3f063eff823d07a9f5ea740aa5975b92b6e4a238f7bc0eb222de244b0d4516d2

Analysis

max time kernel
121s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
30/03/2025, 16:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-03-30_1e7736c45ca86406b14dc22de70d8300_amadey_rhadamanthys_smoke-loader.exe
Size

6.1MB
MD5

1e7736c45ca86406b14dc22de70d8300
SHA1

76dea3dab0663a74a20dd319daecdfcbd9f2865b
SHA256

3f063eff823d07a9f5ea740aa5975b92b6e4a238f7bc0eb222de244b0d4516d2
SHA512

ce9450b461e63e754e21947ea5b7ab9b2c617bc2332745008d2f19dc7f9c2f5072f2d66a2d8378e4e9669e210dc7ac21e2fc5d3b8ff8e6133f49c16e876393cb
SSDEEP

98304:2oqTB3hkFfGMTPQLco1gufrVqV26hgDFrteSdvggzmRLIo6Eg0:6hkFfGMkASVqV26hgDneS1FyRUo6Eg0

Score

7^/10

discovery upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation	2025-03-30_1e7736c45ca86406b14dc22de70d8300_amadey_rhadamanthys_smoke-loader.exe

Executes dropped EXE 3 IoCs

pid	Process
4580	qqgvzaumno.exe
4844	gyrarutskx.exe
5228	bindsvc.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wideshut.exe	gyrarutskx.exe
File opened for modification	C:\Windows\SysWOW64\wideshut.exe	gyrarutskx.exe
File created	C:\Windows\SysWOW64\wimsvc.exe	gyrarutskx.exe
File created	C:\Windows\SysWOW64\racfg.exe	gyrarutskx.exe
File created	C:\Windows\SysWOW64\bindsvc.exe	gyrarutskx.exe
File created	C:\Windows\system32\msfte.dll	gyrarutskx.exe
File created	C:\Windows\system32\oci.dll	gyrarutskx.exe
File created	C:\Windows\System32\bindsvc.exe	gyrarutskx.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000600000002299a-10.dat	upx
behavioral2/memory/4844-11-0x0000000000860000-0x00000000009DA000-memory.dmp	upx
behavioral2/memory/4844-194-0x0000000000860000-0x00000000009DA000-memory.dmp	upx
behavioral2/memory/4844-212-0x0000000000860000-0x00000000009DA000-memory.dmp	upx

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2752	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qqgvzaumno.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gyrarutskx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bindsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-03-30_1e7736c45ca86406b14dc22de70d8300_amadey_rhadamanthys_smoke-loader.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000c42cd2f8ea1db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d02936308ea1db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000064e8b6308ea1db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000763c49308ea1db01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b2abda308ea1db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009fdee92f8ea1db01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000072db27308ea1db01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4844	gyrarutskx.exe
4844	gyrarutskx.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: 33	4548	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4548	SearchIndexer.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 4580	4848	2025-03-30_1e7736c45ca86406b14dc22de70d8300_amadey_rhadamanthys_smoke-loader.exe	88
PID 4848 wrote to memory of 4580	4848	2025-03-30_1e7736c45ca86406b14dc22de70d8300_amadey_rhadamanthys_smoke-loader.exe	88
PID 4848 wrote to memory of 4580	4848	2025-03-30_1e7736c45ca86406b14dc22de70d8300_amadey_rhadamanthys_smoke-loader.exe	88
PID 4848 wrote to memory of 4844	4848	2025-03-30_1e7736c45ca86406b14dc22de70d8300_amadey_rhadamanthys_smoke-loader.exe	89
PID 4848 wrote to memory of 4844	4848	2025-03-30_1e7736c45ca86406b14dc22de70d8300_amadey_rhadamanthys_smoke-loader.exe	89
PID 4848 wrote to memory of 4844	4848	2025-03-30_1e7736c45ca86406b14dc22de70d8300_amadey_rhadamanthys_smoke-loader.exe	89
PID 4548 wrote to memory of 1628	4548	SearchIndexer.exe	91
PID 4548 wrote to memory of 1628	4548	SearchIndexer.exe	91
PID 4548 wrote to memory of 2176	4548	SearchIndexer.exe	92
PID 4548 wrote to memory of 2176	4548	SearchIndexer.exe	92
PID 4844 wrote to memory of 1400	4844	gyrarutskx.exe	99
PID 4844 wrote to memory of 1400	4844	gyrarutskx.exe	99
PID 1400 wrote to memory of 2752	1400	cmd.exe	102
PID 1400 wrote to memory of 2752	1400	cmd.exe	102
PID 4844 wrote to memory of 3076	4844	gyrarutskx.exe	103
PID 4844 wrote to memory of 3076	4844	gyrarutskx.exe	103
PID 4844 wrote to memory of 5228	4844	gyrarutskx.exe	104
PID 4844 wrote to memory of 5228	4844	gyrarutskx.exe	104
PID 4844 wrote to memory of 5228	4844	gyrarutskx.exe	104

C:\Users\Admin\AppData\Local\Temp\2025-03-30_1e7736c45ca86406b14dc22de70d8300_amadey_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2025-03-30_1e7736c45ca86406b14dc22de70d8300_amadey_rhadamanthys_smoke-loader.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Users\Admin\AppData\Local\Temp\qqgvzaumno.exe
  "C:\Users\Admin\AppData\Local\Temp\qqgvzaumno.exe" "C:\Users\Admin\AppData\Local\Temp\qnbfheutsi.exe" "C:\Users\Admin\AppData\Local\Temp\2025-03-30_1e7736c45ca86406b14dc22de70d8300_amadey_rhadamanthys_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4580
- C:\Users\Admin\AppData\Local\Temp\gyrarutskx.exe
  C:\Users\Admin\AppData\Local\Temp\gyrarutskx.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Windows\System32\cmd.exe
    /c sc config msdtc obj= LocalSystem
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1400
  - - C:\Windows\system32\sc.exe
      sc config msdtc obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:2752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\vN3OaUm8.bat"
    3⤵
    PID:3076
- - C:\Windows\System32\bindsvc.exe
    "C:\Windows\System32\bindsvc.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5228

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1628
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:2176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gyrarutskx.exe

Filesize
580KB

MD5
2c2029588ad8b86759c17b7ae885ee03

SHA1
91653b5344d4c210201218e2f215dd5228d76799

SHA256
3ab288c47914e33cc61985e46502158400faa9d7187b55c19039b8795504a290

SHA512
88531fe6b0f2d66ada368a431f912868f74f9ed8ade9dc88887807b761490fe2cc317e1b6b40e7070411924c80971f237dca68ad2faafa7b4b1ecd2ec90c860f

Download Submit
C:\Users\Admin\AppData\Local\Temp\qqgvzaumno.exe

Filesize
51KB

MD5
e48b89715bf5e4c55eb5a1fed67865d9

SHA1
89a287da39e14b02cdc284eb287549462346d724

SHA256
c25d90168fc2026d8ed2a69c066bd5a7e11004c3899928a7db24cb7636fc4d9e

SHA512
4bd77d2fa5da646009ebeeedb5610048c58598ee7e5aeb5660b0c01042f0f34a88f89181e13e86c06cae9984155d0299128a2aee1c2c16f18e284db4745d850c

Download Submit
C:\Users\Admin\AppData\Local\Temp\vN3OaUm8.bat

Filesize
196B

MD5
691ebb5cf64d44fbf0d7f1c14d26248b

SHA1
4b890740d7d4b035c4f53308c9a34b861c9bc312

SHA256
1589b566ddb9e1cb3c255fad128fb688d394b87217a8ee4bbe2f7d682e71a0f9

SHA512
5538fd7299f744209ae115fd29b2ae33475ff4208cc9478f4fd43fa4d3f60c2ba455753d500d7c5698a57a7e00d0d865d00e2b3f0565ce59ba942bcb91d8e02c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UserSetting\trnmg.sdb

Filesize
1KB

MD5
f229feaf0b03c22a2df16649a77087a7

SHA1
0a9b85eea0ec28316945349cd6312faf934c1cab

SHA256
5a9171a6586d682cd76fdb7903f6ff804d28abefeb2b1cb7522db51a69c48884

SHA512
cf3635e130641df8ee819ecdba164c22b1d19eff9ca0f7ea2da1fb7eb61badac7367c6fd7eda3da9df4ddd127884e13b39f2ff7884efd128fdcd3b7ca9cbc676

Download Submit
C:\Windows\System32\bindsvc.exe

Filesize
291KB

MD5
7c5b397fb54d5aa06bd2a6fb99c62fee

SHA1
a9e0bf7bbabf6ab9e294156985537ae972ebd743

SHA256
d032bdc64c9451bbb653b346c5bd6ac9f83a91edeb0155497f098c8d6182ddee

SHA512
daa4702eff625b5dd1edca358c653338cff4eeca4e43d12dfd39bbc52acf8dfde3b963d190cf4426e405d9db8bcc9817cd50868055aa0d4a9efe4d1042beaf0c

Download Submit
memory/2176-74-0x000001D52A630000-0x000001D52A640000-memory.dmp

Filesize
64KB

Download
memory/2176-78-0x000001D52A630000-0x000001D52A640000-memory.dmp

Filesize
64KB

Download
memory/2176-67-0x000001D52A630000-0x000001D52A640000-memory.dmp

Filesize
64KB

Download
memory/2176-75-0x000001D52A630000-0x000001D52A640000-memory.dmp

Filesize
64KB

Download
memory/2176-59-0x000001D52A630000-0x000001D52A640000-memory.dmp

Filesize
64KB

Download
memory/2176-60-0x000001D52A630000-0x000001D52A640000-memory.dmp

Filesize
64KB

Download
memory/2176-61-0x000001D52A630000-0x000001D52A640000-memory.dmp

Filesize
64KB

Download
memory/2176-64-0x000001D52A630000-0x000001D52A640000-memory.dmp

Filesize
64KB

Download
memory/2176-63-0x000001D52A630000-0x000001D52A640000-memory.dmp

Filesize
64KB

Download
memory/2176-62-0x000001D52A630000-0x000001D52A640000-memory.dmp

Filesize
64KB

Download
memory/2176-65-0x000001D52A630000-0x000001D52A640000-memory.dmp

Filesize
64KB

Download
memory/2176-66-0x000001D52A630000-0x000001D52A640000-memory.dmp

Filesize
64KB

Download
memory/2176-69-0x000001D52A630000-0x000001D52A640000-memory.dmp

Filesize
64KB

Download
memory/2176-68-0x000001D52A630000-0x000001D52A640000-memory.dmp

Filesize
64KB

Download
memory/2176-70-0x000001D52A630000-0x000001D52A640000-memory.dmp

Filesize
64KB

Download
memory/2176-76-0x000001D52A630000-0x000001D52A640000-memory.dmp

Filesize
64KB

Download
memory/2176-73-0x000001D52A630000-0x000001D52A640000-memory.dmp

Filesize
64KB

Download
memory/2176-72-0x000001D52A630000-0x000001D52A640000-memory.dmp

Filesize
64KB

Download
memory/2176-71-0x000001D52A630000-0x000001D52A640000-memory.dmp

Filesize
64KB

Download
memory/2176-81-0x000001D52A630000-0x000001D52A640000-memory.dmp

Filesize
64KB

Download
memory/2176-80-0x000001D52A630000-0x000001D52A640000-memory.dmp

Filesize
64KB

Download
memory/2176-79-0x000001D52A630000-0x000001D52A640000-memory.dmp

Filesize
64KB

Download
memory/2176-77-0x000001D52A630000-0x000001D52A640000-memory.dmp

Filesize
64KB

Download
memory/2176-86-0x000001D52A630000-0x000001D52A640000-memory.dmp

Filesize
64KB

Download
memory/2176-85-0x000001D52A630000-0x000001D52A640000-memory.dmp

Filesize
64KB

Download
memory/2176-84-0x000001D52A630000-0x000001D52A640000-memory.dmp

Filesize
64KB

Download
memory/2176-83-0x000001D52A630000-0x000001D52A640000-memory.dmp

Filesize
64KB

Download
memory/2176-82-0x000001D52A630000-0x000001D52A640000-memory.dmp

Filesize
64KB

Download
memory/4548-54-0x0000019145F90000-0x0000019145F98000-memory.dmp

Filesize
32KB

Download
memory/4548-50-0x0000019144840000-0x0000019144848000-memory.dmp

Filesize
32KB

Download
memory/4548-57-0x0000019145F90000-0x0000019145F98000-memory.dmp

Filesize
32KB

Download
memory/4548-55-0x0000019145F80000-0x0000019145F81000-memory.dmp

Filesize
4KB

Download
memory/4548-18-0x000001913C250000-0x000001913C260000-memory.dmp

Filesize
64KB

Download
memory/4548-34-0x000001913C350000-0x000001913C360000-memory.dmp

Filesize
64KB

Download
memory/4844-194-0x0000000000860000-0x00000000009DA000-memory.dmp

Filesize
1.5MB

Download
memory/4844-212-0x0000000000860000-0x00000000009DA000-memory.dmp

Filesize
1.5MB

Download
memory/4844-11-0x0000000000860000-0x00000000009DA000-memory.dmp

Filesize
1.5MB

Download