Analysis
- max time kernel
150s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
03/05/2026, 14:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-03_0f4858dbf603dea97c96cb2e8e1e5cc2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-03_0f4858dbf603dea97c96cb2e8e1e5cc2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target 2026-05-03_0f4858dbf603dea97c96cb2e8e1e5cc2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 235KB
- Sample260503-rydfaabt7v
- SHA256 e1bc742ac140101e20da1b1bdecc18b7646f7fbbdd1f9f653522b6d423ae792f
- MD5 0f4858dbf603dea97c96cb2e8e1e5cc2
- SHA1 0d7d582d427c5b171800bfbc64b616352bea97cb
- SHA512 1773f70a660ec126a3d3fcc9af8df0b99394689fea82ae22258268a84acbd24feda00016af908e5219c7b1254540e0912cc988b563f8e14ea518a5b2e96c90f6
- SSDEEP 3072:DCSjGoLpWM6bblmjxi3EAi8RYZrEguStu505aYwKa8YzWP1myXC:ZXmRmUE5kZgBuiaYwKaTFyS
- TLSH T137347C2632CCF372D0E205345E6DF2B1AD7ABC311E25581FB7E91B2D5E716C29A28346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Renames multiple (257) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 2026-05-03_0f4858dbf603dea97c96cb2e8e1e5cc2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe File opened for modification C:\Windows\system32\drivers\etc\hosts rundl132.exe - Executes dropped EXE 2 IoCs
pid Process 5564 Logo1_.exe 2992 rundl132.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" Logo1_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" 2026-05-03_0f4858dbf603dea97c96cb2e8e1e5cc2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\RCXCFCA.tmp Logo1_.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXCD92.tmp Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe.Exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\RCXD00E.tmp Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\RCXDC30.tmp Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Video.UI.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\RCXDBBD.tmp Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateCore.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateOnDemand.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeComRegisterShellARM64.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe.Exe Logo1_.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Solitaire.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXDA32.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdate.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe Logo1_.exe File opened for modification C:\Program Files\dotnet\dotnet.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe.Exe Logo1_.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\Logo1_.exe 2026-05-03_0f4858dbf603dea97c96cb2e8e1e5cc2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification C:\Windows\uninstall\rundl132.exe Logo1_.exe File created C:\Windows\uninstall\rundl132.exe 2026-05-03_0f4858dbf603dea97c96cb2e8e1e5cc2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe - System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundl132.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-03_0f4858dbf603dea97c96cb2e8e1e5cc2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5024 2026-05-03_0f4858dbf603dea97c96cb2e8e1e5cc2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 5024 2026-05-03_0f4858dbf603dea97c96cb2e8e1e5cc2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 5024 2026-05-03_0f4858dbf603dea97c96cb2e8e1e5cc2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 5024 2026-05-03_0f4858dbf603dea97c96cb2e8e1e5cc2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 5024 2026-05-03_0f4858dbf603dea97c96cb2e8e1e5cc2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 5024 2026-05-03_0f4858dbf603dea97c96cb2e8e1e5cc2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 5024 2026-05-03_0f4858dbf603dea97c96cb2e8e1e5cc2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 5024 2026-05-03_0f4858dbf603dea97c96cb2e8e1e5cc2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 5024 2026-05-03_0f4858dbf603dea97c96cb2e8e1e5cc2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 5024 2026-05-03_0f4858dbf603dea97c96cb2e8e1e5cc2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 5024 2026-05-03_0f4858dbf603dea97c96cb2e8e1e5cc2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 5024 2026-05-03_0f4858dbf603dea97c96cb2e8e1e5cc2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 5024 2026-05-03_0f4858dbf603dea97c96cb2e8e1e5cc2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 5024 2026-05-03_0f4858dbf603dea97c96cb2e8e1e5cc2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 5024 2026-05-03_0f4858dbf603dea97c96cb2e8e1e5cc2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 5024 2026-05-03_0f4858dbf603dea97c96cb2e8e1e5cc2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 5024 2026-05-03_0f4858dbf603dea97c96cb2e8e1e5cc2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 5024 2026-05-03_0f4858dbf603dea97c96cb2e8e1e5cc2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 5024 2026-05-03_0f4858dbf603dea97c96cb2e8e1e5cc2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 5024 2026-05-03_0f4858dbf603dea97c96cb2e8e1e5cc2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 5024 2026-05-03_0f4858dbf603dea97c96cb2e8e1e5cc2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 5024 2026-05-03_0f4858dbf603dea97c96cb2e8e1e5cc2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 5024 2026-05-03_0f4858dbf603dea97c96cb2e8e1e5cc2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 5024 2026-05-03_0f4858dbf603dea97c96cb2e8e1e5cc2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 5024 2026-05-03_0f4858dbf603dea97c96cb2e8e1e5cc2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 5024 2026-05-03_0f4858dbf603dea97c96cb2e8e1e5cc2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 5564 Logo1_.exe 5564 Logo1_.exe 5564 Logo1_.exe 5564 Logo1_.exe 5564 Logo1_.exe 5564 Logo1_.exe 5564 Logo1_.exe 5564 Logo1_.exe 5564 Logo1_.exe 5564 Logo1_.exe 5564 Logo1_.exe 5564 Logo1_.exe 5564 Logo1_.exe 5564 Logo1_.exe 5564 Logo1_.exe 5564 Logo1_.exe 5564 Logo1_.exe 5564 Logo1_.exe 5564 Logo1_.exe 5564 Logo1_.exe 5564 Logo1_.exe 5564 Logo1_.exe 5564 Logo1_.exe 5564 Logo1_.exe 5564 Logo1_.exe 5564 Logo1_.exe 5564 Logo1_.exe 5564 Logo1_.exe 5564 Logo1_.exe 5564 Logo1_.exe 5564 Logo1_.exe 5564 Logo1_.exe 5564 Logo1_.exe 5564 Logo1_.exe 5564 Logo1_.exe 5564 Logo1_.exe 5564 Logo1_.exe 5564 Logo1_.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 5024 wrote to memory of 5072 5024 2026-05-03_0f4858dbf603dea97c96cb2e8e1e5cc2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 79 PID 5072 wrote to memory of 4196 5072 net.exe 81 PID 5024 wrote to memory of 1036 5024 2026-05-03_0f4858dbf603dea97c96cb2e8e1e5cc2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 82 PID 5024 wrote to memory of 5564 5024 2026-05-03_0f4858dbf603dea97c96cb2e8e1e5cc2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 83 PID 5564 wrote to memory of 3200 5564 Logo1_.exe 85 PID 3200 wrote to memory of 4068 3200 net.exe 87 PID 5564 wrote to memory of 2036 5564 Logo1_.exe 90 PID 2036 wrote to memory of 1984 2036 net.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-03_0f4858dbf603dea97c96cb2e8e1e5cc2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-03_0f4858dbf603dea97c96cb2e8e1e5cc2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
PID:4196
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3FA4.bat2⤵
- System Location Discovery: System Language Discovery
PID:1036
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:4068
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:1984
-
-
-
-
C:\Windows\uninstall\rundl132.exeC:\Windows\uninstall\rundl132.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2992
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXD8FF.tmp
- Size 77KB
- SHA256 c936005ef50b3bff07d9d168ecdc30ac4b57c2d2d5a39391c488bcf46cf0f703
- MD5 dee97f074650e8209159aacca596d001
- SHA1 8611ce0589fb8490869d9d6d6e2e5b5a5ad7f344
- SHA512 e8c5299de945d09f1238b85febecca3f646e02a2f2c99b181508365e1120090f1c5341cb184e412461f3ae2b3ce6c6d276028a5959e91c805bfc0920fe9c6575
- SSDEEP 1536:a7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxM:TCSjGoLpWM6bblmjxM
- TLSH T1A573D756B18CB3B2D0E299BC8E0FF2E5BC257E201E1D589FB59A2F0DEE7A1C1550C185
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCXDB23.tmp
- Size 86KB
- SHA256 853ee415285520ccc78789fa472e0519968eac7493a1a59e6b2747f925a715d6
- MD5 8e7b28eefa80e6f6b0744cfea2e12c12
- SHA1 1f41b1d6768b0f0cf1bf4b0db8e363bf9a20de57
- SHA512 0d26f4b6f1d62979f9abe24e227824ce9be9b0558d0b969bc6f82cc6917d113bece2c3c5182aa8a7a777e899e74b254f928d2262e54e1b5c5ac4b5cb22ceea03
- SSDEEP 1536:67qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxS1XkSPsULMHi2:zCSjGoLpWM6bblmjxSdtPlLqr
- TLSH T1B8833969B28DF372D0F299BC8E0DF2E5BC287D301F19186BB69E1F0D9A765C2150C196
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RCXDB64.tmp
- Size 74KB
- SHA256 ddc48a66623342b053a85c494d3b4a3ec0af06a3fd9273268babf51859aabdfb
- MD5 d1019a2def9187ae76ad6e2e6bdc4cd0
- SHA1 2e1a09273b5f18969978d2d9fe4517e7dc3a95e8
- SHA512 19cf547b7001c3f322ffa35e6586c74073fa6ef858be7da76d2eea533e8cae569db6fa2e6b0f35696ef3edbc95424af6d77cc8d60facf90852a5f80f0926b5dc
- SSDEEP 1536:m7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxS:3CSjGoLpWM6bblmjxS
- TLSH T1F3732A69B28DB372D0F299B89E0DF2E5BC287E301E19186FB69E1F0DDA771C2150C195
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXDA01.tmp
- Size 101KB
- SHA256 1d196a6573e11c3873703132b16d8ece856901ded212b1d119d35d3a03f952d7
- MD5 9764caed8c57d6e8788f72f3c3dff6d5
- SHA1 8e90fa3cdbc312615404f8b5ce9c26551c9e375b
- SHA512 2119309f61b317b2126483348815a43bcfdb9e1b174d42d27f0937e8c55bc42d4df0f8337665bedfa0ce78ab0d8ddeba5ed0cc8c38b1b5e2db13c614d4804dda
- SSDEEP 1536:C7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxh4GZjzQwK5WW7VCn6Ky3:7CSjGoLpWM6bblmjxPe5BV02
- TLSH T192A37C65B68CF3B7C0E299B88E0DF2E5BD257E301E29085FB59A2F0DCA7B5C1550C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe.Exe
- Size 638KB
- SHA256 53f222e0ecc1bbefac25c250a7dfb320cda4274ee573a7ad97416a4deb6dea10
- MD5 da68ff16d21fad7ab3e2856a0b954057
- SHA1 ac7f86f7e90b2a2ca115933bbc6c3ae466647de0
- SHA512 3bc83957e9967c31d4821e11e5cc767da017431cff9355a660a2e32f9e234923f89b8898a76096dea0d7d4acb28921d27c9b0c099acb040f1e3ec7530906b504
- SSDEEP 12288:gGnXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:nJ0Le5ji0hmxNrM
- TLSH T155D4F715F66CB331D0F2C0B9C5DEB69AED713C811B3089CB5286876C6E676E6853A331
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe.Exe
- Size 360KB
- SHA256 b7dba98b727454f0f3f04fd78259a7704ca621b3d757a967a5fe2dad618599a2
- MD5 04002262736a0d57b5121d6f1cf30a2d
- SHA1 f676b767d4cacb80cc5e5fbc2c66825686b82536
- SHA512 c1ac136fb5116540e4706a253396587d9e4e26f9cdc224328c5dc6b87f9fe99e40ab3f36c0bda4db5c7e9903a3870b0478c73236a3073f44cd90e87176700d65
- SSDEEP 6144:1XmRmVAHdwS/WYoTOLHIsPPzAdnz0YutYPDvhI:0KCd9/WYoaLHF3z0z04PDvhI
- TLSH T14E747C95B29C3BF4D8E381398D1DB556EDB27C250B20C61F23A8371A5F332911C2DB99
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\RCXCFB9.tmp
- Size 139KB
- SHA256 c72302210e6d343c1fb39282d9ec0d14059115c341ae179a3796133884e2ef49
- MD5 955828c3288bcdee6b798b31cd2d86ef
- SHA1 3c00ba25ee25a39661881f411289b2fe707a76a3
- SHA512 61114a93200c66730ce654395818ae4dc5ad289d2c9d62dc54edbc9d21d28f266e6d7504c9910f62ed2dc3543e8259041f0a3fe1b4ce148f51edb11f138ae020
- SSDEEP 1536:v7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxPnN:+CSjGoLpWM6bblmjxPN
- TLSH T14BD38275B25CB776E0E199B84E1CF1E5AC1D3E202E2BCC6A755A3F0DBB761C11A0818D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\RCXCFDC.tmp
- Size 74KB
- SHA256 50ec062bfdc7c6a7ff24c78338ef89a19f4aff6d28eb8b284b4a1bf1854e79fc
- MD5 b91d6e956a45c7abd5f9f883856239ff
- SHA1 1dff6701949f4a1c5ab242748d957395db1e4cea
- SHA512 907f86287146c7e6d01e10d83b9a930d96041073ff9af27714c0e734e67928e2de179cb57eef20b55728416c56b0e0796e33f983a6c169b1285f8b3d8907b6f6
- SSDEEP 1536:q7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxU:DCSjGoLpWM6bblmjxU
- TLSH T101731A65B28CB376C0F2A9B89E0DF2E5BC247E301E19185BB5EE1F0DDA7B1C2560C195
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\RCXCFED.tmp
- Size 83KB
- SHA256 eee6b34bc8a6650341fd8dbaebf69f027518ab35daa35d3ca6bfb1b285554bdf
- MD5 d08d2d7f0c6e4c4cf78ae1717c34990d
- SHA1 63ec5ba4f7887ca032827c0dc894a2cef40729fe
- SHA512 a3cc5860f37dea5f65283985b40558609f77c34ed21cd5dc756c9b274b67a67350dbc28bd54b6368c00c18670a100db49eedb623d56690ebf32f7952522edd06
- SSDEEP 1536:u7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjx5qkSZZZ3q:/CSjGoLpWM6bblmjx7Uq
- TLSH T1D8832855B68DB3B2D0F189B89E0DF3E5BD247E301E59185BB2AE3F0E9A771C2150C189
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\VideoLAN\VLC\vlc.exe.Exe
- Size 1.0MB
- SHA256 aa137ef9449dd8341150a4541a46da516745be896266feca968c54458221ae7f
- MD5 4ec2aad2fc262c0bbb658351a90b945c
- SHA1 befdac63c62ec18d9e46a80fb43491e4e3e48dda
- SHA512 86d6695d48c8f92e1fe350a2ad98a5c97495b624bcfc9527c9d586a775c01897bfdb8b41dcc3f1357a406c807ccce303704b4213fc86beabc3a0219690a41cac
- SSDEEP 24576:ce3xAibB85Z1HrWtB8z1L1O6J75zzz3zzzozzz3zzzzm:DxAibBEZ1LWtBzkOm
- TLSH T1AE352A1BE2AE77E9C5EFC034879EF7716E30BC5902247E2E2955D7222E10D509B2E724
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\RCXE057.tmp
- Size 75KB
- SHA256 7fca295c3c1baa9bfe2c13d3cb654cb9bd2ad15182c68f56431caf4b84d8190d
- MD5 867638bc4ffbb5b4f7731b2f48fba7a8
- SHA1 16f758ad9c4a714e159ed7c3732bca7493758176
- SHA512 7e3eb58bc3049be24bbb1cf6164d5f2af2602124f577cba837569cdf692e56bea3ff166ab37dd19c7d038831e7b4a6f3871a3482a0bfad5f687d2d7cd3a73a2a
- SSDEEP 1536:O7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxf:fCSjGoLpWM6bblmjxf
- TLSH T16E732A69B28DB772D0F299B88E0DF2E5BC287E301E19186FB69E1F0DDA771C2550C185
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$a3FA4.bat
- Size 896B
- SHA256 e770725a64611745520caaa0c7d66de2004b5c62e4e04734a67b1207eae148aa
- MD5 1e84fc0c1790cbe92820134391b5381b
- SHA1 008f288fe303f418351079a09e014963a89542e3
- SHA512 66fe51a87887460afc9c828e421d9ba664c82d4cd6757a026c934cf7282a9361014267d3e4f1177713300c5e008e20a1b708f783a446a29dc3f8692c88809f25
- TLSH T1C011E945492FDA7F0118C0AF1729E9CDDA9416646B9E23F73612D30980EA9DAAA73113
- MD5 SHA1 SHA512 TLSH
2026-05-03_0f4858dbf603dea97c96cb2e8e1e5cc2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe.exe
- Path C:\Users\Admin\AppData\Local\Temp\2026-05-03_0f4858dbf603dea97c96cb2e8e1e5cc2_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe.exe
- Size 145KB
- SHA256 03774966297dbdb9a54e120df6a59cb163a8a04688fc40b614a5121d71d5c6de
- MD5 72c421a5b756683a7c55f6b72ca8a5ef
- SHA1 96cf1e441bd9c09c26c76f886eb160450ec3d1b5
- SHA512 2b9896d8d415fee5351fead8cccce6a0763edf2208c1f741adaf959d5344122c2d41ba3d72505a948c59ea07db94c19e035237eadda8da8ed0b0af970ebb3760
- SSDEEP 1536:14HHHuCYDP1ghqBdgCisri5HIXdKGNu50PQJTeaub/psKsKjgHUngfzdiH4zWP1I:WRYZrEguStu505aYwKa8YzWP1myXC
- TLSH T185E38D2236D0C032D1A211315AB9E7B1AABAF8721D21995FB7E5172D1F707E3EA34347
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logo1_.exe
- Size 89KB
- SHA256 6840faf00aec3dbcc585bc9b8a8130965301c155b86910690d40e37f99e3df6c
- MD5 da1d82921a9cbb50bb41d0bd8482bed0
- SHA1 f3694b6d9882390c5bfb9813a31df6c535a1aa39
- SHA512 59a1e524a62f30ab8c4ca09f5176cd1222824cbc2cbd0f83c5e82bd62029d27e345ff16f26bc49ebc659920ad8b0ee17f45e665978774329ce62432e1bf93755
- SSDEEP 1536:q7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxi3EAi3x:DCSjGoLpWM6bblmjxi3EAiB
- TLSH T1D493181AB29DB372D0F25A789D1DF1E0AD3A7D702F3A441FB69D1B0D9AB61C1191C382
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 842B
- SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
- MD5 6f4adf207ef402d9ef40c6aa52ffd245
- SHA1 4b05b495619c643f02e278dede8f5b1392555a57
- SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
- TLSH T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
- MD5 SHA1 SHA512 TLSH