42cdd97b333d36f2b18ec2bd5633012aa386dbc6a1d0b1f8b814ad1068e5f55a

Analysis

max time kernel
132s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
30/03/2025, 16:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-03-30_222f7516c7424f05fd0cbbcbdf25cd0b_amadey_rhadamanthys_smoke-loader.exe
Size

5.5MB
MD5

222f7516c7424f05fd0cbbcbdf25cd0b
SHA1

1c0de6486a859d7fc373e294bc893187bf6226d3
SHA256

42cdd97b333d36f2b18ec2bd5633012aa386dbc6a1d0b1f8b814ad1068e5f55a
SHA512

5934f6552b2dc6b1658e0f46b586e25ec744e0a29d63ad124fe1b558f21821270489d97225ec22a0b21c795f291f870e26da68b792c4eee90076b7f9a34c7143
SSDEEP

98304:IGoqTB3ovZVtMnYhWYJgJheWRsFn0iydrEXvZG:Iqg/MYkYOJhjRsF0i+oxG

Score

7^/10

discovery upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	2025-03-30_222f7516c7424f05fd0cbbcbdf25cd0b_amadey_rhadamanthys_smoke-loader.exe

Executes dropped EXE 3 IoCs

pid	Process
3660	encdgrpdlp.exe
5428	jzfbcgxrzi.exe
2612	bindsvc.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\bindsvc.exe	jzfbcgxrzi.exe
File created	C:\Windows\system32\msfte.dll	jzfbcgxrzi.exe
File created	C:\Windows\system32\oci.dll	jzfbcgxrzi.exe
File created	C:\Windows\System32\bindsvc.exe	jzfbcgxrzi.exe
File created	C:\Windows\SysWOW64\wideshut.exe	jzfbcgxrzi.exe
File opened for modification	C:\Windows\SysWOW64\wideshut.exe	jzfbcgxrzi.exe
File created	C:\Windows\SysWOW64\wimsvc.exe	jzfbcgxrzi.exe
File created	C:\Windows\SysWOW64\racfg.exe	jzfbcgxrzi.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00080000000242cc-10.dat	upx
behavioral2/memory/5428-11-0x0000000000010000-0x000000000018A000-memory.dmp	upx
behavioral2/memory/5428-112-0x0000000000010000-0x000000000018A000-memory.dmp	upx
behavioral2/memory/5428-128-0x0000000000010000-0x000000000018A000-memory.dmp	upx

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3612	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-03-30_222f7516c7424f05fd0cbbcbdf25cd0b_amadey_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	encdgrpdlp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jzfbcgxrzi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bindsvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009b9055388ea1db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007c1435378ea1db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004216bc388ea1db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c062e9388ea1db01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000298af0388ea1db01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c3fe05398ea1db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008cd758378ea1db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008c4fd6388ea1db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009feeb4388ea1db01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000298af0388ea1db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cfb1d8388ea1db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5428	jzfbcgxrzi.exe
5428	jzfbcgxrzi.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: 33	2992	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2992	SearchIndexer.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 3660	1532	2025-03-30_222f7516c7424f05fd0cbbcbdf25cd0b_amadey_rhadamanthys_smoke-loader.exe	89
PID 1532 wrote to memory of 3660	1532	2025-03-30_222f7516c7424f05fd0cbbcbdf25cd0b_amadey_rhadamanthys_smoke-loader.exe	89
PID 1532 wrote to memory of 3660	1532	2025-03-30_222f7516c7424f05fd0cbbcbdf25cd0b_amadey_rhadamanthys_smoke-loader.exe	89
PID 1532 wrote to memory of 5428	1532	2025-03-30_222f7516c7424f05fd0cbbcbdf25cd0b_amadey_rhadamanthys_smoke-loader.exe	90
PID 1532 wrote to memory of 5428	1532	2025-03-30_222f7516c7424f05fd0cbbcbdf25cd0b_amadey_rhadamanthys_smoke-loader.exe	90
PID 1532 wrote to memory of 5428	1532	2025-03-30_222f7516c7424f05fd0cbbcbdf25cd0b_amadey_rhadamanthys_smoke-loader.exe	90
PID 2992 wrote to memory of 4524	2992	SearchIndexer.exe	92
PID 2992 wrote to memory of 4524	2992	SearchIndexer.exe	92
PID 2992 wrote to memory of 4600	2992	SearchIndexer.exe	93
PID 2992 wrote to memory of 4600	2992	SearchIndexer.exe	93
PID 5428 wrote to memory of 6020	5428	jzfbcgxrzi.exe	101
PID 5428 wrote to memory of 6020	5428	jzfbcgxrzi.exe	101
PID 6020 wrote to memory of 3612	6020	cmd.exe	103
PID 6020 wrote to memory of 3612	6020	cmd.exe	103
PID 5428 wrote to memory of 3196	5428	jzfbcgxrzi.exe	104
PID 5428 wrote to memory of 3196	5428	jzfbcgxrzi.exe	104
PID 5428 wrote to memory of 2612	5428	jzfbcgxrzi.exe	105
PID 5428 wrote to memory of 2612	5428	jzfbcgxrzi.exe	105
PID 5428 wrote to memory of 2612	5428	jzfbcgxrzi.exe	105

C:\Users\Admin\AppData\Local\Temp\2025-03-30_222f7516c7424f05fd0cbbcbdf25cd0b_amadey_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2025-03-30_222f7516c7424f05fd0cbbcbdf25cd0b_amadey_rhadamanthys_smoke-loader.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Users\Admin\AppData\Local\Temp\encdgrpdlp.exe
  "C:\Users\Admin\AppData\Local\Temp\encdgrpdlp.exe" "C:\Users\Admin\AppData\Local\Temp\eunlyyzftq.exe" "C:\Users\Admin\AppData\Local\Temp\2025-03-30_222f7516c7424f05fd0cbbcbdf25cd0b_amadey_rhadamanthys_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3660
- C:\Users\Admin\AppData\Local\Temp\jzfbcgxrzi.exe
  C:\Users\Admin\AppData\Local\Temp\jzfbcgxrzi.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5428
- - C:\Windows\System32\cmd.exe
    /c sc config msdtc obj= LocalSystem
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6020
  - - C:\Windows\system32\sc.exe
      sc config msdtc obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:3612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\mk02C6re.bat"
    3⤵
    PID:3196
- - C:\Windows\System32\bindsvc.exe
    "C:\Windows\System32\bindsvc.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2612

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4524
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 804 808 816 8192 812 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\encdgrpdlp.exe

Filesize
51KB

MD5
e48b89715bf5e4c55eb5a1fed67865d9

SHA1
89a287da39e14b02cdc284eb287549462346d724

SHA256
c25d90168fc2026d8ed2a69c066bd5a7e11004c3899928a7db24cb7636fc4d9e

SHA512
4bd77d2fa5da646009ebeeedb5610048c58598ee7e5aeb5660b0c01042f0f34a88f89181e13e86c06cae9984155d0299128a2aee1c2c16f18e284db4745d850c

Download Submit
C:\Users\Admin\AppData\Local\Temp\jzfbcgxrzi.exe

Filesize
580KB

MD5
2c2029588ad8b86759c17b7ae885ee03

SHA1
91653b5344d4c210201218e2f215dd5228d76799

SHA256
3ab288c47914e33cc61985e46502158400faa9d7187b55c19039b8795504a290

SHA512
88531fe6b0f2d66ada368a431f912868f74f9ed8ade9dc88887807b761490fe2cc317e1b6b40e7070411924c80971f237dca68ad2faafa7b4b1ecd2ec90c860f

Download Submit
C:\Users\Admin\AppData\Local\Temp\mk02C6re.bat

Filesize
196B

MD5
b96ab885fc033e97586891a683d56227

SHA1
941cbc2c4a7048d0b8c9b6869e38096b856d289a

SHA256
db05e0379c9feb53bb0a013b43669dfa6a1eef5374e2e52978971a156ebb02b1

SHA512
3cf3eb2b2104c04acf5a804a1caa3336543358bce87967f3c165f544fc0663f8b9bf0e255383b956a27f734adb189834f94ce48eb24b3f4a3e712d480f3d94e9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UserSetting\trnmg.sdb

Filesize
1KB

MD5
8b0e8b068f8477d7256761ddba7a4dc9

SHA1
71df7c5450ae59edcec42f00dc49083f22faf91a

SHA256
2c975d1b1dac6381154b02863df61039a44a83a528666cedbc2eccde991cb54a

SHA512
453bd9ee84eb36605e5d65bbd32438f8853d0aad304ca86e7cef8f91cabf1478a695f14aa4441760aa6390bcd9c685e2a5724ed8bb4e6aed5505d54ef2bef1f5

Download Submit
C:\Windows\SysWOW64\bindsvc.exe

Filesize
291KB

MD5
7c5b397fb54d5aa06bd2a6fb99c62fee

SHA1
a9e0bf7bbabf6ab9e294156985537ae972ebd743

SHA256
d032bdc64c9451bbb653b346c5bd6ac9f83a91edeb0155497f098c8d6182ddee

SHA512
daa4702eff625b5dd1edca358c653338cff4eeca4e43d12dfd39bbc52acf8dfde3b963d190cf4426e405d9db8bcc9817cd50868055aa0d4a9efe4d1042beaf0c

Download Submit
memory/2992-34-0x000002409AF90000-0x000002409AFA0000-memory.dmp

Filesize
64KB

Download
memory/2992-18-0x000002409AE90000-0x000002409AEA0000-memory.dmp

Filesize
64KB

Download
memory/2992-50-0x00000240A3480000-0x00000240A3488000-memory.dmp

Filesize
32KB

Download
memory/2992-54-0x00000240A4690000-0x00000240A4698000-memory.dmp

Filesize
32KB

Download
memory/4600-69-0x0000028521D20000-0x0000028521D30000-memory.dmp

Filesize
64KB

Download
memory/4600-75-0x0000028521D20000-0x0000028521D30000-memory.dmp

Filesize
64KB

Download
memory/4600-60-0x0000028521D20000-0x0000028521D30000-memory.dmp

Filesize
64KB

Download
memory/4600-61-0x0000028521D20000-0x0000028521D30000-memory.dmp

Filesize
64KB

Download
memory/4600-62-0x0000028521D20000-0x0000028521D30000-memory.dmp

Filesize
64KB

Download
memory/4600-63-0x0000028521D20000-0x0000028521D30000-memory.dmp

Filesize
64KB

Download
memory/4600-66-0x0000028521D20000-0x0000028521D30000-memory.dmp

Filesize
64KB

Download
memory/4600-67-0x0000028521D20000-0x0000028521D30000-memory.dmp

Filesize
64KB

Download
memory/4600-65-0x0000028521D20000-0x0000028521D30000-memory.dmp

Filesize
64KB

Download
memory/4600-70-0x0000028521D20000-0x0000028521D30000-memory.dmp

Filesize
64KB

Download
memory/4600-71-0x0000028521D20000-0x0000028521D30000-memory.dmp

Filesize
64KB

Download
memory/4600-58-0x0000028521D20000-0x0000028521D30000-memory.dmp

Filesize
64KB

Download
memory/4600-68-0x0000028521D20000-0x0000028521D30000-memory.dmp

Filesize
64KB

Download
memory/4600-64-0x0000028521D20000-0x0000028521D30000-memory.dmp

Filesize
64KB

Download
memory/4600-72-0x0000028521D20000-0x0000028521D30000-memory.dmp

Filesize
64KB

Download
memory/4600-73-0x0000028521D20000-0x0000028521D30000-memory.dmp

Filesize
64KB

Download
memory/4600-74-0x0000028521D20000-0x0000028521D30000-memory.dmp

Filesize
64KB

Download
memory/4600-59-0x0000028521D20000-0x0000028521D30000-memory.dmp

Filesize
64KB

Download
memory/4600-76-0x0000028521D20000-0x0000028521D30000-memory.dmp

Filesize
64KB

Download
memory/4600-77-0x0000028521D20000-0x0000028521D30000-memory.dmp

Filesize
64KB

Download
memory/4600-78-0x0000028521D20000-0x0000028521D30000-memory.dmp

Filesize
64KB

Download
memory/4600-79-0x0000028521D20000-0x0000028521D30000-memory.dmp

Filesize
64KB

Download
memory/4600-80-0x0000028521D20000-0x0000028521D30000-memory.dmp

Filesize
64KB

Download
memory/4600-83-0x0000028521D20000-0x0000028521D30000-memory.dmp

Filesize
64KB

Download
memory/4600-82-0x0000028521D20000-0x0000028521D30000-memory.dmp

Filesize
64KB

Download
memory/4600-81-0x0000028521D20000-0x0000028521D30000-memory.dmp

Filesize
64KB

Download
memory/4600-85-0x0000028521D20000-0x0000028521D30000-memory.dmp

Filesize
64KB

Download
memory/4600-84-0x0000028521D20000-0x0000028521D30000-memory.dmp

Filesize
64KB

Download
memory/4600-56-0x0000028521D20000-0x0000028521D30000-memory.dmp

Filesize
64KB

Download
memory/4600-57-0x0000028521D20000-0x0000028521D30000-memory.dmp

Filesize
64KB

Download
memory/5428-128-0x0000000000010000-0x000000000018A000-memory.dmp

Filesize
1.5MB

Download
memory/5428-112-0x0000000000010000-0x000000000018A000-memory.dmp

Filesize
1.5MB

Download
memory/5428-11-0x0000000000010000-0x000000000018A000-memory.dmp

Filesize
1.5MB

Download