Analysis
- max time kernel
149s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/11/2026, 23:23
Behavioral task
behavioral1
Sample
2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe
- Size 338KB
- Sample261110-3dendscd26
- SHA256 9ce7e2745d8989f019978f8008c0ee5807a6fc93bda236b57ee754e9211328c8
- MD5 302781c089399fdd1c8d0d17dadcfb8c
- SHA1 d7e6ef68155dedfe9053fefd3de806bc5199fa51
- SHA512 558bb7731c45d718c4052319cede85524c1b6d55e98f2c8fdd384749c0a3da8be903b2f7cd505d1976b9655369741e8535897289efeaa6ae6269b984c0d2050a
- SSDEEP 3072:wjW/6oNYg/DomEMaP+be8Ijfr5R5SYj0LFjAiGcQVpRbVtE/yS5OLsrStJPuLgEp:wj2jamlC+MjX0RsrJRM62uPuLgE06T
- TLSH T164748C12FA418076C5210474AEFE3735D6FEBD311E25A7CBA38CCE166F74A80A62D746
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\perfhost.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\relog.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\waitfor.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\wusa.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\dpapimig.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\dtdump.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\eudcedit.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\netsh.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\rundll32.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\tracerpt.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\ddodiag.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\iexpress.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\Netplwiz.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\PATHPING.EXE 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\winrs.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\systeminfo.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\WerFault.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\expand.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\raserver.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\user.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\openfiles.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\RMActivate.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\sfc.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\shrpubw.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\at.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\dpnsvr.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\timeout.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\control.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\find.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\ntprint.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\iscsicpl.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\explorer.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\perfhost.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\SettingSyncHost.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\winver.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\xwizard.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\convert.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\lodctr.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\setx.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\WerFault.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\winrshost.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\dialer.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\ftp.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\rasphone.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\SearchIndexer.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\SecEdit.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\appidtel.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\comp.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe -
resource yara_rule behavioral1/memory/4336-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/files/0x000300000001dc6f-4.dat upx behavioral1/memory/4336-1437-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/4336-3212-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Windows Media Player\wmprph.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Windows Mail\wabmig.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Mozilla Firefox\firefox.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Mozilla Firefox\updater.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Windows NT\Accessories\wordpad.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.19041.1266_none_e2f3aaf24de135ec\Magnify.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.19041.1266_none_22b99d078bbc3016\setup_wm.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..client-decoder-host_31bf3856ad364e35_10.0.19041.207_none_00b5dbdfab19326f\r\UtcDecoderHost.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_netfx35linq-csharp_31bf3856ad364e35_10.0.19041.1_none_cd1cbc8db3875f47\csc.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\WFServicesReg.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-d..ectxdatabaseupdater_31bf3856ad364e35_10.0.19041.928_none_138fb436497565f4\directxdatabaseupdater.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.19041.1_none_e1253388ca1ca1af\DismHost.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lishing-wmiprovider_31bf3856ad364e35_10.0.19041.1151_none_aa086da848b2c07b\rdpsign.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.19041.1081_none_7dd23580df04442f\f\DWWIN.EXE- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ces-backgroundagent_31bf3856ad364e35_10.0.19041.423_none_d8a242bf396f7d4d\f\SpaceAgent.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_10.0.19041.844_none_6f27e9e1e7c4fb87\f\net1.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-synchost_31bf3856ad364e35_10.0.19041.746_none_51cf02378fc26da3\r\SyncHost.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.19041.1081_none_6700b2d2d3c0055f\r\adamsync.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.19041.1266_none_c67a7a982eedc4e8\explorer.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\wow64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.19041.1151_none_2e15548db03a22c8\CheckNetIsolation.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\SecureAssessmentBrowser.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-coredpussvr_31bf3856ad364e35_10.0.19041.746_none_7946fb11bf19dc87\r\coredpussvr.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.19041.117_none_4d353cf1ceb5d6d2\notepad.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nslookup_31bf3856ad364e35_10.0.19041.1_none_8171817405d01500\nslookup.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..onentpackagesupport_31bf3856ad364e35_10.0.19041.746_none_3db5b5ee37a4dee7\r\CompPkgSrv.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-cmdline_31bf3856ad364e35_10.0.19041.746_none_a5751a882524bee1\r\Defrag.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-mbr2gpt_31bf3856ad364e35_10.0.19041.84_none_ee550b91ec0a7e82\f\MBR2GPT.EXE- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_d12f2a9a88909fc2\aspnetca.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..alenrollmentmanager_31bf3856ad364e35_10.0.19041.264_none_839983ebef167c68\f\CredentialEnrollmentManager.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.19041.1_none_2537dd4c480ec91b\rasdial.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-autofmt_31bf3856ad364e35_10.0.19041.1266_none_650ebab5a8c02ffc\f\autofmt.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-corruptedfilerecovery_31bf3856ad364e35_10.0.19041.1_none_3daac563c824d4e0\cofire.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..riseclientsync-host_31bf3856ad364e35_10.0.19041.207_none_ac38fc33d542b487\r\WorkFolders.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.264_none_583d67d6d00b6b6a\r\WerFaultSecure.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_a4f6113bccc284b7\chgusr.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.19041.1266_none_07a5d18b92d8b668\r\cmproxyd.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wsl_31bf3856ad364e35_10.0.19041.117_none_610933d42d963a44\r\wsl.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.19041.1081_none_ae0369bc9fe47e6c\f\appidtel.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.19041.1_none_2f8c879e7c6f8b16\rasdial.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..dialoghost.appxmain_31bf3856ad364e35_10.0.19041.423_none_edab5dd3a4c202d9\CredDialogHost.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\PrintDialog\PrintDialog.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpkinstall_31bf3856ad364e35_10.0.19041.746_none_e72c4ffca9db7315\f\lpkinstall.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_10.0.19041.1266_none_93a0f3defb54e912\f\rdpshell.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.19041.1081_none_e3f87355251e8c43\r\notepad.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.19041.1_none_4030851754b3e0fb\schtasks.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.19041.964_none_dddeea757b7fbba7\r\ssh.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\r\SyncAppvPublishingServer.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..onentpackagesupport_31bf3856ad364e35_10.0.19041.746_none_3db5b5ee37a4dee7\f\CompPkgSrv.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.19041.746_none_b5fe9c5c09b9d7a9\rundll32.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.19041.1_none_8b021141ec175d3e\sdbinst.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iechooser_31bf3856ad364e35_11.0.19041.746_none_122a74c9827fe81a\r\IEChooser.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-isoburn_31bf3856ad364e35_10.0.19041.746_none_c42bf1ebf80a8661\isoburn.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smartscreen_31bf3856ad364e35_10.0.19041.1052_none_323c9a9ad543e3a3\smartscreen.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_9aa166e99861c2bc\chgusr.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssadmin_31bf3856ad364e35_10.0.19041.1_none_7a6e62f3d1012ed4\vssadmin.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-setx_31bf3856ad364e35_10.0.19041.1_none_6cbc8da4ecceab64\setx.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..d-searchintegration_31bf3856ad364e35_10.0.19041.746_none_63b0fc68ee30f2cb\f\IMESEARCH.EXE- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_10.0.19041.1_none_8b6323099e7e4441\aspnet_regiis.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.19041.84_none_51ae5c25baf813ff\r\SgrmBroker.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.19041.746_none_ad0ed54dd130eec3\r\DismHost.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\vbc.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-e..taprotectioncleanup_31bf3856ad364e35_10.0.19041.789_none_b38221af158e5881\EDPCleanup.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.19041.423_none_df344b9fe5390f25\AppResolverUX.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.1266_none_eb6597ac99d11603\r\SpatialAudioLicenseSrv.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4336
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 887KB
- SHA256 110a945be9e56e71b618ecabc679bf2c477cd8eca9e3adf5523fb67ecd34e5dc
- MD5 647d40c63b013453414edf88af9f79cd
- SHA1 9d257deda1f54afaf120e25c8e6ce765851da58b
- SHA512 1df84eb577330ccac40fa22cf374aae67f22bcedd9c6bea4c58688bcfd1b88a8f5f2b1d67561f08b00f5d84921f25f03ac3d566179f3b113d501226be1e63964
- SSDEEP 12288:vckqtF4XZNYVLeyUji0h90ZD0wxpGZIVuKrHs1:vcFI0Le5ji0hmxNrM1
- TLSH T176153B16F6748335D073C0B9C5E6A7AAEA7134411B308ACB5385CB6C3F67AD6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH