34d39e249a4785e5783f45728d15ee680b8ab00c1eeebc4a5b7427a96eddf0ce

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/04/2026, 19:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-25_ba81a6bca26cf936df4eb99ea9ef3e88_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Size 128KB
Sample260425-ynmdrsbs3n
SHA256 34d39e249a4785e5783f45728d15ee680b8ab00c1eeebc4a5b7427a96eddf0ce
MD5 ba81a6bca26cf936df4eb99ea9ef3e88
SHA1 4156ec2c8aca293327781a51fcb2598c0bd604f1
SHA512 687b6e4c9ac62c6c059013bdc196fb896115930533f3718063c063c162a32789fed99221f01b89f8168119259cfcba5811793f4f362be1d36a5cac6e9fd0be37
SSDEEP 1536:gjX0s1IG9k50g0tHgzaZo50Se8ia7kPd4qIP731J+lx+fSQeWcHmlt3aJtjW79Aa:gTfg0txZ27kPdITzqx+ZAmw67qyRkSJ
TLSH
T14BD3D0063893D072D40101B4046B8EF17B7FADE37ABD951FABBDF10E6EB12684966271
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
4112	xu4doiz4j.exe
3924	xu4doiz4j.exe
4252	rg73ou6.exe
3584	rg73ou6.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fil43uf = "C:\\Users\\Admin\\AppData\\Roaming\\xu4doiz4j.exe"	2026-04-25_ba81a6bca26cf936df4eb99ea9ef3e88_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zb9yiyjw = "C:\\Users\\Admin\\AppData\\Roaming\\rg73ou6.exe"	xu4doiz4j.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4336 set thread context of 3548	4336	2026-04-25_ba81a6bca26cf936df4eb99ea9ef3e88_amadey_elex_rhadamanthys_smoke-loader_stop.exe	85
PID 4112 set thread context of 3924	4112	xu4doiz4j.exe	89
PID 4252 set thread context of 3584	4252	rg73ou6.exe	93

Program crash 3 IoCs

pid	pid_target	Process	procid_target
896	4336	WerFault.exe	84
2024	4112	WerFault.exe	87
2804	4252	WerFault.exe	91

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xu4doiz4j.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xu4doiz4j.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rg73ou6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rg73ou6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-25_ba81a6bca26cf936df4eb99ea9ef3e88_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-25_ba81a6bca26cf936df4eb99ea9ef3e88_amadey_elex_rhadamanthys_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4336 wrote to memory of 3548	4336	2026-04-25_ba81a6bca26cf936df4eb99ea9ef3e88_amadey_elex_rhadamanthys_smoke-loader_stop.exe	85
PID 4336 wrote to memory of 3548	4336	2026-04-25_ba81a6bca26cf936df4eb99ea9ef3e88_amadey_elex_rhadamanthys_smoke-loader_stop.exe	85
PID 3548 wrote to memory of 4112	3548	2026-04-25_ba81a6bca26cf936df4eb99ea9ef3e88_amadey_elex_rhadamanthys_smoke-loader_stop.exe	87
PID 4112 wrote to memory of 3924	4112	xu4doiz4j.exe	89
PID 4112 wrote to memory of 3924	4112	xu4doiz4j.exe	89
PID 3924 wrote to memory of 4252	3924	xu4doiz4j.exe	91
PID 4252 wrote to memory of 3584	4252	rg73ou6.exe	93
PID 4252 wrote to memory of 3584	4252	rg73ou6.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-04-25_ba81a6bca26cf936df4eb99ea9ef3e88_amadey_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-25_ba81a6bca26cf936df4eb99ea9ef3e88_amadey_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Users\Admin\AppData\Local\Temp\2026-04-25_ba81a6bca26cf936df4eb99ea9ef3e88_amadey_elex_rhadamanthys_smoke-loader_stop.exe
  C:\Users\Admin\AppData\Local\Temp\2026-04-25_ba81a6bca26cf936df4eb99ea9ef3e88_amadey_elex_rhadamanthys_smoke-loader_stop.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3548
- - C:\Users\Admin\AppData\Roaming\xu4doiz4j.exe
    C:\Users\Admin\AppData\Roaming\xu4doiz4j.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4112
  - - C:\Users\Admin\AppData\Roaming\xu4doiz4j.exe
      C:\Users\Admin\AppData\Roaming\xu4doiz4j.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3924
    - - C:\Users\Admin\AppData\Roaming\rg73ou6.exe
        
        C:\Users\Admin\AppData\Roaming\rg73ou6.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4252
      - C:\Users\Admin\AppData\Roaming\rg73ou6.exe
        
        C:\Users\Admin\AppData\Roaming\rg73ou6.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3584
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4252 -s 340
        6⤵
        Program crash
        
        PID:2804
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4112 -s 340
      4⤵
      Program crash
      PID:2024
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 340
  2⤵
  - Program crash
  PID:896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4336 -ip 4336
1⤵
PID:696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4112 -ip 4112
1⤵
PID:3440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4252 -ip 4252
1⤵
PID:2992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rg73ou6.exe

Path C:\Users\Admin\AppData\Roaming\rg73ou6.exe
Size 128KB
SHA256 2a1ef6164c15db3c11433380c0d8d7af1583557d6211c91cc78c76088da8459f
MD5 1126e44b34bc3b255e1204f827336bfd
SHA1 303d1f81dfb6a441f84dce82b57f8176b7b2f419
SHA512 20ff5e9fbdb87a8a4cbaa996da1842da760efdcbc00a29e62e854eeedf376fd7fe5b355a91484617389bfec9d0a837a8165c22a59cb2485ea92ab51ff8123c36
SSDEEP 1536:SjX0s1IG9k50g0tHgzaZo50Se8ia7kPd4qIP731J+lx+fSQeWcHmlt3aJtjW79Aa:STfg0txZ27kPdITzqx+ZAmw67qyRkSJ
TLSH
T155D3D0063893D072D40101B4046B8EF17B7FADE37ABD951FABBDF10E6EB12684966271
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xu4doiz4j.exe

Path C:\Users\Admin\AppData\Roaming\xu4doiz4j.exe
Size 128KB
SHA256 d4d19e2f896051b2bb385b1c9f12ea15cfdc3be06434d5222fb1a540a8888f73
MD5 0dc4297613c592cc4170fab14a35442c
SHA1 2ad9bb6dbfa6395392d4bea59a4c1f23d69f78d9
SHA512 dc7ccfbf3a4bea44f1fe1f06ed962d3e6c1e035544414fe86cb633619b294fe28f00f5254fc31f8b27af59bf4f025f2f52d5239afc440178653e114d510ecd3f
SSDEEP 1536:0jX0s1IG9k50g0tHgzaZo50Se8ia7kPd4qIP731J+lx+fSQeWcHmlt3aJtjW79Aa:0Tfg0txZ27kPdITzqx+ZAmw67qyRkSJ
TLSH
T149D3D0063893D072D40101B4046B8EF17B7FADE37ABD951FABBDF10E6EB12684926271
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3548-1-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3548-2-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3548-4-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3548-0-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3584-32-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3584-25-0x00000000027B0000-0x000000000282E000-memory.dmp

Download

memory/3584-62-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3584-19-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3584-21-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3584-20-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3584-24-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3584-56-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3584-28-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3584-54-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3584-46-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3584-52-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3924-11-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3924-14-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3924-10-0x0000000000400000-0x0000000000429000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads