Analysis
- max time kernel
149s - max time network
92s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
03/05/2026, 03:05
Behavioral task
behavioral1
Sample
2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe
- Size 458KB
- Sample260503-dldcvsax8t
- SHA256 287e64c12dc8c30eb89f2e433a9580f2b37d265d65773f264d510137212b366b
- MD5 20362a8cf5ba313f328e310d21df5d36
- SHA1 98578cc744879b29e587b4516b4cf453a34ebdd4
- SHA512 5e1f9a35eb79bc3cde386cb7984aa35cc82b96567a6acbe42c2e5a6258a96ccde8e3c64b9fcfe55b854d26401833872cd5be98c04586757a01d72e7e8c56cb19
- SSDEEP 6144:NS1flGXd4OvDzewaH0AFQl7XtRTTLRp1nQ4QLH:qflGXd4OvX8UAFQl7Prr1nMLH
- TLSH T12BA4F6567A80C032D45119340660EBAD4B6A7864DB535DCBBAD03EEEFFF1AC05E39235
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 1 IoCs
resource yara_rule behavioral2/files/0x001d00000002b2db-7.dat family_shodi - Executes dropped EXE 1 IoCs
pid Process 2832 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.usa - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\UsaShohdi.asu 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification C:\Windows\SysWOW64\UsaShohdi.asu 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Mozilla Firefox\updater.usa 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.usa 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.usa 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.usa 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.usa 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.usa 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.usa 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.usa 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.usa 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaws.usa 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.usa 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.usa 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.usa 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\private_browsing.usa 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.usa 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.usa 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\maintenanceservice.usa 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.usa 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.usa 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files\7-Zip\Uninstall.exe 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\PerfBoost.usa 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\SDXHelper.usa 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\XLICONS.usa 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.usa 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\protocolhandler.usa 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.usa 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.usa 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files\Mozilla Firefox\plugin-container.exe 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.usa 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files\7-Zip\7zG.usa 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\msoia.usa 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.usa 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.usa - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4808 wrote to memory of 2832 4808 2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.usaC:\Users\Admin\AppData\Local\Temp\2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.usa2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2832
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\2026-05-03_20362a8cf5ba313f328e310d21df5d36_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.usa
- Size 231KB
- SHA256 3eb8d53778eab9fb13b4c97aeab56e4bad2a6ea3748d342f22eaf4d7aa3185a7
- MD5 6f581a41167d2d484fcba20e6fc3c39a
- SHA1 d48de48d24101b9baaa24f674066577e38e6b75c
- SHA512 e1177b6cea89445d58307b3327c78909adff225497f9abb8de571cdd114b547a8f515ec3ab038b583bf752a085b231f6329d6ca82fbe6be8a58cd97a1dbaf0f6
- SSDEEP 1536:UILFkbeumIkA39xSZW175V7UZQJ0UjsWpcdVO4Mqg+aJRaCAd1uhNRBo+XY:ULRkgUA1nQZwFGVO4Mqg+WDY
- TLSH T163343C17BE448031D8A10D311A65EBAD672AB918C8434E9736943FDFFFF1AD18E24A35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\UsaShohdi.asu
- Size 458KB
- SHA256 b45fd6e90a5782e54a0a442d1a8cad2f869d2c5f4a98e9832a757712fe98ce97
- MD5 1e543ce56fad02e87a92b1e163d1356a
- SHA1 7bd02c3f91bdcc0c0205a0105b78b9f74d5f4a20
- SHA512 57c7ac9155cfbf2c824005794409e9e814b2a2de58e323a3ea74f1bf77f227aaacbc650a4f4eac12909e8cd45d7eaa48a0c8fe090a16ad7b8e94fe0aa74d0087
- SSDEEP 6144:NSiflGXd4OvDzewaH0AFQl7XtRTTLRp1nQ4QLH:dflGXd4OvX8UAFQl7Prr1nMLH
- TLSH T109A407567A80C032D45119341660EAAD4B6A7864CB535DCBBBD03EEEFFF1AC09E39235
- MD5 SHA1 SHA512 SSDEEP TLSH