Analysis
- max time kernel
149s - max time network
104s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/07/2026, 22:10
Behavioral task
behavioral1
Sample
2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe
- Size 704KB
- Sample260710-13rcdacs2l
- SHA256 f1f1e0c7bbec5a83c1a897ecc23389cd888538338a0b2ac8041e146252208780
- MD5 a9edfcbb5c9af3995d9ee6e9d883df93
- SHA1 50efd6478fb46bf3e94ba93157ef82bc319cadd9
- SHA512 66cb1eb4ef46d2a9a947f0274cc906c948c61a7f00bcb8fc3ecec0e43d8e603a7a549add58d251dd1f9733e5f07e042ded976c7ae87c697d86231bfc8e710fd5
- SSDEEP 12288:SflGXd4OvXkLGKUAFQl7P4UAFQl7P7qZytzSKyfWCBYgoHAAHpI:S9GmA09v/yhyufHBI
- TLSH T1FAE4B6C53584C221E451717CBAF46DE586A174E263B13ECBFED038941663BC6BD3A32A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 1 IoCs
resource yara_rule behavioral2/files/0x0008000000016b4d-4.dat family_shodi - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\UsaShohdi.asu 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification C:\Windows\SysWOW64\UsaShohdi.asu 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.usa 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files\7-Zip\7zFM.exe 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.usa 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\SETLANG.usa 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.usa 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.usa 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.usa 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSQRY32.usa 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.usa 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.usa 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.usa 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.usa 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\SELFCERT.usa 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files\Mozilla Firefox\private_browsing.exe 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.usa 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\crashreporter.usa 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\default-browser-agent.usa 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.usa 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jconsole.usa 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.usa 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.usa 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.usa 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.usa 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\javaws.usa 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSOUC.usa 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ONENOTEM.usa 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.usa 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files\VideoLAN\VLC\vlc.usa 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.usa 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files\Google\Chrome\Application\chrome.exe 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.usa 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.usa 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\WORDICON.usa 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.usa 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 2080 2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-10_a9edfcbb5c9af3995d9ee6e9d883df93_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
PID:2080
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\UsaShohdi.asu
- Size 704KB
- SHA256 b60d17974b11284cbce1da8b2fbf2c9a90e64cc2945430586607fec75c6c23c2
- MD5 094047762cb4e0db6a62268112b0ed6d
- SHA1 93f17d8f3bff99895dd6c85b47ab430576dc3e8e
- SHA512 2eb60122e6a0ec26517f2f705c511dfa928bf5380208deba5b2ed0d7c96199783e5b74f8356ac15cfc3a830ea48beaa299d435eeaff54e2752741d94a3d898e7
- SSDEEP 12288:iflGXd4OvXkLGKUAFQl7P4UAFQl7P7qZytzSKyfWCBYgoHAAHpI:i9GmA09v/yhyufHBI
- TLSH T135E4B6C53584C221E451717CBAF46DE586A170E263B17ECBFED038941663BC6BD3A32A
- MD5 SHA1 SHA512 SSDEEP TLSH