34d39e249a4785e5783f45728d15ee680b8ab00c1eeebc4a5b7427a96eddf0ce

Analysis

max time kernel
149s
max time network
116s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/04/2026, 19:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-25_ba81a6bca26cf936df4eb99ea9ef3e88_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Size 128KB
Sample260425-ynmdrsbs3n
SHA256 34d39e249a4785e5783f45728d15ee680b8ab00c1eeebc4a5b7427a96eddf0ce
MD5 ba81a6bca26cf936df4eb99ea9ef3e88
SHA1 4156ec2c8aca293327781a51fcb2598c0bd604f1
SHA512 687b6e4c9ac62c6c059013bdc196fb896115930533f3718063c063c162a32789fed99221f01b89f8168119259cfcba5811793f4f362be1d36a5cac6e9fd0be37
SSDEEP 1536:gjX0s1IG9k50g0tHgzaZo50Se8ia7kPd4qIP731J+lx+fSQeWcHmlt3aJtjW79Aa:gTfg0txZ27kPdITzqx+ZAmw67qyRkSJ
TLSH
T14BD3D0063893D072D40101B4046B8EF17B7FADE37ABD951FABBDF10E6EB12684966271
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
4376	o1djmmcpl.exe
1936	o1djmmcpl.exe
4796	rg73ou6.exe
580	rg73ou6.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows\CurrentVersion\Run\zb9yiyjw = "C:\\Users\\Admin\\AppData\\Roaming\\rg73ou6.exe"	o1djmmcpl.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows\CurrentVersion\Run\q7gant8go = "C:\\Users\\Admin\\AppData\\Roaming\\o1djmmcpl.exe"	2026-04-25_ba81a6bca26cf936df4eb99ea9ef3e88_amadey_elex_rhadamanthys_smoke-loader_stop.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4592 set thread context of 3208	4592	2026-04-25_ba81a6bca26cf936df4eb99ea9ef3e88_amadey_elex_rhadamanthys_smoke-loader_stop.exe	80
PID 4376 set thread context of 1936	4376	o1djmmcpl.exe	85
PID 4796 set thread context of 580	4796	rg73ou6.exe	89

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1988	4592	WerFault.exe	79
1768	4376	WerFault.exe	82
656	4796	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rg73ou6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rg73ou6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-25_ba81a6bca26cf936df4eb99ea9ef3e88_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-25_ba81a6bca26cf936df4eb99ea9ef3e88_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	o1djmmcpl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	o1djmmcpl.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 3208	4592	2026-04-25_ba81a6bca26cf936df4eb99ea9ef3e88_amadey_elex_rhadamanthys_smoke-loader_stop.exe	80
PID 4592 wrote to memory of 3208	4592	2026-04-25_ba81a6bca26cf936df4eb99ea9ef3e88_amadey_elex_rhadamanthys_smoke-loader_stop.exe	80
PID 3208 wrote to memory of 4376	3208	2026-04-25_ba81a6bca26cf936df4eb99ea9ef3e88_amadey_elex_rhadamanthys_smoke-loader_stop.exe	82
PID 4376 wrote to memory of 1936	4376	o1djmmcpl.exe	85
PID 4376 wrote to memory of 1936	4376	o1djmmcpl.exe	85
PID 1936 wrote to memory of 4796	1936	o1djmmcpl.exe	87
PID 4796 wrote to memory of 580	4796	rg73ou6.exe	89
PID 4796 wrote to memory of 580	4796	rg73ou6.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-04-25_ba81a6bca26cf936df4eb99ea9ef3e88_amadey_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-25_ba81a6bca26cf936df4eb99ea9ef3e88_amadey_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Users\Admin\AppData\Local\Temp\2026-04-25_ba81a6bca26cf936df4eb99ea9ef3e88_amadey_elex_rhadamanthys_smoke-loader_stop.exe
  C:\Users\Admin\AppData\Local\Temp\2026-04-25_ba81a6bca26cf936df4eb99ea9ef3e88_amadey_elex_rhadamanthys_smoke-loader_stop.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3208
- - C:\Users\Admin\AppData\Roaming\o1djmmcpl.exe
    C:\Users\Admin\AppData\Roaming\o1djmmcpl.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4376
  - - C:\Users\Admin\AppData\Roaming\o1djmmcpl.exe
      C:\Users\Admin\AppData\Roaming\o1djmmcpl.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1936
    - - C:\Users\Admin\AppData\Roaming\rg73ou6.exe
        
        C:\Users\Admin\AppData\Roaming\rg73ou6.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4796
      - C:\Users\Admin\AppData\Roaming\rg73ou6.exe
        
        C:\Users\Admin\AppData\Roaming\rg73ou6.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:580
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 372
        6⤵
        Program crash
        
        PID:656
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 376
      4⤵
      Program crash
      PID:1768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4592 -s 372
  2⤵
  - Program crash
  PID:1988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4592 -ip 4592
1⤵
PID:1080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4376 -ip 4376
1⤵
PID:2160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4796 -ip 4796
1⤵
PID:3388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

o1djmmcpl.exe

Path C:\Users\Admin\AppData\Roaming\o1djmmcpl.exe
Size 128KB
SHA256 255da2c65f52634a308b13fdbeb88343bf150a7dd2d6fa6683ab129475a6c8f2
MD5 4779234d842005b7a94c5dc07fd89142
SHA1 d6a56dd58bc48d2576c650c2fc53abe4b3066edc
SHA512 a29941153c20f7ae9766cf2c580a8c23041c87ed33b06671d104d88336b6ecf9ad79b6a696c3e83b303d6a82b13f82c59078170136a1bde6ece0e5aad80522b4
SSDEEP 1536:ajX0s1IG9k50g0tHgzaZo50Se8ia7kPd4qIP731J+lx+fSQeWcHmlt3aJtjW79Aa:aTfg0txZ27kPdITzqx+ZAmw67qyRkSJ
TLSH
T178D3D0063893D072D40101B4046B8EF17B7FADE37ABD951FABBDF10E6EB12684966271
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rg73ou6.exe

Path C:\Users\Admin\AppData\Roaming\rg73ou6.exe
Size 128KB
SHA256 968815b982e677cc171934b34728584c7af6c297f68fb68e0ddb141681a8f3af
MD5 7ed49d82d185966ef96e811cc1a1f7d9
SHA1 af8389bfabe80feb36f4bbfda939d749039c9140
SHA512 de4fb40885128b03a08ad85142067754beab765e4be9d547373e8946de543af7a32c6883bf498a6e272c18104b23734c3fb087ef8319cc8cddf1d8bdacaa3538
SSDEEP 1536:8jX0s1IG9k50g0tHgzaZo50Se8ia7kPd4qIP731J+lx+fSQeWcHmlt3aJtjW79Aa:8Tfg0txZ27kPdITzqx+ZAmw67qyRkSJ
TLSH
T100D3D0063893D072D40101B4046B8EF17B7FADE37ABD951FABBDF10E6EB12684926271
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/580-21-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/580-29-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/580-72-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/580-62-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/580-61-0x0000000000860000-0x000000000091B000-memory.dmp

Download

memory/580-66-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/580-19-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/580-20-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/580-64-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/580-28-0x0000000000860000-0x000000000091B000-memory.dmp

Download

memory/580-41-0x0000000000860000-0x000000000091B000-memory.dmp

Download

memory/580-40-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/580-60-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/580-34-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1936-11-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1936-26-0x00000000008A0000-0x000000000095B000-memory.dmp

Download

memory/1936-14-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1936-10-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3208-24-0x0000000000B70000-0x0000000000C2B000-memory.dmp

Download

memory/3208-22-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3208-1-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3208-3-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3208-2-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3208-0-0x0000000000400000-0x0000000000429000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads