Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250619-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/07/2025, 18:52

General

  • Target

    2025-07-02_d1d467f957fb112f8d7b919f352179a4_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exe

  • Size

    368KB

  • MD5

    d1d467f957fb112f8d7b919f352179a4

  • SHA1

    140920c0c65867d96d462630488601776ae18260

  • SHA256

    66eecf0cc3f1f10afdb8b2aae855a0bfba0f47dfa1c354d61609614677539270

  • SHA512

    f804f23fdb381df9c5ae6dc1f32137f71cdca0bbbb2fc4aec2ce88b933711b738b5612c229af26261abf9b1c2ff93365cf78354aadea1874169655bc702a5df0

  • SSDEEP

    6144:sPxbrqwifQDmSAmTTIJ9YY10Abb/Sr2Txj72zltNla40Oq:sZ3HprNTTA1dbDRXQQ

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • System Binary Proxy Execution: Rundll32 1 TTPs 2 IoCs

    Abuse Rundll32 to proxy execution of malicious code.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks for any installed AV software in registry 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-07-02_d1d467f957fb112f8d7b919f352179a4_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-07-02_d1d467f957fb112f8d7b919f352179a4_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4536
    • C:\Windows\SysWOW64\backgroundTaskHost.exe
      "backgroundTaskHost.exe"
      2⤵
      • Adds Run key to start application
      • Checks for any installed AV software in registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:4904
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\cbkAC2F.tmp.bat" "C:\Users\Admin\AppData\Local\Temp\2025-07-02_d1d467f957fb112f8d7b919f352179a4_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exe""
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1156
      • C:\Windows\SysWOW64\attrib.exe
        attrib -r -s -h "C:\Users\Admin\AppData\Local\Temp\2025-07-02_d1d467f957fb112f8d7b919f352179a4_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stop.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:404
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 1892
      2⤵
      • Program crash
      PID:3604
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 1808
      2⤵
      • Program crash
      PID:4872
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c rundll32.exe shell32.dll, ShellExec_RunDLL C:\PROGRA~3\BB40JF~1.EXE
    1⤵
    • System Binary Proxy Execution: Rundll32
    • Suspicious use of WriteProcessMemory
    PID:3920
    • C:\Windows\system32\rundll32.exe
      rundll32.exe shell32.dll, ShellExec_RunDLL C:\PROGRA~3\BB40JF~1.EXE
      2⤵
      • Checks computer location settings
      • System Binary Proxy Execution: Rundll32
      PID:4100
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4536 -ip 4536
    1⤵
      PID:3500
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4536 -ip 4536
      1⤵
        PID:3624

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\ProgramData\bb40jf006b.exe

              Filesize

              368KB

              MD5

              5b8abe944f40f709073958ec2d27cdbd

              SHA1

              d7541161489736c2226ecf20c913d36cca68a5d2

              SHA256

              2e630fcefe098c4b9a51614d21bdb941fb728cfc93fcab008a46f550849cca6c

              SHA512

              f0a405f45ec4c07fcfffbf5f68444e082ebde62de66ccad9f24e0284add292250e517f0bedbc2411bb2d6f275e91dbf1d0115e7fe40d82b574579c610579a7d5

            • C:\Users\Admin\AppData\Local\Temp\3492473cd35c8bdceed8

              Filesize

              29B

              MD5

              c532d94f86a9943fe0581e6aa06a7b43

              SHA1

              185af6b1eaa5eb1821596ac720f2842dc148162f

              SHA256

              d4082b14b44ff3c73811a3e8577dcd9c5af72cfd1a55b609684253a51cb7b8f4

              SHA512

              e631df6229718c3162afa89aad952bf8a1bac87d913c36eb4b5cf7345c6c934c34b74a86adb95285b933d29ef5e2d7d677f3b78680e8aa985e39bc688591cca2

            • C:\Users\Admin\AppData\Roaming\cbkAC2F.tmp.bat

              Filesize

              59B

              MD5

              4aaadb8274333377662df7a6e844333d

              SHA1

              3f06b501e51b4e0c12947d7d70b5973584e8506d

              SHA256

              f0c092a72d9958b28d646f485c8ce5a138a45748daae1a55fa5a8e041b5aaa7d

              SHA512

              348ad7cb9195e91e443acbbca0eb2715436514950247be4048738c1d0eba05364b7e809ee875da671d423c60ee2a6c3dff751fd8b54934ab2380a6474f2f6d37

            • memory/4536-0-0x0000000000590000-0x0000000000591000-memory.dmp

              Filesize

              4KB

            • memory/4536-1-0x0000000000400000-0x0000000000466000-memory.dmp

              Filesize

              408KB

            • memory/4536-3-0x0000000000590000-0x00000000005A0000-memory.dmp

              Filesize

              64KB

            • memory/4536-433-0x0000000000400000-0x0000000000466000-memory.dmp

              Filesize

              408KB

            • memory/4536-8-0x0000000000400000-0x0000000000466000-memory.dmp

              Filesize

              408KB

            • memory/4904-357-0x0000000001040000-0x00000000010AA000-memory.dmp

              Filesize

              424KB

            • memory/4904-295-0x0000000001100000-0x0000000001200000-memory.dmp

              Filesize

              1024KB

            • memory/4904-300-0x0000000001040000-0x00000000010AA000-memory.dmp

              Filesize

              424KB

            • memory/4904-302-0x0000000001040000-0x00000000010AA000-memory.dmp

              Filesize

              424KB

            • memory/4904-296-0x0000000001040000-0x00000000010AA000-memory.dmp

              Filesize

              424KB

            • memory/4904-291-0x0000000001040000-0x00000000010AA000-memory.dmp

              Filesize

              424KB

            • memory/4904-298-0x0000000001100000-0x0000000001200000-memory.dmp

              Filesize

              1024KB

            • memory/4904-306-0x0000000001040000-0x00000000010AA000-memory.dmp

              Filesize

              424KB

            • memory/4904-9-0x0000000001040000-0x00000000010AA000-memory.dmp

              Filesize

              424KB

            • memory/4904-6-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

              Filesize

              4KB

            • memory/4904-435-0x0000000001040000-0x00000000010AA000-memory.dmp

              Filesize

              424KB

            • memory/4904-450-0x00000000012C0000-0x00000000012C1000-memory.dmp

              Filesize

              4KB

            • memory/4904-464-0x0000000001100000-0x0000000001200000-memory.dmp

              Filesize

              1024KB

            • memory/4904-467-0x0000000001100000-0x0000000001200000-memory.dmp

              Filesize

              1024KB