5d06522342d63cff0e03df1c0e96e6fab916d05359862c9a93e45219695147ea

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/04/2026, 00:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-23_2af88a062ee69c9cd2664ecbdf9afc91_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Size 124KB
Sample260423-a8rbfsfs2v
SHA256 5d06522342d63cff0e03df1c0e96e6fab916d05359862c9a93e45219695147ea
MD5 2af88a062ee69c9cd2664ecbdf9afc91
SHA1 23d8cd0748854b99f0727e092fe56881ab848f47
SHA512 3e6ae397d2eb73efd3616823b36ee40641e5e7a6a9dc329c299e649d6f10ca250dd526673e6a11f67b6f1248082f6859009dd785f733685e6270dd19344d7f97
SSDEEP 1536:wLBYbzcsgkNn4jnstTfIGsXbJyBnZuZ27ogIlt7TeNJOSA5mEY7X05uHaW34k5RZ:GLjnstTf9ZuZ2MgGwQ/2auHaFq4UvJ
TLSH
T185C3AD503523C832D8F04DBC409FCF847B6FED432AB5561BFB9476596B71288B52AAB0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4456	xu4doiz4j.exe
2708	xu4doiz4j.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fil43uf = "C:\\Users\\Admin\\AppData\\Roaming\\xu4doiz4j.exe"	2026-04-23_2af88a062ee69c9cd2664ecbdf9afc91_amadey_elex_rhadamanthys_smoke-loader_stop.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4752 set thread context of 4584	4752	2026-04-23_2af88a062ee69c9cd2664ecbdf9afc91_amadey_elex_rhadamanthys_smoke-loader_stop.exe	84
PID 4456 set thread context of 2708	4456	xu4doiz4j.exe	88

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4804	4752	WerFault.exe	83
900	4456	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xu4doiz4j.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-23_2af88a062ee69c9cd2664ecbdf9afc91_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-23_2af88a062ee69c9cd2664ecbdf9afc91_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xu4doiz4j.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 4584	4752	2026-04-23_2af88a062ee69c9cd2664ecbdf9afc91_amadey_elex_rhadamanthys_smoke-loader_stop.exe	84
PID 4752 wrote to memory of 4584	4752	2026-04-23_2af88a062ee69c9cd2664ecbdf9afc91_amadey_elex_rhadamanthys_smoke-loader_stop.exe	84
PID 4584 wrote to memory of 4456	4584	2026-04-23_2af88a062ee69c9cd2664ecbdf9afc91_amadey_elex_rhadamanthys_smoke-loader_stop.exe	86
PID 4456 wrote to memory of 2708	4456	xu4doiz4j.exe	88
PID 4456 wrote to memory of 2708	4456	xu4doiz4j.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-04-23_2af88a062ee69c9cd2664ecbdf9afc91_amadey_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-23_2af88a062ee69c9cd2664ecbdf9afc91_amadey_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Users\Admin\AppData\Local\Temp\2026-04-23_2af88a062ee69c9cd2664ecbdf9afc91_amadey_elex_rhadamanthys_smoke-loader_stop.exe
  C:\Users\Admin\AppData\Local\Temp\2026-04-23_2af88a062ee69c9cd2664ecbdf9afc91_amadey_elex_rhadamanthys_smoke-loader_stop.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4584
- - C:\Users\Admin\AppData\Roaming\xu4doiz4j.exe
    C:\Users\Admin\AppData\Roaming\xu4doiz4j.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4456
  - - C:\Users\Admin\AppData\Roaming\xu4doiz4j.exe
      C:\Users\Admin\AppData\Roaming\xu4doiz4j.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2708
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4456 -s 316
      4⤵
      Program crash
      PID:900
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 304
  2⤵
  - Program crash
  PID:4804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4752 -ip 4752
1⤵
PID:1460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4456 -ip 4456
1⤵
PID:1664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xu4doiz4j.exe

Path C:\Users\Admin\AppData\Roaming\xu4doiz4j.exe
Size 124KB
SHA256 48fe916435a611efc3500fea0e61c5f7ad0a574484a51567517f423da1295989
MD5 441fec553a45d4d10544e342b7335255
SHA1 480b120ba256246422a5b142ec6deb7677227d4e
SHA512 f7458e5b78f6054c7d32413a87dd90e15957b1cf047dd740407c282e3456c4cd6382c7837ace47c6d9f85e289b3c851d2f5e1a9162f53dc14f2901be812b9e63
SSDEEP 1536:4LBYbzcsgkNn4jnstTfIGsXbJyBnZuZ27ogIlt7TeNJOSA5mEY7X05uHaW34k5RZ:OLjnstTf9ZuZ2MgGwQ/2auHaFq4UvJ
TLSH
T152C3AD103523C832D8F04DBC409FCF847B6FED032AB5561BFB9476596B71288B52AAB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2708-15-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2708-11-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2708-10-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2708-12-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2708-17-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2708-19-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2708-21-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4584-2-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4584-4-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4584-1-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4584-13-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4584-0-0x0000000000400000-0x0000000000429000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads