Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250610-en
  • resource tags

    arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    03/07/2025, 05:54

General

  • Target

    2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe

  • Size

    337KB

  • MD5

    94445727af72681bcea091c4977357d4

  • SHA1

    0e4e49631e495f0cba2e595268d6067c3eb65171

  • SHA256

    1ed9b81662617e8f6dda135faa80468d98a79916d6fc25a3d612a769697016b9

  • SHA512

    dfbdb8cff802dedb7a5b7f4a9b037ea61699cb213d383716a3485aaf7a3d77985538219b4ce34b7e3ec7afa5119dc6be62f37a7f6375bf3694698ef08e459035

  • SSDEEP

    6144:XsLqdufVUNDaWa1SYOW6tah5EuLIxLfhWpIN7:cFUNDaWa1Srjtah5Eu0xFX7

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 8 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 5 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:128
    • \??\c:\users\admin\appdata\local\temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe 
      c:\users\admin\appdata\local\temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe 
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:5188
    • C:\Windows\Resources\Themes\icsys.icn.exe
      C:\Windows\Resources\Themes\icsys.icn.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4420
      • \??\c:\windows\resources\themes\explorer.exe
        c:\windows\resources\themes\explorer.exe
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5244
        • \??\c:\windows\resources\spoolsv.exe
          c:\windows\resources\spoolsv.exe SE
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2384
          • \??\c:\windows\resources\svchost.exe
            c:\windows\resources\svchost.exe
            5⤵
            • Modifies visiblity of hidden/system files in Explorer
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4816
            • \??\c:\windows\resources\spoolsv.exe
              c:\windows\resources\spoolsv.exe PR
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:4196
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\resources\themes\explorer.exe RO
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4548
    • \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe RO
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2292
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\resources\svchost.exe RO
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4180
    • \??\c:\windows\resources\svchost.exe
      c:\windows\resources\svchost.exe RO
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2916

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe 

          Filesize

          202KB

          MD5

          899501650e263fc1aea7e48ebc86a77d

          SHA1

          87c33e64c56732f93e8ba04e7c91dfde4f9d0f37

          SHA256

          85a84db46ff36105fec0bdb925f784919c31e44bb4ea2b3f9a7eb98d232cde81

          SHA512

          efe051b5367c5c2789287cf283f7c2b3d79d9b7f4f028028b66967c4fbb4f82661d00de26ef3f443cdeb2e622cd356ac3490def97519ac6a09bccfbd5d09c32f

        • C:\Windows\Resources\Themes\explorer.exe

          Filesize

          135KB

          MD5

          a807604321f6fba1fb5c67285ac831a5

          SHA1

          d8788513cff6cba17840dff5e0fd56a1ef5400c0

          SHA256

          b9a538e11f665ef044bcc4510305341e3923a12ff1786ad94d0a065c2c145d0e

          SHA512

          661abba32a5db55af6a1db38648971853c5d8674d41fe27ade16f935e1cec74633375520421ba2226a433d9aa1f2948e7caeb9007325cc9820e85bbda8312e97

        • C:\Windows\Resources\Themes\icsys.icn.exe

          Filesize

          135KB

          MD5

          95add61b3b5420300094422cd62fd8b8

          SHA1

          195558e8937be411463b1cfe67b02c5a9c4f82a1

          SHA256

          9a5e8a8629138843d2f1919d155448642b2b55e9d9ab97c9f7b3040349a0ca13

          SHA512

          446570b7e7beb2afa9fe2523c744cb769fed476b4888ce85cb9f6a206c83cd0da6e5009aef16ff44637ee7984ee7f854ad32b09fb05111606f4322c0a6e879e0

        • C:\Windows\Resources\spoolsv.exe

          Filesize

          135KB

          MD5

          b3476c34be1b546634844be18532c6e8

          SHA1

          8a8acaecf362296dfb13d1bd693a30ffaa6b1cd8

          SHA256

          763550179bb1aef157895a4e383cc50ebfc90d8de2d33eb5104b7480fed81d53

          SHA512

          cd4d33e37fbe998ba0313cabdd5b63f7aaf76849d45417069855844a9a00d3d1591028edd22c29f24fa52d2ffe2c6856b80c985dfa79d77bbc284a8f03c99f9f

        • C:\Windows\Resources\svchost.exe

          Filesize

          135KB

          MD5

          aa5e671fde138023d8b4d9ec0bd8daaf

          SHA1

          4bd69d1ad214a6bbcf0a0340842c61802cdf29b0

          SHA256

          87eed29a8ab351f837f46b6eb69d75c24ee3bff5db9cbbc3a9b3411def3bc638

          SHA512

          ba7358802b7cc0ad4799df3ec41a277f81bc3035f6e6888676868d94dbb7340d8061fdc12b349a1dd079d2ca7d38d5428cce473f618dde8a116ceda472e6ff8c

        • memory/128-47-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB

        • memory/128-0-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB

        • memory/2292-57-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB

        • memory/2384-45-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB

        • memory/2916-53-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB

        • memory/4196-44-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB

        • memory/4420-12-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB

        • memory/4420-46-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB

        • memory/4816-59-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB

        • memory/5244-58-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB