Analysis
- max time kernel
149s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
11/05/2026, 01:36
Behavioral task
behavioral1
Sample
2026-05-11_9c54ca4f25040e9fa1e3cb7a68143a0a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-11_9c54ca4f25040e9fa1e3cb7a68143a0a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win11-20260130-en
windows11-21h2-x64
5 signatures
150 seconds
General
- Target 2026-05-11_9c54ca4f25040e9fa1e3cb7a68143a0a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 387KB
- Sample260511-bz74aahw8x
- SHA256 d30e5ea611993cfd1969e973ca242a94a6c33d3a32a6d3869efb6a9a936fbfb6
- MD5 9c54ca4f25040e9fa1e3cb7a68143a0a
- SHA1 78fa00eb6c9506f92d915c2bb8c521d5184842cb
- SHA512 ec580e54d8cb71401fbbda7c1f61a42adb0f7770c4cc61c4bd145f0c442987ad73ce50724d1170144b15075187430384b518668d31fa53d36482bf324cf731ed
- SSDEEP 6144:S8efQ6QPJGcLbjg0EuDK4UnUHOkb8734A2P6gt99Wvtxrpp29xQp41:76QPJGcE0hKRg04zPZt9mtPOb
- TLSH T14684BF217240C035E3A6073559A6E6F559A86E3A1394E08FF7787E795F312C39A3324F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 1028 xovuz.exe 6060 syidd.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language syidd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-11_9c54ca4f25040e9fa1e3cb7a68143a0a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xovuz.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe 6060 syidd.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3088 wrote to memory of 1028 3088 2026-05-11_9c54ca4f25040e9fa1e3cb7a68143a0a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 79 PID 3088 wrote to memory of 944 3088 2026-05-11_9c54ca4f25040e9fa1e3cb7a68143a0a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 80 PID 1028 wrote to memory of 6060 1028 xovuz.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_9c54ca4f25040e9fa1e3cb7a68143a0a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_9c54ca4f25040e9fa1e3cb7a68143a0a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\xovuz.exe"C:\Users\Admin\AppData\Local\Temp\xovuz.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\syidd.exe"C:\Users\Admin\AppData\Local\Temp\syidd.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:6060
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "2⤵
- System Location Discovery: System Language Discovery
PID:944
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
- Size 412B
- SHA256 23479eda5b474c2cdfcbce5fa3babc355483a2c964ccb1b5f6960a2ada6c1294
- MD5 8d71d0afdc615030a34cc9852863d87c
- SHA1 2c0ba1924d09ec17c44c39d754eed57575c1a4eb
- SHA512 ccbb81f69db643abf8715c2c57c81f383d7879544c36a21d990ad0f00f5e912a8f8e44e9b3e2a26fa89b7263e1f46f4c8419682f90b72e17b57d51176cb08ff3
- TLSH T197E09B42016FDE7B2108E01B0ABDB6DFC76459542EC62774AE20C3CC51DA49EB9F7146
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
- Size 512B
- SHA256 fe20fffb03fce5879f9e84988ca5481875ad32cf6a5eb197f02aef29eab04505
- MD5 ce3d90d132f5dcac6610ef6dc621ade3
- SHA1 1746e185bd6d226215fdafb3487e32aeaba20ff0
- SHA512 8c6aa6ee89f168e931cf876922c5097f1dd6f7563e14a18916acfc11cb32c4f880e0436f4671ff089fbf0f354049364001bb47d39bdf0dde0fcc70e4826df9d4
- TLSH T1B8F08CD93072B0003202FA36C2A43BA257474CDC27439E8C000932308C3686C8049321
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\syidd.exe
- Size 297KB
- SHA256 3c56d7db5fb35d0b3efe72f7ba968e7d307f246e475dc40121236f06f6d252fd
- MD5 435c351e55238ba3ae70ee6552f129c5
- SHA1 913bc07cf6024d5bfc0fd9add3ac1c0cc19478b1
- SHA512 c1cec4beb91eeae4427379a65a21239fd8418004bd9ace1d3c98bad1f0b174b00f8039eca18caca9207bdb509e4a51ad5264125cf849af206dcbe08ef4a3279f
- SSDEEP 6144:nzCnkGXC4JfDu67rIULCFVugtxvIKsAHp22:nzK9fJru+IU+F6KsAM2
- TLSH T151547B1076508076E72A07710556EAF40AA8AE3917E4E48FF7787E392E312D39B7724F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\xovuz.exe
- Size 387KB
- SHA256 d575569bdd8d8ae912a5417137f129f2bfeae6594b044837cb8484c19222696a
- MD5 6c134bad59182159ca60a07414423f51
- SHA1 18baeb530d6220da0af1b82869ff8568f82b9d36
- SHA512 4f3d151183a5d4eef5e292615ddb25b7b46fc01d3ede7561d715831f75cffe819ad1846894cf96d708a28e0e558c3ad6c9a09de718e9b73d456b898b38414a78
- SSDEEP 6144:S8efQ6QPJGcLbjg0EuDK4UnUHOkb8734A2P6gt99Wvtxrpp29xQp4Z:76QPJGcE0hKRg04zPZt9mtPOP
- TLSH T1C384BF217240C035E3A6073559A6E6F559A86E3A1394E08FF7787E795F312C39A3324F
- MD5 SHA1 SHA512 SSDEEP TLSH