c38e951c44abf7b02454f7211b67daf50f22dc2b2a0739f2ad5b4fc728625dab

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/04/2026, 14:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-16_31ee35464805e0ad5bc391622e9723f2_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Size 128KB
Sample260416-sb9ewact5k
SHA256 c38e951c44abf7b02454f7211b67daf50f22dc2b2a0739f2ad5b4fc728625dab
MD5 31ee35464805e0ad5bc391622e9723f2
SHA1 1e4c140c9d33db7bc6b34b8a8a83235a9d4fce32
SHA512 5f31b1a0d7bcc27cd29f41dab9df260c78cbed93c7f064f688b2254f5ef11c1e2b7d98d9cd116129735936a4aaecfc576b64924a96daa986e1b8966b46c56b57
SSDEEP 3072:wTfu0ts0nhqXpMfrG/XzP6lGafV8BRSVATMJ:wTXnUKf8zQlfVYSVAe
TLSH
T19AD3AE173493D072D40363B0C89686C11B6E2C133BB6DD2FBB9532FE6AB1654D91A6E3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
1604	4bqm.exe
1472	4bqm.exe
1096	yc1ug1g8b.exe
4396	yc1ug1g8b.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\risn6b374q = "C:\\Users\\Admin\\AppData\\Roaming\\4bqm.exe"	2026-04-16_31ee35464805e0ad5bc391622e9723f2_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a1f0lv7eke = "C:\\Users\\Admin\\AppData\\Roaming\\yc1ug1g8b.exe"	4bqm.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2340 set thread context of 868	2340	2026-04-16_31ee35464805e0ad5bc391622e9723f2_amadey_elex_rhadamanthys_smoke-loader_stop.exe	86
PID 1604 set thread context of 1472	1604	4bqm.exe	91
PID 1096 set thread context of 4396	1096	yc1ug1g8b.exe	95

Program crash 3 IoCs

pid	pid_target	Process	procid_target
976	2340	WerFault.exe	85
4328	1604	WerFault.exe	88
3060	1096	WerFault.exe	92

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4bqm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yc1ug1g8b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yc1ug1g8b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-16_31ee35464805e0ad5bc391622e9723f2_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-16_31ee35464805e0ad5bc391622e9723f2_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4bqm.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 868	2340	2026-04-16_31ee35464805e0ad5bc391622e9723f2_amadey_elex_rhadamanthys_smoke-loader_stop.exe	86
PID 2340 wrote to memory of 868	2340	2026-04-16_31ee35464805e0ad5bc391622e9723f2_amadey_elex_rhadamanthys_smoke-loader_stop.exe	86
PID 868 wrote to memory of 1604	868	2026-04-16_31ee35464805e0ad5bc391622e9723f2_amadey_elex_rhadamanthys_smoke-loader_stop.exe	88
PID 1604 wrote to memory of 1472	1604	4bqm.exe	91
PID 1604 wrote to memory of 1472	1604	4bqm.exe	91
PID 1472 wrote to memory of 1096	1472	4bqm.exe	92
PID 1096 wrote to memory of 4396	1096	yc1ug1g8b.exe	95
PID 1096 wrote to memory of 4396	1096	yc1ug1g8b.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-04-16_31ee35464805e0ad5bc391622e9723f2_amadey_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-16_31ee35464805e0ad5bc391622e9723f2_amadey_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Users\Admin\AppData\Local\Temp\2026-04-16_31ee35464805e0ad5bc391622e9723f2_amadey_elex_rhadamanthys_smoke-loader_stop.exe
  C:\Users\Admin\AppData\Local\Temp\2026-04-16_31ee35464805e0ad5bc391622e9723f2_amadey_elex_rhadamanthys_smoke-loader_stop.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:868
- - C:\Users\Admin\AppData\Roaming\4bqm.exe
    C:\Users\Admin\AppData\Roaming\4bqm.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1604
  - - C:\Users\Admin\AppData\Roaming\4bqm.exe
      C:\Users\Admin\AppData\Roaming\4bqm.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1472
    - - C:\Users\Admin\AppData\Roaming\yc1ug1g8b.exe
        
        C:\Users\Admin\AppData\Roaming\yc1ug1g8b.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1096
      - C:\Users\Admin\AppData\Roaming\yc1ug1g8b.exe
        
        C:\Users\Admin\AppData\Roaming\yc1ug1g8b.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4396
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1096 -s 340
        6⤵
        Program crash
        
        PID:3060
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 340
      4⤵
      Program crash
      PID:4328
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 340
  2⤵
  - Program crash
  PID:976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2340 -ip 2340
1⤵
PID:4404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1604 -ip 1604
1⤵
PID:2180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1096 -ip 1096
1⤵
PID:1656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4bqm.exe

Path C:\Users\Admin\AppData\Roaming\4bqm.exe
Size 128KB
SHA256 dc16740ce60eb1fdd28d651cfdbded2bc68c254ed32c7fe742d2c1ae6a6d1ad7
MD5 bbfcb4d4069e010d31fde2e57587edab
SHA1 3d55d288a5539b8ec1b73b8d628bf697afe3b17a
SHA512 3d809f798acda08ab291f7a8199275f0c8dcc43ec65f3cd9d3f958b5c69659bebbd8b555e597c90386df0935600db1fd0c13304f7d7dbee3b4b6dc616cd1c398
SSDEEP 3072:/Tfu0ts0nhqXpMfrG/XzP6lGafV8BRSVATMJ:/TXnUKf8zQlfVYSVAe
TLSH
T11BD3AE173493D072D40363B0C89686C11B6E2C133BB6DD2FBB9532FE6AB1654D91A6E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yc1ug1g8b.exe

Path C:\Users\Admin\AppData\Roaming\yc1ug1g8b.exe
Size 128KB
SHA256 bed2fae981c3d64beeeecc38de0ba758626b19e9da3153752b23bfd7c7c11a80
MD5 f8ad26c8d66df36926ec96dd83bcbdbe
SHA1 e37a3ff18265b77bab89efa78c5b90ffa69fbfe7
SHA512 2bef2377534eeb89dd326277c28ee256ce8bb64b24593ed7ad8a3e670bd14023520d6bcff77662cb50db723ef3b5221427003623da4a0f1114701bad3b712e99
SSDEEP 3072:ETfu0ts0nhqXpMfrG/XzP6lGafV8BRSVATMJ:ETXnUKf8zQlfVYSVAe
TLSH
T147D3AE173493D072D40363B0C89686C11B6E2C133BB6DD2FBB9532FE6AB1654D91A6E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/868-0-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/868-1-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/868-2-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/868-5-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1472-11-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1472-10-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1472-14-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4396-19-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4396-20-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4396-21-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4396-24-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4396-27-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4396-30-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4396-41-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4396-44-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4396-45-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4396-46-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4396-49-0x0000000000400000-0x0000000000429000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads