Analysis
- max time kernel
149s - max time network
97s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
19/04/2026, 22:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-19_853dff4df8b0b8c9c7919a83e0ceced0_elex_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-19_853dff4df8b0b8c9c7919a83e0ceced0_elex_rhadamanthys_smoke-loader_stop.exe
Resource
win11-20260130-en
windows11-21h2-x64
7 signatures
150 seconds
General
- Target 2026-04-19_853dff4df8b0b8c9c7919a83e0ceced0_elex_rhadamanthys_smoke-loader_stop.exe
- Size 104KB
- Sample260419-2dcncsf19x
- SHA256 4b15732500937f71021f22087ff51d7ebf887ae96aa78fd1f6ebf29ba07f7864
- MD5 853dff4df8b0b8c9c7919a83e0ceced0
- SHA1 f719fc3b001cd176796d4c72ec22468a44f5cf0e
- SHA512 d86efd93f395871d9b4a2c8a942926eaee6bd93fd2e95b779212a96f95c6d5d9871c94e52ee65436eb2380d6e315ace6ad02ddc52d69fc08f4cd5795dbd2ec81
- SSDEEP 1536:ngTJCNMiJ0dxUEy5beFI5sxyCNYwUch0IdTh8evcmmt0Dz:n2JhCgPCR41hWevcmmt0Dz
- TLSH T18EA37E0539D3C073D41505328A41CAC1AB7EBD333BFBA96BFB9407896E901C5E7AA1B5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4304 uwkoo.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\uwkoo.exe 2026-04-19_853dff4df8b0b8c9c7919a83e0ceced0_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\SysWOW64\uwkoo.exe 2026-04-19_853dff4df8b0b8c9c7919a83e0ceced0_elex_rhadamanthys_smoke-loader_stop.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\inf\xutrt.PNF 2026-04-19_853dff4df8b0b8c9c7919a83e0ceced0_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\inf\xutrt.PNF uwkoo.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uwkoo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-19_853dff4df8b0b8c9c7919a83e0ceced0_elex_rhadamanthys_smoke-loader_stop.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe 4304 uwkoo.exe - Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 4944 wrote to memory of 4304 4944 2026-04-19_853dff4df8b0b8c9c7919a83e0ceced0_elex_rhadamanthys_smoke-loader_stop.exe 81 PID 4944 wrote to memory of 2616 4944 2026-04-19_853dff4df8b0b8c9c7919a83e0ceced0_elex_rhadamanthys_smoke-loader_stop.exe 83 PID 4304 wrote to memory of 3560 4304 uwkoo.exe 57 PID 4304 wrote to memory of 3836 4304 uwkoo.exe 61 PID 4304 wrote to memory of 2792 4304 uwkoo.exe 51 PID 4304 wrote to memory of 3680 4304 uwkoo.exe 58 PID 4304 wrote to memory of 3836 4304 uwkoo.exe 61 PID 4304 wrote to memory of 3680 4304 uwkoo.exe 58 PID 4304 wrote to memory of 3836 4304 uwkoo.exe 61 PID 4304 wrote to memory of 3836 4304 uwkoo.exe 61 PID 4304 wrote to memory of 2792 4304 uwkoo.exe 51 PID 4304 wrote to memory of 3836 4304 uwkoo.exe 61 PID 4304 wrote to memory of 3152 4304 uwkoo.exe 53 PID 4304 wrote to memory of 3680 4304 uwkoo.exe 58 PID 4304 wrote to memory of 3836 4304 uwkoo.exe 61 PID 4304 wrote to memory of 3560 4304 uwkoo.exe 57 PID 4304 wrote to memory of 3836 4304 uwkoo.exe 61 PID 4304 wrote to memory of 3680 4304 uwkoo.exe 58 PID 4304 wrote to memory of 3152 4304 uwkoo.exe 53 PID 4304 wrote to memory of 2792 4304 uwkoo.exe 51
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2792
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\2026-04-19_853dff4df8b0b8c9c7919a83e0ceced0_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-19_853dff4df8b0b8c9c7919a83e0ceced0_elex_rhadamanthys_smoke-loader_stop.exe"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\SysWOW64\uwkoo.exe"C:\Windows\system32\uwkoo.exe" -reg23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4304
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\erase.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:2616
-
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3560
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3680
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3836
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\erase.bat
- Size 181B
- SHA256 3c1cf718403a0fe1d47c715a7f0d22d7af8f2679de5a17e5fcc47f9d2d207edb
- MD5 4068af7b7fa298420a1215775fe18aa5
- SHA1 40487e58130f33cf4f5160342eeca7de24b6c719
- SHA512 813bb94b4d4da7dcaa13f4a30c2941c54c16e42dff3ec239201a2e3fa9886a2da7d6c31c962c21b14bcc675386ad50af729956a0fa74741363821ab9b4413ca3
- TLSH T1F0C02209808ADF1A0208A00B07B3DA4EC0A808866E003722AB0282A820C185DA487122
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\uwkoo.exe
- Size 104KB
- SHA256 7a32dfdff48c842853305ea0d4bdbed6869c903e1680efc9aa72b726a1903732
- MD5 84598f6c5691fb1f6fda7746c226c716
- SHA1 a09267a8fa87b086531e51d2992955018b71e758
- SHA512 f79da9edbac4c4168a3196b7eb55146370b71993f50c1bf56c9f39ead6bd0ad1d5d7dce9166bf65feb4fad3ca5cfe20cedc46dd1ff7a94282d42d9c60d425762
- SSDEEP 1536:ngTJCNMiJ0dxUEy5beFI5sxyCNYwUch0IdTh8evcmmt0DK:n2JhCgPCR41hWevcmmt0DK
- TLSH T1E2A37E0539D3C073D41505328A41CAC1AB7EBD333BFBA96BFB9407896E901C5E7AA1B5
- MD5 SHA1 SHA512 SSDEEP TLSH