Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows11-21h2_x64 -
resource
win11-20250502-en -
resource tags
arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system -
submitted
15/05/2025, 17:34
Static task
static1
Behavioral task
behavioral1
Sample
2025-05-15_8470ac8248543d5ba122832551b6303c_amadey_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20250502-en
General
-
Target
2025-05-15_8470ac8248543d5ba122832551b6303c_amadey_elex_rhadamanthys_smoke-loader.exe
-
Size
4.0MB
-
MD5
8470ac8248543d5ba122832551b6303c
-
SHA1
cae8fda6ca20aa97bcc08716474f09a5fadec4db
-
SHA256
6498fed2649dc8edc48aa61d8bfdc72c0027fe7376a4e48aad6de327f4ba4483
-
SHA512
80183e9da3606e1b5ad3abba6efc35a5439462e7768454562a1a0dbe75eee9d4a5e0ca90550646e2b5ddfa629445470e36c71a4cc94f7c2fda566e4cb0a708cd
-
SSDEEP
98304:V4x8xcgVfPruHHuW8eRLAlRUdscUNlT6CuKgh3yhtDe2tMb54Ly8UmK37dF7GN26:ggNVfUHu1eR0ll9Nd69Ka3UD3Ly8HK3g
Malware Config
Extracted
phorphiex
http://185.156.72.39
Extracted
phorphiex
http://185.156.72.39/
http://45.141.233.6/
TW3wpRJmZgC5WifuY468JBUCF3TEkzBT5H
qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r
rsXCXBf9SagxV8JfC12d8Bybk84oPdMNN9
AULzfBuUAPfCGAXoG5Vq14aP9s6fx3AH4Z
LdgchXq1sKbAaAJ1EXAPSRBzLb8jnTZstT
MF6iVGLmErYP9y4B9SwtzarDoy3ETSzYrh
4AtjkCVKbtEC3UEN77SQHuH9i1XkzNiRi5VCbA2XGsJh46nJSXfGQn4GjLuupCqmC57Lo7LvKmFUyRfhtJSvKvuw3h9ReKK
XryzFMFVpDUvU7famUGf214EXD3xNUSmQf
0x46e5cc402BC848ceC9f4d65c9B48aE7D7A24821B
15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC
1B8FF5WwJXNnjkVzxgPkAznVZ8uKb3Watx
ltc1qyfzdpxky7q2grz4zmqv5x0t0uwfuznl5u43c93
3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc
3GcQJkfHq7NWgBhhNKjz7uSfM6LzADpLvX
CSLKveRL2zqkbV2TqiFVuW6twtpqgFajoUZLAJQTTQk2
DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA
t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh
stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj
bnb1msyt0djx4ecspfxg5en0ye465kg3kmv9utzml2
bc1ppypcmu3684n648gyj62gjp2rw0xy7w3vwfamatlg29ajp4z52desafa0sr
bc1q9tgkga69k094n5v0pn7ewmpp2kn66sh9hu65gq
GBQJMXYXPRIWFMXIFJR35ZB7LRKMB4PHCIUAUFR3TKUL6RDBZVLZEUJ3
bitcoincash:qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r
-
mutex
l9n7b5f2r
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Signatures
-
Phorphiex family
-
Phorphiex payload 1 IoCs
resource yara_rule behavioral2/files/0x001900000002b1be-11.dat family_phorphiex -
Xmrig family
-
XMRig Miner payload 9 IoCs
resource yara_rule behavioral2/memory/4788-78-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral2/memory/4788-79-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral2/memory/4788-84-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral2/memory/4788-85-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral2/memory/4788-83-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral2/memory/4788-82-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral2/memory/4788-81-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral2/memory/4788-89-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral2/memory/4788-90-0x0000000140000000-0x0000000140835000-memory.dmp xmrig -
Creates new service(s) 2 TTPs
-
Downloads MZ/PE file 3 IoCs
flow pid Process 18 2432 2214718867.exe 3 1648 7407.exe 1 2192 2025-05-15_8470ac8248543d5ba122832551b6303c_amadey_elex_rhadamanthys_smoke-loader.exe -
Stops running service(s) 4 TTPs
-
Executes dropped EXE 11 IoCs
pid Process 1648 7407.exe 3220 1579829756.exe 3484 syscrondvr.exe 2480 syscrondvr.exe 5076 79832029.exe 4716 178546684.exe 5756 syscrondvr.exe 4868 syscrondvr.exe 2432 2214718867.exe 1204 106395928.exe 2452 sysmtdrav.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\syscrondvr.exe" 1579829756.exe Set value (str) \REGISTRY\USER\S-1-5-21-330179853-1108322181-418488014-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Users\\Admin\\syscrondvr.exe" 178546684.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2452 set thread context of 5368 2452 sysmtdrav.exe 101 PID 2452 set thread context of 4788 2452 sysmtdrav.exe 102 -
resource yara_rule behavioral2/memory/4788-75-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/4788-74-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/4788-73-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/4788-76-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/4788-78-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/4788-77-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/4788-79-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/4788-84-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/4788-85-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/4788-83-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/4788-82-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/4788-81-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/4788-89-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/4788-90-0x0000000140000000-0x0000000140835000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\syscrondvr.exe 1579829756.exe File opened for modification C:\Windows\syscrondvr.exe 1579829756.exe File created C:\Windows\syscrondvr.exe 178546684.exe -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2788 sc.exe 2656 sc.exe 3144 sc.exe 3128 sc.exe -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-05-15_8470ac8248543d5ba122832551b6303c_amadey_elex_rhadamanthys_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7407.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1579829756.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79832029.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2214718867.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language syscrondvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 178546684.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language syscrondvr.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1204 106395928.exe 1204 106395928.exe 1204 106395928.exe 1204 106395928.exe 2452 sysmtdrav.exe 2452 sysmtdrav.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeLockMemoryPrivilege 4788 dwm.exe -
Suspicious use of WriteProcessMemory 43 IoCs
description pid Process procid_target PID 2192 wrote to memory of 1648 2192 2025-05-15_8470ac8248543d5ba122832551b6303c_amadey_elex_rhadamanthys_smoke-loader.exe 78 PID 2192 wrote to memory of 1648 2192 2025-05-15_8470ac8248543d5ba122832551b6303c_amadey_elex_rhadamanthys_smoke-loader.exe 78 PID 2192 wrote to memory of 1648 2192 2025-05-15_8470ac8248543d5ba122832551b6303c_amadey_elex_rhadamanthys_smoke-loader.exe 78 PID 1648 wrote to memory of 3220 1648 7407.exe 79 PID 1648 wrote to memory of 3220 1648 7407.exe 79 PID 1648 wrote to memory of 3220 1648 7407.exe 79 PID 3220 wrote to memory of 3484 3220 1579829756.exe 81 PID 3220 wrote to memory of 3484 3220 1579829756.exe 81 PID 3220 wrote to memory of 3484 3220 1579829756.exe 81 PID 4212 wrote to memory of 2480 4212 cmd.exe 83 PID 4212 wrote to memory of 2480 4212 cmd.exe 83 PID 4212 wrote to memory of 2480 4212 cmd.exe 83 PID 3484 wrote to memory of 5076 3484 syscrondvr.exe 84 PID 3484 wrote to memory of 5076 3484 syscrondvr.exe 84 PID 3484 wrote to memory of 5076 3484 syscrondvr.exe 84 PID 3484 wrote to memory of 4716 3484 syscrondvr.exe 85 PID 3484 wrote to memory of 4716 3484 syscrondvr.exe 85 PID 3484 wrote to memory of 4716 3484 syscrondvr.exe 85 PID 4716 wrote to memory of 5756 4716 178546684.exe 87 PID 4716 wrote to memory of 5756 4716 178546684.exe 87 PID 4716 wrote to memory of 5756 4716 178546684.exe 87 PID 2500 wrote to memory of 4868 2500 cmd.exe 89 PID 2500 wrote to memory of 4868 2500 cmd.exe 89 PID 2500 wrote to memory of 4868 2500 cmd.exe 89 PID 5756 wrote to memory of 2432 5756 syscrondvr.exe 90 PID 5756 wrote to memory of 2432 5756 syscrondvr.exe 90 PID 5756 wrote to memory of 2432 5756 syscrondvr.exe 90 PID 2432 wrote to memory of 1204 2432 2214718867.exe 91 PID 2432 wrote to memory of 1204 2432 2214718867.exe 91 PID 2452 wrote to memory of 5368 2452 sysmtdrav.exe 101 PID 2452 wrote to memory of 5368 2452 sysmtdrav.exe 101 PID 2452 wrote to memory of 5368 2452 sysmtdrav.exe 101 PID 2452 wrote to memory of 5368 2452 sysmtdrav.exe 101 PID 2452 wrote to memory of 5368 2452 sysmtdrav.exe 101 PID 2452 wrote to memory of 5368 2452 sysmtdrav.exe 101 PID 2452 wrote to memory of 5368 2452 sysmtdrav.exe 101 PID 2452 wrote to memory of 5368 2452 sysmtdrav.exe 101 PID 2452 wrote to memory of 5368 2452 sysmtdrav.exe 101 PID 2452 wrote to memory of 4788 2452 sysmtdrav.exe 102 PID 2452 wrote to memory of 4788 2452 sysmtdrav.exe 102 PID 2452 wrote to memory of 4788 2452 sysmtdrav.exe 102 PID 2452 wrote to memory of 4788 2452 sysmtdrav.exe 102 PID 2452 wrote to memory of 4788 2452 sysmtdrav.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-05-15_8470ac8248543d5ba122832551b6303c_amadey_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2025-05-15_8470ac8248543d5ba122832551b6303c_amadey_elex_rhadamanthys_smoke-loader.exe"1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\7407.exe"C:\Users\Admin\AppData\Local\Temp\7407.exe"2⤵
- Downloads MZ/PE file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\1579829756.exeC:\Users\Admin\AppData\Local\Temp\1579829756.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Windows\syscrondvr.exeC:\Windows\syscrondvr.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\79832029.exeC:\Users\Admin\AppData\Local\Temp\79832029.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5076
-
-
C:\Users\Admin\AppData\Local\Temp\178546684.exeC:\Users\Admin\AppData\Local\Temp\178546684.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\syscrondvr.exeC:\Users\Admin\syscrondvr.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\Users\Admin\AppData\Local\Temp\2214718867.exeC:\Users\Admin\AppData\Local\Temp\2214718867.exe7⤵
- Downloads MZ/PE file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\106395928.exeC:\Users\Admin\AppData\Local\Temp\106395928.exe8⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1204 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "MgrSrvdrvcs"9⤵
- Launches sc.exe
PID:2788
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "MgrSrvdrvcs" binpath= "C:\ProgramData\MgrSrvdrvcs\sysmtdrav.exe" start= "auto"9⤵
- Launches sc.exe
PID:2656
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog9⤵
- Launches sc.exe
PID:3144
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "MgrSrvdrvcs"9⤵
- Launches sc.exe
PID:3128
-
-
-
-
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\syscrondvr.exe1⤵
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Windows\syscrondvr.exeC:\Windows\syscrondvr.exe2⤵
- Executes dropped EXE
PID:2480
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\syscrondvr.exe1⤵
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\syscrondvr.exeC:\Users\Admin\syscrondvr.exe2⤵
- Executes dropped EXE
PID:4868
-
-
C:\ProgramData\MgrSrvdrvcs\sysmtdrav.exeC:\ProgramData\MgrSrvdrvcs\sysmtdrav.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:5368
-
-
C:\Windows\system32\dwm.exedwm.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4788
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD50000638ebbfe0d620abe6ca32abb1b58
SHA1ae908681544765eb238e92b4ff7df26884692aa0
SHA256267ec6176c1111d9ffcf32fcfa6aa65917e64d1556dcbbd8989ee6bbebc2e72f
SHA5121522ed6c96d0a6699aaf5c1e6e3956742f26e8b46f2c795c0b6cfd3c02421aa6101134ded49c6b97e4085a789056cfb2d0fa09630c1c8796c7fc8d49aef66212
-
Filesize
80KB
MD5f30fdbf3448f67cbc3566f31729cb7a6
SHA1fbf005c38f4a1c2e86817a2cb70406fc241f2c90
SHA25681783b558904becc5b86553faba9525070de5f43339766eb1c025bcfbfe1eef8
SHA512b428df2c8f8b4a002c8d7e1bfd9926e5cf95ee998688a2c360b8551e80be5bfbfa17ef210bea35f247da4a5c8a940fb5dba49f4786da9a74e5d001b771c8e9a8
-
Filesize
10KB
MD523576c32ea5c1925c8a6bfecbe3d6f0a
SHA11ca83777a5a782134a516dbb4c1c9ab6f156b4ef
SHA2568a191f6fe99beb784be59410d10d13d13bc1930fb9959b03ff0a7d0539d007bc
SHA512b3f414d4c92a564367eef2d83d0f7646cd627fc3b20415ed9b0abadfdd613aff07735cd215e8b5816dcc8c49812c391180e7edf7a991c90d43724fa6c8040159
-
Filesize
10KB
MD50ec46393976eb51f307cc11d80bae845
SHA169d4cb168f3a1b97c37a0ba1519d0adb1ff7e245
SHA256252171bdaa35d19f872c165e861b03d347a4afb85d7a03d02f8eae09d191038d
SHA512803351760e3c422e4825103235e13085004b3418b483a2c646aafaef62b7212a1ba4ed28469134a236c5b6121e6a748ba958bbae2dbe4afe9f9f45704928d31f
-
Filesize
10KB
MD5c08cfa523c9377d3ae24fdb373b3ae13
SHA15289219770ad28b0fa4f0bdd91817f76bd6be222
SHA256326c70a965d4e642275c26cd913e268b1db89edd59b31a86ee600a7a9c664eb0
SHA512c91acd580ac832d5fed363a9a2b98b724a255d82e4fdda6eca62133feb5e60dd79a8caca36597a52bfbfa907a44208c48b15142e2e6020db219d14e970c3f57c
-
Filesize
285B
MD5a690bb166290b53e7cc3c5cfd6aa9bc2
SHA1c5f05ee9e303ab56638a890e7da812df3d9d2d68
SHA256076c85721cf22b0bbe1697387f2e021a4b2921adaf514fd8abf167559c7e7ef2
SHA5122b7034eec20cd657356fa40c9b2290e33a5b7e39f11cef9ef75f91e047e9960873493a6c033c0de9d0e5e6d303c17f780252bee5d9ca03ec26cbd54a39ba388b
-
Filesize
4KB
MD5abb43dc04be5ea92e1ded493f64c7c4f
SHA19d818db35b90141dd464a6b238bc826c08f99622
SHA25684278bfa09b648e6b20954d8d17fbc00366876dff6bdd4e7acede923cbd1b0d7
SHA512392d41234b7a2bd9edd737e8829253543be8e93c43270acc7a5c866a170764898cc7741f2f09c84ab787323bbaba791f59276b4a789dbb5f3d770e0d3a9f192b