efce397893171cbd0cf401c8fbf69507c5d3600edcff257e8a1bbfa39427cd8b

Analysis

max time kernel
148s
max time network
82s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 11:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-03_f4f8bdbe524338a31ee30bdacd3fde6b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 1.0MB
Sample260703-m4ccyscw5k
SHA256 efce397893171cbd0cf401c8fbf69507c5d3600edcff257e8a1bbfa39427cd8b
MD5 f4f8bdbe524338a31ee30bdacd3fde6b
SHA1 8b9c1c1ff294b230aac04bd070cb171396e9c662
SHA512 6ed237fb0d1ccfdd142c716061ffcb1bd5097009d66bd18a20c26710656550b24c2faaa75bc9a198d593d0d793bfd6f004ac17d62122965e3426bf2a20a75673
SSDEEP 12288:EAW0LyGgGvWhK1g0iDutUi9niuBahyqDC8hph1Dn2FGvZe4OUW:El0LyGgGGEtV8Fp2FGvZe4O
TLSH
T19F25BF21B640E02AE49714B25DEFC7A966287F74071D20D3B2D07FDE29B16E26F32617
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5776	pApNm00000.exe

Executes dropped EXE 2 IoCs

pid	Process
5776	pApNm00000.exe
6212	pApNm00000.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\pApNm00000 = "C:\\ProgramData\\pApNm00000\\pApNm00000.exe"	pApNm00000.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-03_f4f8bdbe524338a31ee30bdacd3fde6b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pApNm00000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pApNm00000.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5776	pApNm00000.exe
Token: SeDebugPrivilege	6212	pApNm00000.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5776	pApNm00000.exe
5776	pApNm00000.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
5776	pApNm00000.exe
5776	pApNm00000.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5776	pApNm00000.exe
5776	pApNm00000.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5532 wrote to memory of 5776	5532	2026-07-03_f4f8bdbe524338a31ee30bdacd3fde6b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-03_f4f8bdbe524338a31ee30bdacd3fde6b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-03_f4f8bdbe524338a31ee30bdacd3fde6b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5532
- C:\ProgramData\pApNm00000\pApNm00000.exe
  "C:\ProgramData\pApNm00000\pApNm00000.exe" "C:\Users\Admin\AppData\Local\Temp\2026-07-03_f4f8bdbe524338a31ee30bdacd3fde6b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5776

C:\ProgramData\pApNm00000\pApNm00000.exe
C:\ProgramData\pApNm00000\pApNm00000.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:6212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

pApNm00000

Path C:\ProgramData\pApNm00000\pApNm00000
Size 104B
SHA256 2fb65369c0b99d12bcf274d182a46ce07077412dedec04c6407e1a2869f0b0ac
MD5 838365105e7db70dec494d1cb78cfe76
SHA1 321027e6615c69a618d34e98bf469ae72c682b48
SHA512 4f8beeb6fc21e2478252d64109f9491946ce789d347f789aa87a4515c518d4ed80bc73876e9bfcfae96bc16708e5643f06b0cd89f2b695581672b1998100df53
TLSH
T1CEB0120130C76B44605EB5116A74004E6485A6D95F69004040997AB7EAD14180F54339
MD5 SHA1 SHA512 TLSH

Submit Download

pApNm00000.exe

Path C:\ProgramData\pApNm00000\pApNm00000.exe
Size 1.0MB
SHA256 c84cf44b3b15db20fd657a07012035aa17fa786cabeeab84923fbd692dbff661
MD5 cd8f709a0abb0656519d96999463503b
SHA1 3eda195911dc53afcf79ca56b8b4528e5437be4d
SHA512 4662da97dba7f580e0b49a25c19ba46620988b7f40b12f32de609317e2ca3efd1587f1c434c24e6c49bbadca2667ea1b9c09b054239e414d6c5fa80608b1de7d
SSDEEP 12288:pAW0LyGgGvWhK1g0iDutUi9niuBahyqDC8hph1Dn2FGvZe4OUW:pl0LyGgGGEtV8Fp2FGvZe4O
TLSH
T1C825BF21B640E02AE49714B25DEFC7A966287F74071D20D3B2D07FDE29B16E26F32617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5532-0-0x0000000000597000-0x0000000000598000-memory.dmp

Download

memory/5776-9-0x0000000000FA7000-0x0000000000FA8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads