c2f7a804dc562e53bc5fde1639542b1f2f2795cfc56fb8b2eeeb24e08eee7d42

General

Target
2026-07-12_015cabde72edbc75435ae508d050633d_elex_mafia_rhadamanthys_smoke-loader_stop.exe
Size 1.2MB
Sample260712-wty9eahs2s
SHA256 c2f7a804dc562e53bc5fde1639542b1f2f2795cfc56fb8b2eeeb24e08eee7d42
MD5 015cabde72edbc75435ae508d050633d
SHA1 5671bf9beb6c36f04049a004904fa1bdc7c38c63
SHA512 e015afb040fcdb298bcdd9357de25bced8e0323a73f13e7fe9a2035e8b7af578ffedba112a40f9d941e564f0b554a876d0fc770df2f98328c6198b4a708a46c9
SSDEEP 24576:tEfCvka3NXbi3Xi6kgaINVRX/diX2n0e435qkLeI+t2r48WabGOjbvD/+XbdeXc0:CfCL923XiTcNjPdiGnT65qkYt2r48Wa7
TLSH
T19D45F1113DEFCC76E39300318A36F6A665A4F1AA3B1304D793D4077AEE397C4462B699
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2064	tmppack.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3452	3276	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-12_015cabde72edbc75435ae508d050633d_elex_mafia_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmppack.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	2026-07-12_015cabde72edbc75435ae508d050633d_elex_mafia_rhadamanthys_smoke-loader_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	2026-07-12_015cabde72edbc75435ae508d050633d_elex_mafia_rhadamanthys_smoke-loader_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\IESettingSync	2026-07-12_015cabde72edbc75435ae508d050633d_elex_mafia_rhadamanthys_smoke-loader_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	2026-07-12_015cabde72edbc75435ae508d050633d_elex_mafia_rhadamanthys_smoke-loader_stop.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3276	2026-07-12_015cabde72edbc75435ae508d050633d_elex_mafia_rhadamanthys_smoke-loader_stop.exe
3276	2026-07-12_015cabde72edbc75435ae508d050633d_elex_mafia_rhadamanthys_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3276 wrote to memory of 2064	3276	2026-07-12_015cabde72edbc75435ae508d050633d_elex_mafia_rhadamanthys_smoke-loader_stop.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-12_015cabde72edbc75435ae508d050633d_elex_mafia_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_015cabde72edbc75435ae508d050633d_elex_mafia_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3276
- C:\Users\Admin\AppData\Local\Temp\COOAMDYPKR\tmppack.exe
  -y
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 8640
  2⤵
  - Program crash
  PID:3452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3276 -ip 3276
1⤵
PID:112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

installer.pak

Path C:\Users\Admin\AppData\Local\Temp\COOAMDYPKR\installer.pak
Size 1.6MB
SHA256 c4dcc3e35bc35dcbcef87223eb3555de374c2e25b48fde984eb7edd18ba89c79
MD5 858a3300bc5955dc77eb4e9df137bbca
SHA1 2b21ff580d19cfbfa7668e5f3572758e17cd18d5
SHA512 dd67930bef3c60695e53b1c6e8f211042154d9971e00c03ef302b5f42ac88dfe055cd4b9a7a5170edd1caacd74688f1ed144e57d69d5dd62708826ebd729a36d
SSDEEP 24576:2NVujhEgPNDZnk+IuDPNVkl33BkGZYBfCnWX5ofKuw1y1WIlMIR9:iAmgPNNk+ISFAu3fCc5ofg1yZ
TLSH
T173759EF0E7AD8BD37B64BD42BB91311256178AAF49009A311E696CCF97F33A134026D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmppack.exe

Path C:\Users\Admin\AppData\Local\Temp\COOAMDYPKR\tmppack.exe
Size 718KB
SHA256 e1d31f8bceee54e4e53ba3e876adc8758c82678cc3e7052b1f56dee6fd4fc099
MD5 07132df56fcc549cdb764a5030221f70
SHA1 e3ad21a65c5d1511571dda82ac75050ebebe1390
SHA512 77977fb6f869903fd9c67d5c796211e0c0c21bb8b9457e733e42c8fedae4fb5d32eb19b26c8bb9d4a9a462c268f4f8dd3577e6c48cb370b650036427a58fce82
SSDEEP 12288:3XikbkgaISKVRXGt95u8i7xdio4P2nwEqe435WtkZp/EvCn5wt2r4fUWq:3Xi6kgaINVRX/diX2n0e435qkLeI+t2v
TLSH
T14AF402113EE5C476E2430931DF91BBF1F1D9D32C4F22489363984B2E2E7D689D62AA1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FindamoNA.html

Path C:\Users\Admin\AppData\Local\Temp\xvhi0u2w\gui\FindamoNA.html
Size 4KB
SHA256 1fffd3022595c8203e335c7f53b6b3bebd0ceff4eb3e4b337c2020b7eb802ed7
MD5 027b29b2b69fa520cc94482b9c3859da
SHA1 66643ed38c19d3f381af1a1f9499f10c7b109f54
SHA512 43331d6e1e758bb81035e3521e779e8900998683d494fbe74ecb07750215e12a6e30179ab5ef4d149c7c5e2eeb6ba2699915aa22e8ce1785e1f7f7634947baa3
SSDEEP 96:z2qsvcPp9mc2zWrhcjugAa1QDQxZ1jgoM8aCfCoG:zvhKWrhPTa6ORlM8aCfCJ
TLSH
T177A1A668BD4ED92642330286D0B6ABAD608FD73AE321CC11F2E9027723C7E85D947199
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cav.xml

Path C:\Users\Admin\AppData\Local\Temp\xvhi0u2w\gui\events\cav.xml
Size 1KB
SHA256 c3516b0b9038ce1a8880f92c0f9c4c5a55a6e032657566d06c351248bf37dc8d
MD5 0a396dc280db5266f43e244cb9c7d0f6
SHA1 8c92c353dd7d5b3fc85e2c684fbced5316ec1930
SHA512 56faab16e15acc6437119caa3af77bd83b07ca9151be3924fdc295c745485f2bdc56f01d23f8a5ff4278fc5560ceacc8ac97572f5c0be548d648c0ca8cbb885d
TLSH
T16B314E421CB62992BBEA43E15F93472BE12131F97AB5E18C41109357FA0E1A45DF8F07
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3276-8-0x0000000002710000-0x00000000028AF000-memory.dmp

Download

memory/3276-12-0x0000000002710000-0x00000000028AF000-memory.dmp

Download

memory/3276-76-0x0000000002B80000-0x0000000002B81000-memory.dmp

Download

memory/3276-132-0x0000000002710000-0x00000000028AF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads