b13050e0735cffcaebe1c6778580b2bfb0d90bdba4a39fa26f33b06e64fc5fa9

Analysis

max time kernel
149s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/05/2026, 13:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-03_0cc87339126a89e826e1cda4eafc4aab_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Size 128KB
Sample260503-qdr79shy7x
SHA256 b13050e0735cffcaebe1c6778580b2bfb0d90bdba4a39fa26f33b06e64fc5fa9
MD5 0cc87339126a89e826e1cda4eafc4aab
SHA1 9b0c2f75664ccf2031792142bce3ce001059b068
SHA512 60f1dacd5256875aa2c40d6d821b10b5f8dfede79b742d6ac602c13aba20a3eba27574eadffd4eb81933dc46ca839142c948fc92adebeb5d4e593e95e5452bdd
SSDEEP 1536:CjX0s1IG9k50g0tHgzaZo50Se8ia7kPd4qIP731J+lx+fSQeWcHmlt3aJtjW79Aa:CTfg0txZ27kPdITzqx+ZAmw67qyRkSJ
TLSH
T1E0D3D0063893D072D40101B4046B8EF17B7FADE37ABD951FABBDF10E6EB12684966271
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
1604	xu4doiz4j.exe
2412	xu4doiz4j.exe
4328	wxk0e.exe
4936	wxk0e.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fil43uf = "C:\\Users\\Admin\\AppData\\Roaming\\xu4doiz4j.exe"	2026-05-03_0cc87339126a89e826e1cda4eafc4aab_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vvx1hy = "C:\\Users\\Admin\\AppData\\Roaming\\wxk0e.exe"	xu4doiz4j.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3948 set thread context of 4948	3948	2026-05-03_0cc87339126a89e826e1cda4eafc4aab_amadey_elex_rhadamanthys_smoke-loader_stop.exe	86
PID 1604 set thread context of 2412	1604	xu4doiz4j.exe	90
PID 4328 set thread context of 4936	4328	wxk0e.exe	93

Program crash 3 IoCs

pid	pid_target	Process	procid_target
916	3948	WerFault.exe	85
1872	1604	WerFault.exe	89
4060	4328	WerFault.exe	92

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xu4doiz4j.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xu4doiz4j.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wxk0e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wxk0e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-03_0cc87339126a89e826e1cda4eafc4aab_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-03_0cc87339126a89e826e1cda4eafc4aab_amadey_elex_rhadamanthys_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3948 wrote to memory of 4948	3948	2026-05-03_0cc87339126a89e826e1cda4eafc4aab_amadey_elex_rhadamanthys_smoke-loader_stop.exe	86
PID 3948 wrote to memory of 4948	3948	2026-05-03_0cc87339126a89e826e1cda4eafc4aab_amadey_elex_rhadamanthys_smoke-loader_stop.exe	86
PID 4948 wrote to memory of 1604	4948	2026-05-03_0cc87339126a89e826e1cda4eafc4aab_amadey_elex_rhadamanthys_smoke-loader_stop.exe	89
PID 1604 wrote to memory of 2412	1604	xu4doiz4j.exe	90
PID 1604 wrote to memory of 2412	1604	xu4doiz4j.exe	90
PID 2412 wrote to memory of 4328	2412	xu4doiz4j.exe	92
PID 4328 wrote to memory of 4936	4328	wxk0e.exe	93
PID 4328 wrote to memory of 4936	4328	wxk0e.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-05-03_0cc87339126a89e826e1cda4eafc4aab_amadey_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-03_0cc87339126a89e826e1cda4eafc4aab_amadey_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Users\Admin\AppData\Local\Temp\2026-05-03_0cc87339126a89e826e1cda4eafc4aab_amadey_elex_rhadamanthys_smoke-loader_stop.exe
  C:\Users\Admin\AppData\Local\Temp\2026-05-03_0cc87339126a89e826e1cda4eafc4aab_amadey_elex_rhadamanthys_smoke-loader_stop.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4948
- - C:\Users\Admin\AppData\Roaming\xu4doiz4j.exe
    C:\Users\Admin\AppData\Roaming\xu4doiz4j.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1604
  - - C:\Users\Admin\AppData\Roaming\xu4doiz4j.exe
      C:\Users\Admin\AppData\Roaming\xu4doiz4j.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2412
    - - C:\Users\Admin\AppData\Roaming\wxk0e.exe
        
        C:\Users\Admin\AppData\Roaming\wxk0e.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4328
      - C:\Users\Admin\AppData\Roaming\wxk0e.exe
        
        C:\Users\Admin\AppData\Roaming\wxk0e.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4936
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4328 -s 352
        6⤵
        Program crash
        
        PID:4060
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 340
      4⤵
      Program crash
      PID:1872
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3948 -s 340
  2⤵
  - Program crash
  PID:916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3948 -ip 3948
1⤵
PID:1380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1604 -ip 1604
1⤵
PID:3784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4328 -ip 4328
1⤵
PID:4760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wxk0e.exe

Path C:\Users\Admin\AppData\Roaming\wxk0e.exe
Size 128KB
SHA256 a92c51deb3a3da1566d775aaab1ad3312a4c0c89f722c7078b64ab479a20ed81
MD5 509dd83e10a298216f886607236f49dc
SHA1 197582e644b3e3c6938904d9eee37045bcc8be3e
SHA512 c9bf6c2cb7a6a205223fd38e879ba99db382a80e1859d6e33aa89fbbf071ef9eb9cb1b97c0a17c2a0fe94768b54087a3fefd5877afe670850932667e6d08e5c0
SSDEEP 1536:LjX0s1IG9k50g0tHgzaZo50Se8ia7kPd4qIP731J+lx+fSQeWcHmlt3aJtjW79Aa:LTfg0txZ27kPdITzqx+ZAmw67qyRkSJ
TLSH
T19DD3D0063893D072D40101B4046B8EF17B7FADE37ABD951FABBDF10E6EB12684966271
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xu4doiz4j.exe

Path C:\Users\Admin\AppData\Roaming\xu4doiz4j.exe
Size 128KB
SHA256 8ca740cadb6905461f8fd906ac9038e0ddae1f8ec4d40802cb49e0cbf5086e05
MD5 66b94e2ebb7117432c94806082dd7b04
SHA1 d0ef23331e81b516cda1df25fa63f9205431ff4f
SHA512 3aed2f8806fbaf68651855bd86687ab15aaf275d08c62daa90d6d3b089da73b9da181a2c0376693e89a66c8a4ad1610189f724fa1b82defc70a9697e44f1d65e
SSDEEP 1536:JjX0s1IG9k50g0tHgzaZo50Se8ia7kPd4qIP731J+lx+fSQeWcHmlt3aJtjW79Aa:JTfg0txZ27kPdITzqx+ZAmw67qyRkSJ
TLSH
T12BD3D0063893D072D40101B4046B8EF17B7FADE37ABD951FABBDF10E6EB12684966271
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2412-10-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2412-60-0x00000000007E0000-0x0000000000876000-memory.dmp

Download

memory/2412-26-0x00000000007E0000-0x0000000000876000-memory.dmp

Download

memory/2412-11-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2412-14-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4936-39-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4936-61-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4936-19-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4936-20-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4936-21-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4936-73-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4936-71-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4936-27-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4936-28-0x0000000000540000-0x00000000005D6000-memory.dmp

Download

memory/4936-69-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4936-33-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4936-67-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4948-2-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4948-1-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4948-57-0x0000000000A50000-0x0000000000AE6000-memory.dmp

Download

memory/4948-0-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4948-4-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4948-24-0x0000000000A50000-0x0000000000AE6000-memory.dmp

Download

memory/4948-22-0x0000000000400000-0x0000000000429000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads