Overview

overview

8

Static

static

3

2026-09-29...op.exe

windows10-2004-x64

8

2026-09-29...op.exe

windows11-ltsc_2024-x64

3

Analysis

  • max time kernel
    150s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/09/2026, 00:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-29_5d8db976c51f04818d69898910fb74d7_elex_rhadamanthys_stop.exe
  • Size 836KB
  • Sample260930-aen91aaa84
  • SHA256 4e3c2ab2c1a84b9bfe3af99a633cf3bbee72a2d0c48b0780362a1cb192d90546
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarecredential_accessdefense_evasiondiscoverypersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Disables taskbar notifications via registry modification
    defense_evasion
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 7 IoCs
  • Modifies system executable filetype association 2 TTPs 2 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Windows security modification 2 TTPs 2 IoCs
    defense_evasiontrojan
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops Chrome extension 1 IoCs
  • Enumerates connected drives 3 TTPs 44 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • System policy modification 1 TTPs 2 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_5d8db976c51f04818d69898910fb74d7_elex_rhadamanthys_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_5d8db976c51f04818d69898910fb74d7_elex_rhadamanthys_stop.exe"
    1⤵
    • Modifies system executable filetype association
    • Drops Chrome extension
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1748
  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:3472
  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:2756
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    PID:4844
  • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    • Windows security modification
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • System policy modification
    PID:936
  • C:\Windows\System32\OpenSSH\ssh-agent.exe
    C:\Windows\System32\OpenSSH\ssh-agent.exe
    1⤵
    • Executes dropped EXE
    PID:2324
  • C:\Windows\system32\AgentService.exe
    C:\Windows\system32\AgentService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:4552
  • C:\Windows\system32\wbengine.exe
    "C:\Windows\system32\wbengine.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:5088

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Persistence

        Event Triggered Execution

        2
        T1546

        Change Default File Association

        1
        T1546.001

        Component Object Model Hijacking

        1
        T1546.015

        Privilege Escalation

        Event Triggered Execution

        2
        T1546

        Change Default File Association

        1
        T1546.001

        Component Object Model Hijacking

        1
        T1546.015

        Defense Evasion

        Impair Defenses

        1
        T1562

        Disable or Modify Tools

        1
        T1562.001

        Modify Registry

        4
        T1112

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        2
        T1552

        Credentials In Files

        2
        T1552.001

        Discovery

        Peripheral Device Discovery

        1
        T1120

        Query Registry

        2
        T1012

        System Information Discovery

        1
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        System Network Configuration Discovery

        1
        T1016

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        elevation_service.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        • Size 2.7MB
        • SHA256 66eea6af889fa12da01ed4374176ac2aa5d160e2f457179ddb41dfc6c49ada40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        • Size 838KB
        • SHA256 d48058b358bab29fa5b36a892fa3ddb3a1e8e1133a6d61cdacdc087e9ee8a74b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 1.1MB
        • SHA256 d6f96b632d4099e5f0d0724207fe8c76e06fb86f581f2decc48626f8123d8b30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 1.5MB
        • SHA256 711ce7270e45c906238642c41b8cf3b828699ded5ff1cb09a8b3692c9b153cf5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 1.2MB
        • SHA256 1604cb2b433bf21c07b11fc4c06f6ddf6fa9dc197de9a3259900ef714d9f6afb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 852KB
        • SHA256 cf827ab8f36b2bfe7277b82ccd90e9e829d163da288859300c50f8abea34a26b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 4.6MB
        • SHA256 b5fda121a8d32a3a2ebb15472b37a4c254c7690e0277dfa71d5262a513a043a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 922KB
        • SHA256 1a13b43addf1941ea0f465b33da4a1b7947470345933b74c1c10fc698803c52f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 24.0MB
        • SHA256 b69a0325b8cf79a42e0b061ad808ef93f3c70a81889450157db8233b72b872cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 2.7MB
        • SHA256 ba88a46dc5047ae817bfc6f295814ecadf7426a3fd57fa81a44c4cff8c70a120
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSE.EXE
        • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
        • Size 817KB
        • SHA256 0645d6a4dd97259f23267ddd2a4179073008a54641969a925d4f776b325c59c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bhlnifll.tmp
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\bhlnifll.tmp
        • Size 6.6MB
        • SHA256 11430221e990112c4cb20847095545c40137710d057fdecf57654eab3c9957f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 2.8MB
        • SHA256 fb5814b3faa0bdfce356052f2ee64e9d18de388f90118709ab8c3725e03b3cee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        iexplore.exe
        • Path C:\Program Files\Internet Explorer\iexplore.exe
        • Size 1.4MB
        • SHA256 14cc5e04769c45d383cb457a8a507b46870001643461bc565f525a467ef27600
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        powershell.exe
        • Path C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        • Size 1002KB
        • SHA256 73a8c0e875ec34d98bf0ed07f172707fd291dacbb94c5528b5f658db23ce1425
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AgentService.exe
        • Path C:\Windows\System32\AgentService.exe
        • Size 1.7MB
        • SHA256 77e3c09eb184be9efaab2b461d594272e75e7bc0fbe6e23c7e4de1212213de03
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssh-agent.exe
        • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
        • Size 952KB
        • SHA256 4b6f32edd0b83ccc237df4dba27201f05eda34ad771b2ab58929f8f814225822
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        oegoclqq.tmp
        • Path C:\Windows\System32\oegoclqq.tmp
        • Size 1.3MB
        • SHA256 955e8e04431e00ae67db44289e016863fd30b6bb7df9dbab387bcd03e37973bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wbengine.exe
        • Path C:\Windows\System32\wbengine.exe
        • Size 2.1MB
        • SHA256 8e83ba4a39a9969b8ff2cf4b4ec1ac3b5b17e466a11f9f673ddbbf8df61262de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wmpnetwk.exe
        • Path \??\c:\program files\windows media player\wmpnetwk.exe
        • Size 1.5MB
        • SHA256 1e3a18744c31703b47fe28901a837dfc490ef3bbcdab174bc32308fba574175b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fxssvc.exe
        • Path \??\c:\windows\system32\fxssvc.exe
        • Size 1.2MB
        • SHA256 c290f4157b12ba31bbc542821e7f215b1e247d49ad12a2aed613db4f5eb90e80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msdtc.exe
        • Path \??\c:\windows\system32\msdtc.exe
        • Size 724KB
        • SHA256 6d99f66090e805b47389a04bf90b45d4a51e1336f51f87db0b5cea95b9a8a48c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msiexec.exe
        • Path \??\c:\windows\system32\msiexec.exe
        • Size 647KB
        • SHA256 4826c49fccd1bb333f0464daaafed3041a9349627f47cb35279042c083b7307f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snmptrap.exe
        • Path \??\c:\windows\system32\snmptrap.exe
        • Size 596KB
        • SHA256 43079a9e2e37bccc980d0957fe8d5126e20c6106432cd049cc4bb3ef67e55885
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/936-130-0x0000000140000000-0x00000001402C2000-memory.dmp
        Download

        memory/936-49-0x0000000140000000-0x00000001402C2000-memory.dmp
        Download

        memory/1748-15-0x0000000000400000-0x000000000069A000-memory.dmp
        Download

        memory/1748-0-0x0000000000400000-0x000000000069A000-memory.dmp
        Download

        memory/2324-141-0x0000000140000000-0x00000001402F5000-memory.dmp
        Download

        memory/2324-60-0x0000000140000000-0x00000001402F5000-memory.dmp
        Download

        memory/2756-24-0x0000000140000000-0x00000001404C7000-memory.dmp
        Download

        memory/2756-23-0x0000000140000000-0x00000001404C7000-memory.dmp
        Download

        memory/3472-17-0x0000000140000000-0x00000001404DD000-memory.dmp
        Download

        memory/3472-16-0x0000000140000000-0x00000001404DD000-memory.dmp
        Download

        memory/4552-66-0x0000000140000000-0x00000001403B3000-memory.dmp
        Download

        memory/4552-71-0x0000000140000000-0x00000001403B3000-memory.dmp
        Download

        memory/4844-30-0x0000000140000000-0x00000001402C8000-memory.dmp
        Download

        memory/4844-31-0x0000000140000000-0x00000001402C8000-memory.dmp
        Download

        memory/5088-154-0x0000000140000000-0x0000000140409000-memory.dmp
        Download

        memory/5088-73-0x0000000140000000-0x0000000140409000-memory.dmp
        Download