8ba5bdd8861af4a5ab99ada3b4d17678e0661d905f8eb6cde278d5fab7f04c7a

General

Target
2026-06-02_0d0c42ae831bde029a635113693b0243_amadey_elex_maze_rhadamanthys_smoke-loader_stealc_stop.exe
Size 155KB
Sample260602-nedp6acy4n
SHA256 8ba5bdd8861af4a5ab99ada3b4d17678e0661d905f8eb6cde278d5fab7f04c7a
MD5 0d0c42ae831bde029a635113693b0243
SHA1 fe7ac5bc15385d22df5a195165d312e4ef782ec1
SHA512 719e4e1f0b8412b42e8f9574e3b8f749d79b8c940d6c893461c84405f7369974edf9aa175d4c256fe228653c021049e901873db30b5f03f2fd98b2b2dc791029
SSDEEP 1536:2gPt0KClIhV0u7XnUNORgvshmnXxc5B5bbagFwHh+zX5q2AVykPzum6CFIeFCqm3:dhV0rNOUU/0GoRyGrC+hMPz+TLdABHX
TLSH
T112F39D0636D0C071EAE7023209B89B66597DFD714B708DD7B7984B0E6DB06C0AB36B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery trojan

Malware Config

Signatures

Custom signature

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000200000002a903-3.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Downloads MZ/PE file 1 IoCs

flow	pid	Process
2	5132	2026-06-02_0d0c42ae831bde029a635113693b0243_amadey_elex_maze_rhadamanthys_smoke-loader_stealc_stop.exe

Executes dropped EXE 1 IoCs

pid	Process
4728	lrunner.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lrunner.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-02_0d0c42ae831bde029a635113693b0243_amadey_elex_maze_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lrunner.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4728	lrunner.exe
4728	lrunner.exe
4728	lrunner.exe
4728	lrunner.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5132 wrote to memory of 4728	5132	2026-06-02_0d0c42ae831bde029a635113693b0243_amadey_elex_maze_rhadamanthys_smoke-loader_stealc_stop.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-06-02_0d0c42ae831bde029a635113693b0243_amadey_elex_maze_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_0d0c42ae831bde029a635113693b0243_amadey_elex_maze_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5132
- C:\Users\Admin\AppData\Local\Temp\ln240631546\lrunner.exe
  "C:\Users\Admin\AppData\Local\Temp\\ln240631546\lrunner.exe" --bpl="eyJjbGlfdmVyIjogMiwgImluc3RhbGxfdXJsIjogImh0dHBzOi8vZ29zb2Z0ZGwubWFpbC5ydS9zd2l0Y2hlcl9wZF8zXzkuZXhlIiwgImxvY2F0aW9uX2lkIjogImxhbmRfcGFydG5lciIsICJxdWVyeV9zdHJpbmciOiAicGFydG5lcmlkPTgxMTEyMyZhbWlnb19pbnN0YWxsPTEmYW1fZGVmYXVsdD0xJnZibV9pbnN0YWxsPTEmaHBfaW5zdGFsbD0xJmRzZV9pbnN0YWxsPTEmcnRiX2luc3RhbGw9MSZleHRfcGF5X2Jyb3dzZXJfY2xhc3M9MCZleHRfcGFydG5lcmlkPXJ0Yi4xJTNBODMxMTM0JTJDZHNlLjElM0E4MTEwNzIlMkNkc2UuMiUzQTgxMTEwMiUyQ2hwLjElM0E4MTEwNjIlMkNocC4yJTNBODExMDkyJTJDdmJtLjElM0E4MTEwODIlMkN2Ym0uMiUzQTgxMTExMiUyQ3B1bHQuMSUzQTgxMTA4MiUyQ3B1bHQuMiUzQTgxMTExMiUyQ2FueS4xJTNBODExMDUyJTJDYW55LjIlM0E4MTEwNTYmcGFydG5lcl9uZXdfdXJsPWh0dHAlM0ElMkYlMkZwYi5teS1hbWlnby1tYWlsLmluZm8lMkZtYWlsLXJ1JTNGdHJhbnNhY3RJZCUzRDI4Mzc3ODcyJTI2b3ZyJTNEJTI0X19PVlIlMjZzaWclM0QlMjRfX1NJRyUyNmd1aWQlM0QlMjRfX0dVSUQlMjZtb2RlJTNEJTI0X19UWVBFJTI2dHlwZSUzRGFtaWdvJmV4dF9pbnN0YWxsX2NhbGxiYWNrPWh0dHAlM0ElMkYlMkZwYi5teS1hbWlnby1tYWlsLmluZm8lMkZtYWlsLXJ1LW5ldyUzRnRyYW5zYWN0SWQlM0QyODM3Nzg3MiUyNmJyb3dzZXIlM0QlN0Jicm93c2VyJTdEJTI2Z3VpZCUzRCU3Qmd1aWQlN0QlMjZwYWlkJTNEJTdCcGFpZCU3RCUyNnBhaWRCcm93c2VyJTNEJTdCcGFpZEJyb3dzZXIlN0QlMjZpbnN0YWxsZWQlM0QlN0JwYWlkQWN0aW9uJTdEJTI2aW5zdGFsbEJyb3dzZXJDbGFzcyUzRCU3Qmluc3RhbGxCcm93c2VyQ2xhc3MlN0QlMjZwYXlCcm93c2VyQ2xhc3MlM0QlN0JwYXlCcm93c2VyQ2xhc3MlN0QlMjZyZWFzb24lM0QlN0J1bnBhaWRBY3Rpb25SZWFzb24lN0QlMjZickNsYXNzMSUzRCU3QmJyb3dzZXJDbGFzczElN0QlMjZickNsYXNzMiUzRCU3QmJyb3dzZXJDbGFzczIlN0QlMjZ0eXBlJTNEJTdCY29tcG9uZW50JTdEJmV4dF9vbmxpbmVfY2FsbGJhY2s9aHR0cCUzQSUyRiUyRnBiLm15LWFtaWdvLW1haWwuaW5mbyUyRm1haWwtcnUtbmV3JTJGb25saW5lJTNGdHJhbnNhY3RJZCUzRDI4Mzc3ODcyJTI2YnJvd3NlciUzRCU3QmJyb3dzZXIlN0QlMjZndWlkJTNEJTdCaW5zdGFsbElkJTdEJTI2cGFpZCUzRCU3QnBhaWQlN0QlMjZickNsYXNzMSUzRCU3QmJyb3dzZXJDbGFzczElN0QlMjZickNsYXNzMiUzRCU3QmJyb3dzZXJDbGFzczIlN0QlMjZtYXJrJTNEJTdCcmZyJTdEJTI2dHlwZSUzRCU3QmNvbXBvbmVudCU3RCIsICJ0cyI6IDE1MTkyMjYzMDR9"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Id

Path C:\ProgramData\Mail.Ru\Id
Size 38B
SHA256 32693f25154c642092396577b93ce3ec4f87fc9e49e88f868ba3dfaea8cb75b4
MD5 151822273bd79433c89f31b1f9a149d6
SHA1 573e68eaef90c3bfd353bc672b164861bb3fa869
SHA512 66217584892c7a20d113fab166940823f26bac7cdba1e1dda6b1ac71b8b6997bb0606045b9ab47ba9cda7be1a0369c5f326337a226fbc2c59e46cebbf3d03f75
MD5 SHA1 SHA512

Submit Download

lrunner.exe

Path C:\Users\Admin\AppData\Local\Temp\ln240631546\lrunner.exe
Size 1.9MB
SHA256 8dca302c817de6eab1783ed87139cbe2c0da2be2ccc077cabac12ac3237dab91
MD5 59ec4314e2a54053778d3862368d639c
SHA1 a6e7e4383d2a49460f90f46d81bf31260fb71a50
SHA512 48ec36e24c66df5951a35ff366aa80b70aef005119438e1a97dcc81b21e726a4f1eb7e9000026a75811e1fd7ef51255df28647b30140d136af223acf4e968834
SSDEEP 49152:c3LvUeQjx23t6DNp5z09LTIuQVqm4hkPlQqKLczrngrXGCsc4MpEod7VWopEIx:KmCxLTIuQlGknzrngrzD
TLSH
T1AF959D21F7C0C13AE5E201F29A6C5B7A487DBA60072944D7E3C81E5D2A709D3AB3775B
MD5 SHA1 SHA512 SSDEEP TLSH