Analysis
- max time kernel
149s - max time network
135s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
15/04/2026, 04:25
General
- Target 2026-04-15_9a7a0241fb1791f7dba42727ce07fa3e_amadey_elex_rhadamanthys_smoke-loader_stop.exe
- Size 368KB
- Sample260415-e15akahz51
- SHA256 925a6c3239c010d7338b28cee224b3321a78687d4eec7570c91f4f555d1c009e
Malware Config
Signatures
- Detects executables packed with aPLib. 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks for any installed AV software in registry 1 TTPs 4 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_9a7a0241fb1791f7dba42727ce07fa3e_amadey_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_9a7a0241fb1791f7dba42727ce07fa3e_amadey_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"backgroundTaskHost.exe"2⤵
- Adds Run key to start application
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\ProgramData\xtyBBD9.tmp.bat" "C:\Users\Admin\AppData\Local\Temp\2026-04-15_9a7a0241fb1791f7dba42727ce07fa3e_amadey_elex_rhadamanthys_smoke-loader_stop.exe""2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib -r -s -h "C:\Users\Admin\AppData\Local\Temp\2026-04-15_9a7a0241fb1791f7dba42727ce07fa3e_amadey_elex_rhadamanthys_smoke-loader_stop.exe"3⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 19522⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 17522⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1408 -ip 14081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1408 -ip 14081⤵
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
d008jd8bb6.exe
xtyBBD9.tmp.bat
3492473cd35c8bdceed8
memory/1408-3-0x00000000005A0000-0x00000000005B0000-memory.dmp
memory/1408-9-0x0000000000B00000-0x0000000000B01000-memory.dmp
memory/1408-10-0x0000000000400000-0x0000000000466000-memory.dmp
memory/1408-11-0x00000000022B0000-0x00000000022FA000-memory.dmp
memory/1408-412-0x00000000022B0000-0x00000000022FA000-memory.dmp
memory/1408-0-0x00000000005A0000-0x00000000005A1000-memory.dmp
memory/1408-411-0x0000000000400000-0x0000000000466000-memory.dmp
memory/1408-1-0x0000000000400000-0x0000000000466000-memory.dmp
memory/4152-44-0x0000000000EA0000-0x0000000000F0A000-memory.dmp
memory/4152-8-0x0000000000AE0000-0x0000000000AE1000-memory.dmp
memory/4152-306-0x0000000000EA0000-0x0000000000F0A000-memory.dmp
memory/4152-300-0x0000000000EA0000-0x0000000000F0A000-memory.dmp
memory/4152-303-0x0000000000EA0000-0x0000000000F0A000-memory.dmp
memory/4152-309-0x0000000000EA0000-0x0000000000F0A000-memory.dmp
memory/4152-362-0x0000000000EA0000-0x0000000000F0A000-memory.dmp
memory/4152-295-0x0000000000EA0000-0x0000000000F0A000-memory.dmp
memory/4152-297-0x0000000000C50000-0x0000000000D50000-memory.dmp
memory/4152-12-0x0000000000EA0000-0x0000000000F0A000-memory.dmp
memory/4152-413-0x0000000000EA0000-0x0000000000F0A000-memory.dmp
memory/4152-425-0x0000000002760000-0x00000000027AA000-memory.dmp
memory/4152-426-0x0000000000C50000-0x0000000000D50000-memory.dmp