Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20250502-en -
resource tags
arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system -
submitted
14/05/2025, 23:24
Static task
static1
Behavioral task
behavioral1
Sample
2025-05-14_4d3e29ad90ef771439cb135b4c82e136_amadey_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
2025-05-14_4d3e29ad90ef771439cb135b4c82e136_amadey_elex_rhadamanthys_smoke-loader.exe
Resource
win11-20250502-en
General
-
Target
2025-05-14_4d3e29ad90ef771439cb135b4c82e136_amadey_elex_rhadamanthys_smoke-loader.exe
-
Size
3.1MB
-
MD5
4d3e29ad90ef771439cb135b4c82e136
-
SHA1
027ce35ccde61bfc811c101fe922bc5faa1a5939
-
SHA256
4e7da0eb8affca0aaece0dcde6f094856d098e723ffa2adeff70d7cdad6667af
-
SHA512
6dd937d76cde6e0b4e7116e91285d2fc39a779af2a6a0569d7dc0d426ee13432b43e36a73e211b042be102d59230e3ce460bd951d6c67653cf1bae9a5ffcdd4a
-
SSDEEP
98304:/4x8x4EFRDCwuQt4fYj/edNsDn+WyktZtDEv5GbB:6gvFVCwdtiz4+I6G9
Malware Config
Extracted
phorphiex
http://185.156.72.39/
http://45.141.233.6/
TW3wpRJmZgC5WifuY468JBUCF3TEkzBT5H
qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r
rsXCXBf9SagxV8JfC12d8Bybk84oPdMNN9
AULzfBuUAPfCGAXoG5Vq14aP9s6fx3AH4Z
LdgchXq1sKbAaAJ1EXAPSRBzLb8jnTZstT
MF6iVGLmErYP9y4B9SwtzarDoy3ETSzYrh
4AtjkCVKbtEC3UEN77SQHuH9i1XkzNiRi5VCbA2XGsJh46nJSXfGQn4GjLuupCqmC57Lo7LvKmFUyRfhtJSvKvuw3h9ReKK
XryzFMFVpDUvU7famUGf214EXD3xNUSmQf
0x46e5cc402BC848ceC9f4d65c9B48aE7D7A24821B
15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC
1B8FF5WwJXNnjkVzxgPkAznVZ8uKb3Watx
ltc1qyfzdpxky7q2grz4zmqv5x0t0uwfuznl5u43c93
3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc
3GcQJkfHq7NWgBhhNKjz7uSfM6LzADpLvX
CSLKveRL2zqkbV2TqiFVuW6twtpqgFajoUZLAJQTTQk2
DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA
t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh
stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj
bnb1msyt0djx4ecspfxg5en0ye465kg3kmv9utzml2
bc1ppypcmu3684n648gyj62gjp2rw0xy7w3vwfamatlg29ajp4z52desafa0sr
bc1q9tgkga69k094n5v0pn7ewmpp2kn66sh9hu65gq
GBQJMXYXPRIWFMXIFJR35ZB7LRKMB4PHCIUAUFR3TKUL6RDBZVLZEUJ3
bitcoincash:qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r
-
mutex
l9n7b5f2r
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Extracted
phorphiex
http://185.156.72.39
185.156.72.39
Signatures
-
Phorphiex family
-
Phorphiex payload 1 IoCs
resource yara_rule behavioral2/files/0x001900000002b1c8-11.dat family_phorphiex -
Downloads MZ/PE file 2 IoCs
flow pid Process 3 2628 980A.exe 1 1788 2025-05-14_4d3e29ad90ef771439cb135b4c82e136_amadey_elex_rhadamanthys_smoke-loader.exe -
Stops running service(s) 4 TTPs
-
Executes dropped EXE 9 IoCs
pid Process 2628 980A.exe 1536 133227348.exe 4332 syscrondvr.exe 5652 syscrondvr.exe 3648 3278721828.exe 2508 372413144.exe 1200 129504561.exe 4916 67443021.exe 2808 1756321836.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\syscrondvr.exe" 133227348.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\syscrondvr.exe 133227348.exe File opened for modification C:\Windows\syscrondvr.exe 133227348.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 5824 sc.exe 128 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2268 1200 WerFault.exe 96 -
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-05-14_4d3e29ad90ef771439cb135b4c82e136_amadey_elex_rhadamanthys_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 980A.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 133227348.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language syscrondvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 372413144.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 129504561.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67443021.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3648 3278721828.exe 2808 1756321836.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3648 3278721828.exe Token: SeDebugPrivilege 2808 1756321836.exe -
Suspicious use of WriteProcessMemory 37 IoCs
description pid Process procid_target PID 1788 wrote to memory of 2628 1788 2025-05-14_4d3e29ad90ef771439cb135b4c82e136_amadey_elex_rhadamanthys_smoke-loader.exe 82 PID 1788 wrote to memory of 2628 1788 2025-05-14_4d3e29ad90ef771439cb135b4c82e136_amadey_elex_rhadamanthys_smoke-loader.exe 82 PID 1788 wrote to memory of 2628 1788 2025-05-14_4d3e29ad90ef771439cb135b4c82e136_amadey_elex_rhadamanthys_smoke-loader.exe 82 PID 2628 wrote to memory of 1536 2628 980A.exe 85 PID 2628 wrote to memory of 1536 2628 980A.exe 85 PID 2628 wrote to memory of 1536 2628 980A.exe 85 PID 1536 wrote to memory of 4332 1536 133227348.exe 87 PID 1536 wrote to memory of 4332 1536 133227348.exe 87 PID 1536 wrote to memory of 4332 1536 133227348.exe 87 PID 2432 wrote to memory of 5652 2432 cmd.exe 89 PID 2432 wrote to memory of 5652 2432 cmd.exe 89 PID 2432 wrote to memory of 5652 2432 cmd.exe 89 PID 4332 wrote to memory of 3648 4332 syscrondvr.exe 90 PID 4332 wrote to memory of 3648 4332 syscrondvr.exe 90 PID 3648 wrote to memory of 5124 3648 3278721828.exe 91 PID 3648 wrote to memory of 5124 3648 3278721828.exe 91 PID 5124 wrote to memory of 5824 5124 cmd.exe 93 PID 5124 wrote to memory of 5824 5124 cmd.exe 93 PID 5124 wrote to memory of 3784 5124 cmd.exe 94 PID 5124 wrote to memory of 3784 5124 cmd.exe 94 PID 4332 wrote to memory of 2508 4332 syscrondvr.exe 95 PID 4332 wrote to memory of 2508 4332 syscrondvr.exe 95 PID 4332 wrote to memory of 2508 4332 syscrondvr.exe 95 PID 4332 wrote to memory of 1200 4332 syscrondvr.exe 96 PID 4332 wrote to memory of 1200 4332 syscrondvr.exe 96 PID 4332 wrote to memory of 1200 4332 syscrondvr.exe 96 PID 4332 wrote to memory of 4916 4332 syscrondvr.exe 97 PID 4332 wrote to memory of 4916 4332 syscrondvr.exe 97 PID 4332 wrote to memory of 4916 4332 syscrondvr.exe 97 PID 4332 wrote to memory of 2808 4332 syscrondvr.exe 101 PID 4332 wrote to memory of 2808 4332 syscrondvr.exe 101 PID 2808 wrote to memory of 1700 2808 1756321836.exe 102 PID 2808 wrote to memory of 1700 2808 1756321836.exe 102 PID 1700 wrote to memory of 128 1700 cmd.exe 104 PID 1700 wrote to memory of 128 1700 cmd.exe 104 PID 1700 wrote to memory of 3716 1700 cmd.exe 105 PID 1700 wrote to memory of 3716 1700 cmd.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-05-14_4d3e29ad90ef771439cb135b4c82e136_amadey_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2025-05-14_4d3e29ad90ef771439cb135b4c82e136_amadey_elex_rhadamanthys_smoke-loader.exe"1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\980A.exe"C:\Users\Admin\AppData\Local\Temp\980A.exe"2⤵
- Downloads MZ/PE file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\133227348.exeC:\Users\Admin\AppData\Local\Temp\133227348.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Windows\syscrondvr.exeC:\Windows\syscrondvr.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\3278721828.exeC:\Users\Admin\AppData\Local\Temp\3278721828.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc delete "DrvTcfgsvc" & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\DrvTcfgsvc" /f6⤵
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\Windows\system32\sc.exesc delete "DrvTcfgsvc"7⤵
- Launches sc.exe
PID:5824
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\DrvTcfgsvc" /f7⤵PID:3784
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\372413144.exeC:\Users\Admin\AppData\Local\Temp\372413144.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2508
-
-
C:\Users\Admin\AppData\Local\Temp\129504561.exeC:\Users\Admin\AppData\Local\Temp\129504561.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1200 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1200 -s 741166⤵
- Program crash
PID:2268
-
-
-
C:\Users\Admin\AppData\Local\Temp\67443021.exeC:\Users\Admin\AppData\Local\Temp\67443021.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4916
-
-
C:\Users\Admin\AppData\Local\Temp\1756321836.exeC:\Users\Admin\AppData\Local\Temp\1756321836.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc delete "DrvCfgSvcs" & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\DrvCfgSvcs" /f6⤵
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\system32\sc.exesc delete "DrvCfgSvcs"7⤵
- Launches sc.exe
PID:128
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\DrvCfgSvcs" /f7⤵PID:3716
-
-
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\syscrondvr.exe1⤵
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\syscrondvr.exeC:\Windows\syscrondvr.exe2⤵
- Executes dropped EXE
PID:5652
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1200 -ip 12001⤵PID:2360
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
425B
MD5de75c43a265d0848584ae05945570edf
SHA169f95177914f8d8b2f278a91f585a0024b8dffd3
SHA256d9bdf6a2bfdd9b2b5c8593de17ade3d8d317dad331aa6ca0da7483dd06db1140
SHA512365f29c693dd7aa2ade092d765a96f20bf1f7fa93bca7f3b25aeddf5700817b9fd388e8f7d9f1b781c8a876739b06ad16d61e7ed08a1c85ac4be4686a38c63bc
-
Filesize
20KB
MD5680f371f2918acd9c01ebd9b2624e191
SHA12f6d2bc41d8ec3c2cdddeb894f8af082a51acfa9
SHA2565cf738edd0028523f23a77d7dc02087e6f99cf1110f5b51766bf79f00bff6d09
SHA512df251b794acf1ede346f0b01bca3fe576b0d36d127f33e4942e8093625a40d6b74ec26fc51111ebba705a1e9c37d923069de98d2658b416d1f7410846f873e40
-
Filesize
80KB
MD5f30fdbf3448f67cbc3566f31729cb7a6
SHA1fbf005c38f4a1c2e86817a2cb70406fc241f2c90
SHA25681783b558904becc5b86553faba9525070de5f43339766eb1c025bcfbfe1eef8
SHA512b428df2c8f8b4a002c8d7e1bfd9926e5cf95ee998688a2c360b8551e80be5bfbfa17ef210bea35f247da4a5c8a940fb5dba49f4786da9a74e5d001b771c8e9a8
-
Filesize
8KB
MD50cd27d2aa3bc58e4fc3c6639f4797e55
SHA11224947928cbdb0634d3aa7b374825552fe20fde
SHA256559dfe706ff2f2ce820748d25a91173972c89f6bb9510fba52f40815f018621c
SHA5129a595bfaa5ed85d895337a488969d75a00f33a6dd4e8759b95179428ea44922cccbef6189f08579ff806fe030e9833506c0aa8fedd1108622ffed3d0815d7d62
-
Filesize
8KB
MD5c2252ee01d47f885c466fea46d77b337
SHA10e5e5e21dfdd47632831935e98d46fb4c4bf9168
SHA2567563681ee1464143363b1b7b6d59cef4c2a3b9a431c94feae043465cc7d23be0
SHA5128e0fdf90fc8c1c014b6c183dafa58ccf18251a3ea2e279c671a35ff702b60a5be3058c2eceac7a00e4b747796b1e1ed10a64abf95f26bd288980592db4e690d7
-
Filesize
10KB
MD5c08cfa523c9377d3ae24fdb373b3ae13
SHA15289219770ad28b0fa4f0bdd91817f76bd6be222
SHA256326c70a965d4e642275c26cd913e268b1db89edd59b31a86ee600a7a9c664eb0
SHA512c91acd580ac832d5fed363a9a2b98b724a255d82e4fdda6eca62133feb5e60dd79a8caca36597a52bfbfa907a44208c48b15142e2e6020db219d14e970c3f57c
-
Filesize
51KB
MD5588e67994dd9e1084cbe989ee0d7eecd
SHA11a9e7f30d4b14b2054c6947ec7b25024dac5c50e
SHA256d6a96251f4bd75df5e68bbc2ce0cea37e0c5fadf1bace5b035245832930a4d2c
SHA512ad9f235b9c03c391d2cd10f1fc0d07d748b305a254dc310da0ad6e1b27160f65a811a1586a632c4f331c5660a2cb77dec8f06b163c6c226f6a2c39b0d13af25e
-
Filesize
10KB
MD50ec46393976eb51f307cc11d80bae845
SHA169d4cb168f3a1b97c37a0ba1519d0adb1ff7e245
SHA256252171bdaa35d19f872c165e861b03d347a4afb85d7a03d02f8eae09d191038d
SHA512803351760e3c422e4825103235e13085004b3418b483a2c646aafaef62b7212a1ba4ed28469134a236c5b6121e6a748ba958bbae2dbe4afe9f9f45704928d31f
-
C:\Users\Admin\AppData\Local\Temp\dd_2025-05-14_4d3e29ad90ef771439cb135b4c82e136_amadey_elex_rhadamanthys_smoke-loader_decompression_log.txt
Filesize564B
MD53d6af03d044c371a44224a76d75b9d64
SHA103e65465b2267114689c06474c79e39ebe0830d0
SHA256fa7f99559dd53601fc20649cf5da151ecc0dece60c1f4e5df61496976ac8aab9
SHA512a909218ec06372a1affc8b6a5b7032134df353e945dbec89c9c74e8e4877171c23ac7d9453f39b404b5cfc40a2c4926cc676891674092b045bf1e303dde85686