Analysis
- max time kernel
150s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/11/2026, 23:23
Behavioral task
behavioral1
Sample
2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe
- Size 338KB
- Sample261110-3dendscd26
- SHA256 9ce7e2745d8989f019978f8008c0ee5807a6fc93bda236b57ee754e9211328c8
- MD5 302781c089399fdd1c8d0d17dadcfb8c
- SHA1 d7e6ef68155dedfe9053fefd3de806bc5199fa51
- SHA512 558bb7731c45d718c4052319cede85524c1b6d55e98f2c8fdd384749c0a3da8be903b2f7cd505d1976b9655369741e8535897289efeaa6ae6269b984c0d2050a
- SSDEEP 3072:wjW/6oNYg/DomEMaP+be8Ijfr5R5SYj0LFjAiGcQVpRbVtE/yS5OLsrStJPuLgEp:wj2jamlC+MjX0RsrJRM62uPuLgE06T
- TLSH T164748C12FA418076C5210474AEFE3735D6FEBD311E25A7CBA38CCE166F74A80A62D746
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\ieUnatt.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\DpiScaling.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\gpresult.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\mountvol.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\MRINFO.EXE- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\recover.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\Taskmgr.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\chkdsk.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\compact.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\mmgaserver.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\tar.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\WWAHost.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\AtBroker.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\choice.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\dpnsvr.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\regedit.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\cliconfg.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\cttunesvr.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\efsui.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\Fondue.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\notepad.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\raserver.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\SearchIndexer.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\cmd.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\cmdkey.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\format.com- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\fsquirt.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\wusa.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\CloudNotifications.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\edpnotify.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\timeout.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\xwizard.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\edpnotify.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\ieUnatt.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\shrpubw.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\wecutil.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\cscript.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\mobsync.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\cmdkey.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\dpapimig.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\shrpubw.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\srdelayed.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\TapiUnattend.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\waitfor.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\comp.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\find.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\relog.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\wiaacmgr.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\Dism.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\dllhst3g.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\dxdiag.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\wowreg32.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\bthudtask.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe -
resource yara_rule behavioral2/memory/5248-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x000600000001b864-4.dat upx behavioral2/memory/5248-1480-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/5248-3273-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\show_third_party_software_licenses.bat- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Windows Defender\DlpUserAgent.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Windows Defender\MpCmdRun.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Windows Defender\MpDefenderCoreService.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Windows Defender\MpDefenderCoreService.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\dotnet\dotnet.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Windows Media Player\wmpshare.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\HOSTNAME.EXE- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-icm-dccw_31bf3856ad364e35_10.0.26100.1_none_2236fe932b70aa37\dccw.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_aspnet_regbrowsers_b03f5f7f11d50a3a_10.0.26100.1_none_65fa7713b81f7fd0\aspnet_regbrowsers.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.26100.1591_none_08d143c7d80566f8\r\windeploy.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.26100.1742_none_fcf4914266c3a69d\AppInstallerBackgroundUpdate.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.26100.1591_none_815687268bc7e515\WindowsSandboxClient.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1150_none_fd0acb47aebf06db\tracerpt.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_48e47fdfbf0a33b1\TiWorker.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\MSBuild.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-c..periencehost-broker_31bf3856ad364e35_10.0.26100.1150_none_dad1c69b80d09caa\CloudExperienceHostBroker.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ndkperf-setup_31bf3856ad364e35_10.0.26100.1150_none_862cccb1155d1695\r\NDKPerfCmd.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1591_none_4aa2580f59a05075\r\wuaucltcore.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1_none_aa346e257779a3b3\TiWorker.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SystemApps\Windows.CBSPreview_cw5n1h2txyewy\CameraBarcodeScannerPreview.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-edge-webview_31bf3856ad364e35_10.0.26100.1_none_8fe1c356f34a19ca\notification_helper.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_msbuild_b03f5f7f11d50a3a_10.0.26100.1_none_ddc589fe5044ffed\MSBuild.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ktmutil_31bf3856ad364e35_10.0.26100.1_none_8fd24ad09e1634f0\ktmutil.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-i..atedusermode-kernel_31bf3856ad364e35_10.0.26100.1742_none_83617bab44bfd415\securekernel.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.26100.1591_none_66584740e63efa06\InputSwitchToastHandler.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux_31bf3856ad364e35_10.0.26100.1591_none_f78199e24ed908bc\r\slui.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-web-app-host_31bf3856ad364e35_10.0.26100.1_none_2f836f38379760e2\WWAHost.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..services-core-files_31bf3856ad364e35_10.0.26100.1150_none_2bd28325d6e61084\dsamain.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-tools_31bf3856ad364e35_10.0.26100.1150_none_73e2ba5833894ee6\r\wbemtest.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_aspnet_regbrowsers_b03f5f7f11d50a3a_4.0.15912.355_none_5c657b87715a8e52\aspnet_regbrowsers.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..pertiescomputername_31bf3856ad364e35_10.0.26100.1_none_2d66dab1a4ca9883\SystemPropertiesComputerName.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..-remoteapplications_31bf3856ad364e35_10.0.26100.1591_none_ddd035314c6868c8\r\rdpinit.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\wow64_caspol_b03f5f7f11d50a3a_4.0.15912.0_none_f28dd746997c1837\CasPol.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.26100.1742_none_b56d38775a1eaac9\r\mmc.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_8465405a0441f0fb\doskey.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.26100.1_none_b53c1c347378366d\unregmp2.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cttunesvr_31bf3856ad364e35_10.0.26100.1150_none_8be227bace421d8d\cttunesvr.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-certutil_31bf3856ad364e35_10.0.26100.1591_none_5b99ad6617c42c0b\r\certutil.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapphost_31bf3856ad364e35_10.0.26100.1591_none_97668666133579f2\r\LockAppHost.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sxs_31bf3856ad364e35_10.0.26100.1150_none_4a33ec93078da3bd\sxstrace.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-certutil_31bf3856ad364e35_10.0.26100.1591_none_5b99ad6617c42c0b\certutil.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-driververifier_31bf3856ad364e35_10.0.26100.1_none_c1b42dca39a8c2ca\verifiergui.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..iondata-cmdlinetool_31bf3856ad364e35_10.0.26100.1150_none_24124d3c551588ce\r\bcdedit.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.26100.1150_none_25a595b3a76ab6cf\r\ImeBroker.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-win32calc_31bf3856ad364e35_10.0.26100.1150_none_e5966fa8c7a04cf1\r\win32calc.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\msil_smsvchost_b03f5f7f11d50a3a_10.0.26100.1_none_b6996f0c07fabc7a\SMSvcHost.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvsystem_31bf3856ad364e35_10.0.26100.1150_none_e501748828a1adac\r\AppVClient.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\x86_netfx35linq-csharp_31bf3856ad364e35_10.0.26100.1_none_b800bbe6c459021b\csc.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\x86_regsvcs_b03f5f7f11d50a3a_4.0.15912.0_none_8ec56a4c64c63b5b\RegSvcs.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_aspnet_compiler_b03f5f7f11d50a3a_4.0.15912.0_none_75b001d640e3113b\aspnet_compiler.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..hreshold-adminflows_31bf3856ad364e35_10.0.26100.1591_none_bc6c19c8cde9cb50\SystemSettingsAdminFlows.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..services-sessionmsg_31bf3856ad364e35_10.0.26100.1150_none_d6b9ea087315f389\r\sessionmsg.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_netfx35linq-csharp_31bf3856ad364e35_10.0.26100.1_none_141f576a7cb67351\csc.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.26100.1591_none_51f10c4fde15e277\msinfo32.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\x86_aspnet_regsql_b03f5f7f11d50a3a_10.0.26100.1_none_f419bf716fbd61e7\aspnet_regsql.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_10.0.26100.1591_none_361f20b3ac5f9b91\nltest.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sensors-runtimebroker_31bf3856ad364e35_10.0.26100.1591_none_4483428c4f7fb3a1\r\SensorRuntimeBroker.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-snippingtool-app_31bf3856ad364e35_10.0.26100.1150_none_35ab52a6398cdc65\r\SnippingTool.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.26100.1_none_a518656df7c165fb\SenseCE.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-impexp-extexport_31bf3856ad364e35_11.0.26100.1_none_02c44855de8e9d74\ExtExport.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-regini_31bf3856ad364e35_10.0.26100.1_none_0949e4cf225d7e03\regini.exe- 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-09_302781c089399fdd1c8d0d17dadcfb8c_conti_elex_rhadamanthys.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5248
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 887KB
- SHA256 110a945be9e56e71b618ecabc679bf2c477cd8eca9e3adf5523fb67ecd34e5dc
- MD5 647d40c63b013453414edf88af9f79cd
- SHA1 9d257deda1f54afaf120e25c8e6ce765851da58b
- SHA512 1df84eb577330ccac40fa22cf374aae67f22bcedd9c6bea4c58688bcfd1b88a8f5f2b1d67561f08b00f5d84921f25f03ac3d566179f3b113d501226be1e63964
- SSDEEP 12288:vckqtF4XZNYVLeyUji0h90ZD0wxpGZIVuKrHs1:vcFI0Le5ji0hmxNrM1
- TLSH T176153B16F6748335D073C0B9C5E6A7AAEA7134411B308ACB5385CB6C3F67AD6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH