0d715978543633d8b2eb9661c08c2c93f039418eb0754985c6a89e120270d114

Analysis

max time kernel
143s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
30/03/2025, 16:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-03-30_627bff73b072ecc872edc7aa2572dfb2_amadey_rhadamanthys_smoke-loader.exe
Size

7.8MB
MD5

627bff73b072ecc872edc7aa2572dfb2
SHA1

8cc229ae419780ca37fd28087e959a9f4574840a
SHA256

0d715978543633d8b2eb9661c08c2c93f039418eb0754985c6a89e120270d114
SHA512

0929a1cf0a64aa4458d1ffa1abcb9b8167ce0b48ae44c56647ba9329eefc176df025667a2280132d8912167e386ce8a8ab208ca59295885980721c6b7f95827e
SSDEEP

98304:HoqTB3Yle8vH5+pO5xLAqI+lBqyZyaUCQcyaEoA2M4dwqtTysyXVS4bGpCYP7T4X:f4eDpO7L6eQygaLpCYP71Hy9

Score

7^/10

discovery upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation	2025-03-30_627bff73b072ecc872edc7aa2572dfb2_amadey_rhadamanthys_smoke-loader.exe

Executes dropped EXE 3 IoCs

pid	Process
5804	hdaeubkbgt.exe
5588	awppgopnfo.exe
6004	bindsvc.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wideshut.exe	awppgopnfo.exe
File opened for modification	C:\Windows\SysWOW64\wideshut.exe	awppgopnfo.exe
File created	C:\Windows\SysWOW64\wimsvc.exe	awppgopnfo.exe
File created	C:\Windows\SysWOW64\racfg.exe	awppgopnfo.exe
File created	C:\Windows\SysWOW64\bindsvc.exe	awppgopnfo.exe
File created	C:\Windows\system32\msfte.dll	awppgopnfo.exe
File created	C:\Windows\system32\oci.dll	awppgopnfo.exe
File created	C:\Windows\System32\bindsvc.exe	awppgopnfo.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000f00000002405b-10.dat	upx
behavioral2/memory/5588-11-0x0000000000C50000-0x0000000000DCA000-memory.dmp	upx
behavioral2/memory/5588-207-0x0000000000C50000-0x0000000000DCA000-memory.dmp	upx
behavioral2/memory/5588-213-0x0000000000C50000-0x0000000000DCA000-memory.dmp	upx

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2232	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-03-30_627bff73b072ecc872edc7aa2572dfb2_amadey_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hdaeubkbgt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	awppgopnfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bindsvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000102acead8ea1db01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c9741aae8ea1db01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c9741aae8ea1db01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dd880eae8ea1db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d46912af8ea1db01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bf391fae8ea1db01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bf391fae8ea1db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a37158ae8ea1db01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5588	awppgopnfo.exe
5588	awppgopnfo.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: 33	1292	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1292	SearchIndexer.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 5804	5040	2025-03-30_627bff73b072ecc872edc7aa2572dfb2_amadey_rhadamanthys_smoke-loader.exe	88
PID 5040 wrote to memory of 5804	5040	2025-03-30_627bff73b072ecc872edc7aa2572dfb2_amadey_rhadamanthys_smoke-loader.exe	88
PID 5040 wrote to memory of 5804	5040	2025-03-30_627bff73b072ecc872edc7aa2572dfb2_amadey_rhadamanthys_smoke-loader.exe	88
PID 5040 wrote to memory of 5588	5040	2025-03-30_627bff73b072ecc872edc7aa2572dfb2_amadey_rhadamanthys_smoke-loader.exe	89
PID 5040 wrote to memory of 5588	5040	2025-03-30_627bff73b072ecc872edc7aa2572dfb2_amadey_rhadamanthys_smoke-loader.exe	89
PID 5040 wrote to memory of 5588	5040	2025-03-30_627bff73b072ecc872edc7aa2572dfb2_amadey_rhadamanthys_smoke-loader.exe	89
PID 1292 wrote to memory of 3256	1292	SearchIndexer.exe	92
PID 1292 wrote to memory of 3256	1292	SearchIndexer.exe	92
PID 1292 wrote to memory of 5680	1292	SearchIndexer.exe	93
PID 1292 wrote to memory of 5680	1292	SearchIndexer.exe	93
PID 5588 wrote to memory of 3816	5588	awppgopnfo.exe	102
PID 5588 wrote to memory of 3816	5588	awppgopnfo.exe	102
PID 3816 wrote to memory of 2232	3816	cmd.exe	104
PID 3816 wrote to memory of 2232	3816	cmd.exe	104
PID 5588 wrote to memory of 680	5588	awppgopnfo.exe	105
PID 5588 wrote to memory of 680	5588	awppgopnfo.exe	105
PID 5588 wrote to memory of 6004	5588	awppgopnfo.exe	107
PID 5588 wrote to memory of 6004	5588	awppgopnfo.exe	107
PID 5588 wrote to memory of 6004	5588	awppgopnfo.exe	107

C:\Users\Admin\AppData\Local\Temp\2025-03-30_627bff73b072ecc872edc7aa2572dfb2_amadey_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2025-03-30_627bff73b072ecc872edc7aa2572dfb2_amadey_rhadamanthys_smoke-loader.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Users\Admin\AppData\Local\Temp\hdaeubkbgt.exe
  "C:\Users\Admin\AppData\Local\Temp\hdaeubkbgt.exe" "C:\Users\Admin\AppData\Local\Temp\guiusugwbq.exe" "C:\Users\Admin\AppData\Local\Temp\2025-03-30_627bff73b072ecc872edc7aa2572dfb2_amadey_rhadamanthys_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5804
- C:\Users\Admin\AppData\Local\Temp\awppgopnfo.exe
  C:\Users\Admin\AppData\Local\Temp\awppgopnfo.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5588
- - C:\Windows\System32\cmd.exe
    /c sc config msdtc obj= LocalSystem
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3816
  - - C:\Windows\system32\sc.exe
      sc config msdtc obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:2232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2sIa819Z.bat"
    3⤵
    PID:680
- - C:\Windows\System32\bindsvc.exe
    "C:\Windows\System32\bindsvc.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6004

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3256
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 804 808 816 8192 812 788
  2⤵
  - Modifies data under HKEY_USERS
  PID:5680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2sIa819Z.bat

Filesize
196B

MD5
32caa304a11df8f2d85522120983192a

SHA1
fd3b340b4474d4dd9ceaea15b8865ad136da7a13

SHA256
7857fee3e84c9da66588673c12f9fdf207482d2f6b1ff56ce600309c3be19b8c

SHA512
b6fc7b5c9a2a782a8932bcffd65bbfbc1843a7e5abefc53f7106652c9969ccc3ecad8c92c7e35aaf4ae1c177d8cdac3abd11f610b5f4bcbd3bbbab4950b9da4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\awppgopnfo.exe

Filesize
580KB

MD5
2c2029588ad8b86759c17b7ae885ee03

SHA1
91653b5344d4c210201218e2f215dd5228d76799

SHA256
3ab288c47914e33cc61985e46502158400faa9d7187b55c19039b8795504a290

SHA512
88531fe6b0f2d66ada368a431f912868f74f9ed8ade9dc88887807b761490fe2cc317e1b6b40e7070411924c80971f237dca68ad2faafa7b4b1ecd2ec90c860f

Download Submit
C:\Users\Admin\AppData\Local\Temp\hdaeubkbgt.exe

Filesize
51KB

MD5
e48b89715bf5e4c55eb5a1fed67865d9

SHA1
89a287da39e14b02cdc284eb287549462346d724

SHA256
c25d90168fc2026d8ed2a69c066bd5a7e11004c3899928a7db24cb7636fc4d9e

SHA512
4bd77d2fa5da646009ebeeedb5610048c58598ee7e5aeb5660b0c01042f0f34a88f89181e13e86c06cae9984155d0299128a2aee1c2c16f18e284db4745d850c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UserSetting\trnmg.sdb

Filesize
1KB

MD5
c30cc964c0b91f25337ad550a1530563

SHA1
3c46f81f3005351918cbf533df46643c0ea0dc36

SHA256
d7f2344751ad94c699790e6c2490263fd7b7324e59d2daece958d4171937f6cb

SHA512
a54a01cc3ef99b13b43356e2bebf3580bb5189d93316d2b8dff0b36f9f31eebdfab2ad7dcb2a3ddbfc7ddff29934485f456b237a2fe43e200330dcde864f6c55

Download Submit
C:\Windows\System32\bindsvc.exe

Filesize
291KB

MD5
7c5b397fb54d5aa06bd2a6fb99c62fee

SHA1
a9e0bf7bbabf6ab9e294156985537ae972ebd743

SHA256
d032bdc64c9451bbb653b346c5bd6ac9f83a91edeb0155497f098c8d6182ddee

SHA512
daa4702eff625b5dd1edca358c653338cff4eeca4e43d12dfd39bbc52acf8dfde3b963d190cf4426e405d9db8bcc9817cd50868055aa0d4a9efe4d1042beaf0c

Download Submit
memory/1292-34-0x00000143F2690000-0x00000143F26A0000-memory.dmp

Filesize
64KB

Download
memory/1292-55-0x00000143FC210000-0x00000143FC211000-memory.dmp

Filesize
4KB

Download
memory/1292-54-0x00000143FC220000-0x00000143FC228000-memory.dmp

Filesize
32KB

Download
memory/1292-57-0x00000143FC210000-0x00000143FC218000-memory.dmp

Filesize
32KB

Download
memory/1292-50-0x00000143FAB60000-0x00000143FAB68000-memory.dmp

Filesize
32KB

Download
memory/1292-18-0x00000143F2590000-0x00000143F25A0000-memory.dmp

Filesize
64KB

Download
memory/5588-11-0x0000000000C50000-0x0000000000DCA000-memory.dmp

Filesize
1.5MB

Download
memory/5588-213-0x0000000000C50000-0x0000000000DCA000-memory.dmp

Filesize
1.5MB

Download
memory/5588-207-0x0000000000C50000-0x0000000000DCA000-memory.dmp

Filesize
1.5MB

Download
memory/5680-70-0x00000186242A0000-0x00000186242B0000-memory.dmp

Filesize
64KB

Download
memory/5680-77-0x00000186242A0000-0x00000186242B0000-memory.dmp

Filesize
64KB

Download
memory/5680-74-0x00000186242A0000-0x00000186242B0000-memory.dmp

Filesize
64KB

Download
memory/5680-73-0x00000186242A0000-0x00000186242B0000-memory.dmp

Filesize
64KB

Download
memory/5680-72-0x00000186242A0000-0x00000186242B0000-memory.dmp

Filesize
64KB

Download
memory/5680-71-0x00000186242A0000-0x00000186242B0000-memory.dmp

Filesize
64KB

Download
memory/5680-66-0x00000186242A0000-0x00000186242B0000-memory.dmp

Filesize
64KB

Download
memory/5680-68-0x00000186242A0000-0x00000186242B0000-memory.dmp

Filesize
64KB

Download
memory/5680-67-0x00000186242A0000-0x00000186242B0000-memory.dmp

Filesize
64KB

Download
memory/5680-62-0x00000186242A0000-0x00000186242B0000-memory.dmp

Filesize
64KB

Download
memory/5680-61-0x00000186242A0000-0x00000186242B0000-memory.dmp

Filesize
64KB

Download
memory/5680-75-0x00000186242A0000-0x00000186242B0000-memory.dmp

Filesize
64KB

Download
memory/5680-76-0x00000186242A0000-0x00000186242B0000-memory.dmp

Filesize
64KB

Download
memory/5680-69-0x00000186242A0000-0x00000186242B0000-memory.dmp

Filesize
64KB

Download
memory/5680-78-0x00000186242A0000-0x00000186242B0000-memory.dmp

Filesize
64KB

Download
memory/5680-80-0x00000186242A0000-0x00000186242B0000-memory.dmp

Filesize
64KB

Download
memory/5680-79-0x00000186242A0000-0x00000186242B0000-memory.dmp

Filesize
64KB

Download
memory/5680-81-0x00000186242A0000-0x00000186242B0000-memory.dmp

Filesize
64KB

Download
memory/5680-85-0x00000186242A0000-0x00000186242B0000-memory.dmp

Filesize
64KB

Download
memory/5680-84-0x00000186242A0000-0x00000186242B0000-memory.dmp

Filesize
64KB

Download
memory/5680-86-0x00000186242A0000-0x00000186242B0000-memory.dmp

Filesize
64KB

Download
memory/5680-83-0x00000186242A0000-0x00000186242B0000-memory.dmp

Filesize
64KB

Download
memory/5680-82-0x00000186242A0000-0x00000186242B0000-memory.dmp

Filesize
64KB

Download
memory/5680-63-0x00000186242A0000-0x00000186242B0000-memory.dmp

Filesize
64KB

Download
memory/5680-65-0x00000186242A0000-0x00000186242B0000-memory.dmp

Filesize
64KB

Download
memory/5680-64-0x00000186242A0000-0x00000186242B0000-memory.dmp

Filesize
64KB

Download
memory/5680-60-0x00000186242A0000-0x00000186242B0000-memory.dmp

Filesize
64KB

Download
memory/5680-59-0x00000186242A0000-0x00000186242B0000-memory.dmp

Filesize
64KB

Download