Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/05/2026, 01:36
Behavioral task
behavioral1
Sample
2026-05-11_9c54ca4f25040e9fa1e3cb7a68143a0a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-11_9c54ca4f25040e9fa1e3cb7a68143a0a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win11-20260130-en
windows11-21h2-x64
5 signatures
150 seconds
General
- Target 2026-05-11_9c54ca4f25040e9fa1e3cb7a68143a0a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 387KB
- Sample260511-bz74aahw8x
- SHA256 d30e5ea611993cfd1969e973ca242a94a6c33d3a32a6d3869efb6a9a936fbfb6
- MD5 9c54ca4f25040e9fa1e3cb7a68143a0a
- SHA1 78fa00eb6c9506f92d915c2bb8c521d5184842cb
- SHA512 ec580e54d8cb71401fbbda7c1f61a42adb0f7770c4cc61c4bd145f0c442987ad73ce50724d1170144b15075187430384b518668d31fa53d36482bf324cf731ed
- SSDEEP 6144:S8efQ6QPJGcLbjg0EuDK4UnUHOkb8734A2P6gt99Wvtxrpp29xQp41:76QPJGcE0hKRg04zPZt9mtPOb
- TLSH T14684BF217240C035E3A6073559A6E6F559A86E3A1394E08FF7787E795F312C39A3324F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\International\Geo\Nation biije.exe Key value queried \REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\International\Geo\Nation 2026-05-11_9c54ca4f25040e9fa1e3cb7a68143a0a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe - Executes dropped EXE 2 IoCs
pid Process 4692 biije.exe 5788 sifod.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language biije.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sifod.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-11_9c54ca4f25040e9fa1e3cb7a68143a0a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe 5788 sifod.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4200 wrote to memory of 4692 4200 2026-05-11_9c54ca4f25040e9fa1e3cb7a68143a0a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 84 PID 4200 wrote to memory of 4196 4200 2026-05-11_9c54ca4f25040e9fa1e3cb7a68143a0a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 85 PID 4692 wrote to memory of 5788 4692 biije.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_9c54ca4f25040e9fa1e3cb7a68143a0a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_9c54ca4f25040e9fa1e3cb7a68143a0a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\biije.exe"C:\Users\Admin\AppData\Local\Temp\biije.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\sifod.exe"C:\Users\Admin\AppData\Local\Temp\sifod.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5788
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "2⤵
- System Location Discovery: System Language Discovery
PID:4196
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
- Size 412B
- SHA256 23479eda5b474c2cdfcbce5fa3babc355483a2c964ccb1b5f6960a2ada6c1294
- MD5 8d71d0afdc615030a34cc9852863d87c
- SHA1 2c0ba1924d09ec17c44c39d754eed57575c1a4eb
- SHA512 ccbb81f69db643abf8715c2c57c81f383d7879544c36a21d990ad0f00f5e912a8f8e44e9b3e2a26fa89b7263e1f46f4c8419682f90b72e17b57d51176cb08ff3
- TLSH T197E09B42016FDE7B2108E01B0ABDB6DFC76459542EC62774AE20C3CC51DA49EB9F7146
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\biije.exe
- Size 387KB
- SHA256 f80750fdeaf99e68f303a36717398bb5e00464d9a705a1a7075cbef0e661ca66
- MD5 0329183c643b8610361fd71f8542c595
- SHA1 a682f14e9b5fd88b3ae3601e871620d1ace5f2b6
- SHA512 f2be8846a6724d6fe33f56ead8b48dc63ec77b5460dec320f6c69d017c83a2cb0b617d55b97630b2c97766de381e5658d55658f91d0ba0b3e610c2a225ea88aa
- SSDEEP 6144:S8efQ6QPJGcLbjg0EuDK4UnUHOkb8734A2P6gt99Wvtxrpp29xQp4K:76QPJGcE0hKRg04zPZt9mtPOM
- TLSH T15284BF217240C035E3A6073559A6E6F559A86E3A1394E08FF7787E795F312C39A3324F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
- Size 512B
- SHA256 467cac7a19375df9531fe36d0b0b6349ad880b683c4c3821f952e9d3c50919a3
- MD5 19644f1b5f66843a8ec896b8016f25d3
- SHA1 466ad5abd7a3bc1dcd5dcee2aa4a561da1841267
- SHA512 5854c16d00b75e6fea64ef6b1dd3fec2bdc93b81b3a229b9c2362bfd2f15de295123c02bee62e1ae80da2a3114109102eba95830782e23bae8d44f955c84a3ae
- TLSH T153F02BC210F0F0103703F106C3453F53A3930D8806D38C80400872704C328AC40D4160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\sifod.exe
- Size 297KB
- SHA256 0dd52c06b678a3bde206731d0622fc3aef67c7ce3a25dd12bc145fb46ef2041d
- MD5 cc340bb2aac995de7b8e0582722744cb
- SHA1 593cae0dba09c3d404f33f5d132810d4a87cf572
- SHA512 ad5ef3f1a4f8bdd097977ee149a107d2dddf700ce741692f4baeda6d54501829b6f2a542abc8d3e52e1f9f4ea41d64114b21438c9463e5b0f8eed3a2bac1261e
- SSDEEP 6144:nzCnkGXC4JfDu67rIULCFVugtxvIKsAHp2J:nzK9fJru+IU+F6KsAMJ
- TLSH T176547B1076508076E72A07710556EBF40AA8AE3916E4E48FF7787E392E312D39B7724F
- MD5 SHA1 SHA512 SSDEEP TLSH