA1 a98f1a8361d0183651c0ef457b9ac4339e429bea
SHA512 3b1c87a67f63e4276453ec1e322f0c13896dd0524ef35f4e4037a481ce354feaa98440f85b784c0b90a900c59ef115654f687457180ea433ea0100427f5c26f5
SSDEEP 3072:fW8KaJvnsgaSIwi/cJimz+zQzBYTBf9pAXAZPuYQOT:0kv1IHyz+zQeTBl2MuyT
TLSH
T1DC147B2072C1C073C023147641B5C7F55ABB78755A65AA8BBBCB1FB90F252D2EB2938D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 c782f285f6dd594f7d0446e8d6e6e21891508fbbce71f170ec1a209cb5ef8508
MD5 001fb077c9668ae928864c23a550c9ae
SHA1 780baf23bdb09511ce71d1846cad29998014cd8f
SHA512 eab75d01a19ad0bd7acace359ca1769e9b3c84df2ea9c84f753e1abce8c30de551be63b0fbde5ed9eca0703cad747dd748205722a1126945b5dadf5628f378c6
SSDEEP 24576:s7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOcnv7YA+wvD:v6F0eMpAAYEhp5nshwb
TLSH
T167456D54E747C6F7E92310F0844BE7FB65309E1980318D67FBC8FE01BAB2E5225A9616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 fb94daecb282dfcd03333bb26e757f8613745efef3393b643d3ebe3657d7e7d4
MD5 6b1d3c026d1b97f5824815b160f838d0
SHA1 47c6bd3c6dd24afef3eb6760a9406772acaf68dc
SHA512 95abf47ef7b19cd060c9adfcc636108b82ccc92e9b9100ef3f2fd1aee6d6fd5543554e064e9ae19e4876713396c41dc210e60418fab538cd578f94dbede5662b
SSDEEP 24576:s7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOanv7YA+w7Q:v6F0eMpAAYEhpfnshw8
TLSH
T158456D54E747C6F7E92310F0844BE7FB65309E1980318D67FBC8FE01BAB2E5225A9616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 f46b762691a2d39e17c9f809f3c6332d7c8d632cf33279e8becd96038876618f
MD5 1318597e8832fd10e8a9b20a971376cf
SHA1 90dd0d5405a827edc08dae72324816323af0084a
SHA512 481b4ed1fd0537e7acfbdbe478761bec6ed959e39fff0abf6d25acc199d2cb41f73838ed1d3c660cd92871cd4fcd2bcc883058623cbf378c23d20e30c11883d3
SSDEEP 24576:s7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOcnv7YA+wad:v6F0eMpAAYEhp5nshw2
TLSH
T11F456D54E747C6F7E92310F0844BE7FB65309E1980318D67FBC8FE01BAB2E5225A9616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 7b44cda13c6749f24446ba20db5eb32714fa4a7c7ad192ba44fe7945a0583efc
MD5 59257241d6f95b7af320ef1684aba364
SHA1 ca12a37b226295c721e01865591197175851943d
SHA512 da27c22c4a11e711321e56f998bdea6e66946884b1ac77ef83353a1542d3e42a519a18270f34331d0484d20f4428bda4c58f3d8e2041c07b586f585cb49c5381
SSDEEP 24576:U7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOAnv7YA+w9p:X6F0eMpAAYEhp5nshwz
TLSH
T1B9456D54E747C6F7E92310F0844BE7FB65309E1980318D67FBC8FE01BAB2E5225A9616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5784-154-0x0000000000400000-0x000000000053E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads