Malware Analysis Report

2025-08-10 19:52

Sample ID 250703-glx9tavm18
Target 2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee
SHA256 1ed9b81662617e8f6dda135faa80468d98a79916d6fc25a3d612a769697016b9
Tags
defense_evasion discovery persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V16

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1ed9b81662617e8f6dda135faa80468d98a79916d6fc25a3d612a769697016b9

Threat Level: Known bad

The file 2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee was found to be: Known bad.

Malicious Activity Summary

defense_evasion discovery persistence

Modifies visiblity of hidden/system files in Explorer

Executes dropped EXE

Adds Run key to start application

Drops file in System32 directory

Drops file in Windows directory

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-07-03 05:54

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2025-07-03 05:54

Reported

2025-07-03 05:56

Platform

win11-20250610-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe"

Signatures

Modifies visiblity of hidden/system files in Explorer

defense_evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\resources\svchost.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" \??\c:\windows\resources\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" \??\c:\windows\resources\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" \??\c:\windows\resources\themes\explorer.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\explorer.exe \??\c:\windows\resources\themes\explorer.exe N/A
File opened for modification C:\Windows\SysWOW64\explorer.exe \??\c:\windows\resources\svchost.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Resources\Themes\icsys.icn.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
File opened for modification \??\c:\windows\resources\themes\explorer.exe C:\Windows\Resources\Themes\icsys.icn.exe N/A
File opened for modification \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\themes\explorer.exe N/A
File opened for modification \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe N/A
File opened for modification C:\Windows\Resources\tjud.exe \??\c:\windows\resources\themes\explorer.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\users\admin\appdata\local\temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe  N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Resources\Themes\icsys.icn.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\resources\themes\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\resources\spoolsv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\resources\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\resources\spoolsv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\resources\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\resources\themes\explorer.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 128 wrote to memory of 5188 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe \??\c:\users\admin\appdata\local\temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe 
PID 128 wrote to memory of 5188 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe \??\c:\users\admin\appdata\local\temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe 
PID 128 wrote to memory of 5188 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe \??\c:\users\admin\appdata\local\temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe 
PID 128 wrote to memory of 4420 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe C:\Windows\Resources\Themes\icsys.icn.exe
PID 128 wrote to memory of 4420 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe C:\Windows\Resources\Themes\icsys.icn.exe
PID 128 wrote to memory of 4420 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe C:\Windows\Resources\Themes\icsys.icn.exe
PID 4420 wrote to memory of 5244 N/A C:\Windows\Resources\Themes\icsys.icn.exe \??\c:\windows\resources\themes\explorer.exe
PID 4420 wrote to memory of 5244 N/A C:\Windows\Resources\Themes\icsys.icn.exe \??\c:\windows\resources\themes\explorer.exe
PID 4420 wrote to memory of 5244 N/A C:\Windows\Resources\Themes\icsys.icn.exe \??\c:\windows\resources\themes\explorer.exe
PID 5244 wrote to memory of 2384 N/A \??\c:\windows\resources\themes\explorer.exe \??\c:\windows\resources\spoolsv.exe
PID 5244 wrote to memory of 2384 N/A \??\c:\windows\resources\themes\explorer.exe \??\c:\windows\resources\spoolsv.exe
PID 5244 wrote to memory of 2384 N/A \??\c:\windows\resources\themes\explorer.exe \??\c:\windows\resources\spoolsv.exe
PID 2384 wrote to memory of 4816 N/A \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\svchost.exe
PID 2384 wrote to memory of 4816 N/A \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\svchost.exe
PID 2384 wrote to memory of 4816 N/A \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\svchost.exe
PID 4816 wrote to memory of 4196 N/A \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe
PID 4816 wrote to memory of 4196 N/A \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe
PID 4816 wrote to memory of 4196 N/A \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe
PID 4180 wrote to memory of 2916 N/A C:\Windows\system32\cmd.exe \??\c:\windows\resources\svchost.exe
PID 4180 wrote to memory of 2916 N/A C:\Windows\system32\cmd.exe \??\c:\windows\resources\svchost.exe
PID 4180 wrote to memory of 2916 N/A C:\Windows\system32\cmd.exe \??\c:\windows\resources\svchost.exe
PID 4548 wrote to memory of 2292 N/A C:\Windows\system32\cmd.exe \??\c:\windows\resources\themes\explorer.exe
PID 4548 wrote to memory of 2292 N/A C:\Windows\system32\cmd.exe \??\c:\windows\resources\themes\explorer.exe
PID 4548 wrote to memory of 2292 N/A C:\Windows\system32\cmd.exe \??\c:\windows\resources\themes\explorer.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe

"C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe"

\??\c:\users\admin\appdata\local\temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe 

c:\users\admin\appdata\local\temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe 

C:\Windows\Resources\Themes\icsys.icn.exe

C:\Windows\Resources\Themes\icsys.icn.exe

\??\c:\windows\resources\themes\explorer.exe

c:\windows\resources\themes\explorer.exe

\??\c:\windows\resources\spoolsv.exe

c:\windows\resources\spoolsv.exe SE

\??\c:\windows\resources\svchost.exe

c:\windows\resources\svchost.exe

\??\c:\windows\resources\spoolsv.exe

c:\windows\resources\spoolsv.exe PR

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c c:\windows\resources\themes\explorer.exe RO

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c c:\windows\resources\svchost.exe RO

\??\c:\windows\resources\svchost.exe

c:\windows\resources\svchost.exe RO

\??\c:\windows\resources\themes\explorer.exe

c:\windows\resources\themes\explorer.exe RO

Network

Files

memory/128-0-0x0000000000400000-0x000000000041F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe 

MD5 899501650e263fc1aea7e48ebc86a77d
SHA1 87c33e64c56732f93e8ba04e7c91dfde4f9d0f37
SHA256 85a84db46ff36105fec0bdb925f784919c31e44bb4ea2b3f9a7eb98d232cde81
SHA512 efe051b5367c5c2789287cf283f7c2b3d79d9b7f4f028028b66967c4fbb4f82661d00de26ef3f443cdeb2e622cd356ac3490def97519ac6a09bccfbd5d09c32f

C:\Windows\Resources\Themes\icsys.icn.exe

MD5 95add61b3b5420300094422cd62fd8b8
SHA1 195558e8937be411463b1cfe67b02c5a9c4f82a1
SHA256 9a5e8a8629138843d2f1919d155448642b2b55e9d9ab97c9f7b3040349a0ca13
SHA512 446570b7e7beb2afa9fe2523c744cb769fed476b4888ce85cb9f6a206c83cd0da6e5009aef16ff44637ee7984ee7f854ad32b09fb05111606f4322c0a6e879e0

memory/4420-12-0x0000000000400000-0x000000000041F000-memory.dmp

C:\Windows\Resources\Themes\explorer.exe

MD5 a807604321f6fba1fb5c67285ac831a5
SHA1 d8788513cff6cba17840dff5e0fd56a1ef5400c0
SHA256 b9a538e11f665ef044bcc4510305341e3923a12ff1786ad94d0a065c2c145d0e
SHA512 661abba32a5db55af6a1db38648971853c5d8674d41fe27ade16f935e1cec74633375520421ba2226a433d9aa1f2948e7caeb9007325cc9820e85bbda8312e97

C:\Windows\Resources\spoolsv.exe

MD5 b3476c34be1b546634844be18532c6e8
SHA1 8a8acaecf362296dfb13d1bd693a30ffaa6b1cd8
SHA256 763550179bb1aef157895a4e383cc50ebfc90d8de2d33eb5104b7480fed81d53
SHA512 cd4d33e37fbe998ba0313cabdd5b63f7aaf76849d45417069855844a9a00d3d1591028edd22c29f24fa52d2ffe2c6856b80c985dfa79d77bbc284a8f03c99f9f

C:\Windows\Resources\svchost.exe

MD5 aa5e671fde138023d8b4d9ec0bd8daaf
SHA1 4bd69d1ad214a6bbcf0a0340842c61802cdf29b0
SHA256 87eed29a8ab351f837f46b6eb69d75c24ee3bff5db9cbbc3a9b3411def3bc638
SHA512 ba7358802b7cc0ad4799df3ec41a277f81bc3035f6e6888676868d94dbb7340d8061fdc12b349a1dd079d2ca7d38d5428cce473f618dde8a116ceda472e6ff8c

memory/4196-44-0x0000000000400000-0x000000000041F000-memory.dmp

memory/2384-45-0x0000000000400000-0x000000000041F000-memory.dmp

memory/128-47-0x0000000000400000-0x000000000041F000-memory.dmp

memory/4420-46-0x0000000000400000-0x000000000041F000-memory.dmp

memory/2916-53-0x0000000000400000-0x000000000041F000-memory.dmp

memory/2292-57-0x0000000000400000-0x000000000041F000-memory.dmp

memory/5244-58-0x0000000000400000-0x000000000041F000-memory.dmp

memory/4816-59-0x0000000000400000-0x000000000041F000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2025-07-03 05:54

Reported

2025-07-03 05:56

Platform

win10v2004-20250610-en

Max time kernel

150s

Max time network

138s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe"

Signatures

Modifies visiblity of hidden/system files in Explorer

defense_evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-155457276-1657131288-1088518942-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-155457276-1657131288-1088518942-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\resources\svchost.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" \??\c:\windows\resources\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" \??\c:\windows\resources\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" \??\c:\windows\resources\themes\explorer.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\explorer.exe \??\c:\windows\resources\svchost.exe N/A
File opened for modification C:\Windows\SysWOW64\explorer.exe \??\c:\windows\resources\themes\explorer.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\windows\resources\themes\explorer.exe C:\Windows\Resources\Themes\icsys.icn.exe N/A
File opened for modification \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\themes\explorer.exe N/A
File opened for modification \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe N/A
File opened for modification C:\Windows\Resources\tjud.exe \??\c:\windows\resources\themes\explorer.exe N/A
File opened for modification C:\Windows\Resources\Themes\icsys.icn.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Resources\Themes\icsys.icn.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\resources\themes\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\resources\spoolsv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\resources\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\resources\spoolsv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\resources\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\resources\themes\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\users\admin\appdata\local\temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe  N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3456 wrote to memory of 4040 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe \??\c:\users\admin\appdata\local\temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe 
PID 3456 wrote to memory of 4040 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe \??\c:\users\admin\appdata\local\temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe 
PID 3456 wrote to memory of 4040 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe \??\c:\users\admin\appdata\local\temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe 
PID 3456 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe C:\Windows\Resources\Themes\icsys.icn.exe
PID 3456 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe C:\Windows\Resources\Themes\icsys.icn.exe
PID 3456 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe C:\Windows\Resources\Themes\icsys.icn.exe
PID 912 wrote to memory of 1600 N/A C:\Windows\Resources\Themes\icsys.icn.exe \??\c:\windows\resources\themes\explorer.exe
PID 912 wrote to memory of 1600 N/A C:\Windows\Resources\Themes\icsys.icn.exe \??\c:\windows\resources\themes\explorer.exe
PID 912 wrote to memory of 1600 N/A C:\Windows\Resources\Themes\icsys.icn.exe \??\c:\windows\resources\themes\explorer.exe
PID 1600 wrote to memory of 1668 N/A \??\c:\windows\resources\themes\explorer.exe \??\c:\windows\resources\spoolsv.exe
PID 1600 wrote to memory of 1668 N/A \??\c:\windows\resources\themes\explorer.exe \??\c:\windows\resources\spoolsv.exe
PID 1600 wrote to memory of 1668 N/A \??\c:\windows\resources\themes\explorer.exe \??\c:\windows\resources\spoolsv.exe
PID 1668 wrote to memory of 5972 N/A \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\svchost.exe
PID 1668 wrote to memory of 5972 N/A \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\svchost.exe
PID 1668 wrote to memory of 5972 N/A \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\svchost.exe
PID 5972 wrote to memory of 4240 N/A \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe
PID 5972 wrote to memory of 4240 N/A \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe
PID 5972 wrote to memory of 4240 N/A \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe
PID 4068 wrote to memory of 4744 N/A C:\Windows\system32\cmd.exe \??\c:\windows\resources\themes\explorer.exe
PID 4068 wrote to memory of 4744 N/A C:\Windows\system32\cmd.exe \??\c:\windows\resources\themes\explorer.exe
PID 4068 wrote to memory of 4744 N/A C:\Windows\system32\cmd.exe \??\c:\windows\resources\themes\explorer.exe
PID 5680 wrote to memory of 4512 N/A C:\Windows\system32\cmd.exe \??\c:\windows\resources\svchost.exe
PID 5680 wrote to memory of 4512 N/A C:\Windows\system32\cmd.exe \??\c:\windows\resources\svchost.exe
PID 5680 wrote to memory of 4512 N/A C:\Windows\system32\cmd.exe \??\c:\windows\resources\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe

"C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe"

\??\c:\users\admin\appdata\local\temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe 

c:\users\admin\appdata\local\temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe 

C:\Windows\Resources\Themes\icsys.icn.exe

C:\Windows\Resources\Themes\icsys.icn.exe

\??\c:\windows\resources\themes\explorer.exe

c:\windows\resources\themes\explorer.exe

\??\c:\windows\resources\spoolsv.exe

c:\windows\resources\spoolsv.exe SE

\??\c:\windows\resources\svchost.exe

c:\windows\resources\svchost.exe

\??\c:\windows\resources\spoolsv.exe

c:\windows\resources\spoolsv.exe PR

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c c:\windows\resources\themes\explorer.exe RO

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c c:\windows\resources\svchost.exe RO

\??\c:\windows\resources\themes\explorer.exe

c:\windows\resources\themes\explorer.exe RO

\??\c:\windows\resources\svchost.exe

c:\windows\resources\svchost.exe RO

Network

Country Destination Domain Proto
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.179.227:80 c.pki.goog tcp

Files

memory/3456-0-0x0000000000400000-0x000000000041F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\2025-07-03_94445727af72681bcea091c4977357d4_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_swisyn_tofsee.exe 

MD5 899501650e263fc1aea7e48ebc86a77d
SHA1 87c33e64c56732f93e8ba04e7c91dfde4f9d0f37
SHA256 85a84db46ff36105fec0bdb925f784919c31e44bb4ea2b3f9a7eb98d232cde81
SHA512 efe051b5367c5c2789287cf283f7c2b3d79d9b7f4f028028b66967c4fbb4f82661d00de26ef3f443cdeb2e622cd356ac3490def97519ac6a09bccfbd5d09c32f

C:\Windows\Resources\Themes\icsys.icn.exe

MD5 95add61b3b5420300094422cd62fd8b8
SHA1 195558e8937be411463b1cfe67b02c5a9c4f82a1
SHA256 9a5e8a8629138843d2f1919d155448642b2b55e9d9ab97c9f7b3040349a0ca13
SHA512 446570b7e7beb2afa9fe2523c744cb769fed476b4888ce85cb9f6a206c83cd0da6e5009aef16ff44637ee7984ee7f854ad32b09fb05111606f4322c0a6e879e0

C:\Windows\Resources\Themes\explorer.exe

MD5 41fb5d0cad982b4c7a7f2a1229f6bed0
SHA1 46888043cbc7f58d85557e42b7f4f975b32164b2
SHA256 a4265af4fc191aa0970725ac4ec67b7922b85076758446a6e67e8fcc25297b5c
SHA512 7c4c8c53988a67f549caa2cee78663f5ebaaf1494940563635c58df324459145ab2fa3b556cb293f927bd3183f3b9571482858a070f3bce26a6045cba9a323f7

C:\Windows\Resources\spoolsv.exe

MD5 0ce5f32d5145bb4f2732ecbc267225f4
SHA1 f170dff03890ca259dc1f9ee0904b5a051d90d3e
SHA256 2a34a3cfa3dc16423bd217f631a1238932ebefbb1f50b3319365ace5e8d2d4f0
SHA512 17459d7a044f199bd5c994c8490c3a51752384f2e42cc54226fbf0b960f6c1e893a1813fa51cf21931275e1f5441a2e452c41b0fb45f39d08039fd2c4cb9b471

C:\Windows\Resources\svchost.exe

MD5 055db2890649a3b3f44358c5372756cd
SHA1 c30a742acc75b0b6d61a9267dda20a7712365057
SHA256 60e7c21dd35089303fb938f610372e663f310916194bb44b321db752b5eafaf8
SHA512 ab1113825381eade49ddff8d0c0b3f8c9bc5d854885e4de98943a978e0ea2176715c2663902612c93aaf5e5517a44188d53dbca823cdd7cff6cfb3601024cdcb

memory/4240-43-0x0000000000400000-0x000000000041F000-memory.dmp

memory/1668-44-0x0000000000400000-0x000000000041F000-memory.dmp

memory/3456-46-0x0000000000400000-0x000000000041F000-memory.dmp

memory/912-45-0x0000000000400000-0x000000000041F000-memory.dmp

memory/4744-55-0x0000000000400000-0x000000000041F000-memory.dmp

memory/4512-56-0x0000000000400000-0x000000000041F000-memory.dmp

memory/1600-57-0x0000000000400000-0x000000000041F000-memory.dmp

memory/5972-58-0x0000000000400000-0x000000000041F000-memory.dmp