Analysis
- max time kernel
148s - max time network
112s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/07/2026, 23:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe
- Size 260KB
- Sample260713-3ftv4acy4x
- SHA256 13cf3222a5ed1f1baec048a8168b65e99b9d5f6067ac5e855e8ae2a4e3fe94bf
- MD5 002e7ddee6e85af8b318068d697f76c4
- SHA1 16175373c9c5770db92dd133efa8ffe713564a68
- SHA512 f18139e1de243cb0cab3997854a745d5d4e5bd158341295ecd4b0d3cd896ea732a02bd619f8f3d3c685b03afd38ab83e78ca6705662a35405e0296ed5b31d74d
- SSDEEP 3072:TPP3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTBn:jIlKgzelZNQSBQGH/CSpWqT
- TLSH T10944F1453D93C4B3E441493189E58BD18B7F6D03BAA2E15BFF990F4B5EB02884BA7361
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\G: 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\H: 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\L: 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\M: 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\I: 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\J: 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\K: 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\N: 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File opened (read-only) \??\O: 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Control Panel\Desktop\Wallpaper = "C:\\windows\\WallPapers.jpg" 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX5AA9.tmp 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX5ABA.tmp 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX5B11.tmp 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\7-Zip\7z.exe 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\dotnet\RCX5871.tmp 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX59CB.tmp 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\7-Zip\RCX581A.tmp 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\7-Zip\RCX582D.tmp 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\dotnet\dotnet.cab 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX59FE.tmp 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX5A42.tmp 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX59B8.tmp 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\7-Zip\RCX582C.tmp 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX5A53.tmp 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX5A54.tmp 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX5A97.tmp 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX59B7.tmp 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Internet Explorer\ielowutil.cab 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Internet Explorer\iexplore.cab 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX5960.tmp 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX5ADE.tmp 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX59A7.tmp 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\7-Zip\RCX5809.tmp 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\dotnet\dotnet.exe 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX5894.tmp 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX5850.tmp 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX5AA8.tmp 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX59C9.tmp 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX59EB.tmp 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX5ADC.tmp 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.cab 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX5ABB.tmp 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\7-Zip\7z.cab 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\windows\readme.1xt 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe File created C:\windows\WallPapers.jpg 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Desktop\General 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Desktop\General\WallpaperSource = "C:\\windows\\WallPapers.jpg" 2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-13_002e7ddee6e85af8b318068d697f76c4_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:4676
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 251KB
- SHA256 0a803ea78c8d57e5a65c477b18f6d43c31dd52ce4fe4bbe62fdf08a4ce0c9811
- MD5 695c8b5cf3548e2755c1ebe683fed6b0
- SHA1 c4196d7653777a7403d8f376cc1ef623fb830881
- SHA512 ed0b3580175bbcd838c974dd226f2eed0f643df8f9cc6bbbbd7484e610408d10a0ec651e9908080076b1caba1a364fdea769977dc17d650dbea9044ff341e40f
- SSDEEP 3072:7PP3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTB:bIlKgzelZNQSBQGH/CSpWqT
- TLSH T17F44F1493C93C4B3E4414D358AD58AD18BBF5D0376E2E15FFF990A4B4EB029C4AA72B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX5984.tmp
- Size 212KB
- SHA256 1cb0e2395574deb1dc777e3d322a4f9997addca09d89eec321c5000a4938d83d
- MD5 83efec8e5fcde6b09f79ab747deb6a9c
- SHA1 cef7f547edc48c3056e4cfcf51f0aae31a814bec
- SHA512 d9543728a4cc2d2c116fef0f1d8edb170e91ae0819b37fb9ef8251d2a3cb2ef67f9a789bc7e11047d259f205a19bdd9dc2ba4bc584dfec795bd680555a280fb6
- SSDEEP 3072:PPP3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTBQ:HIlKgzelZNQSBQGH/CSpWqTe
- TLSH T1A924F1453C93C4B3E4414D3589D58BD18BBF5D037AE2E15FFF990A4B5EB028C4AAB2A1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCX5A98.tmp
- Size 212KB
- SHA256 624589bf96ff9710915b90f023886fb268eb3d631e7dbd40c4fe5abcb9767649
- MD5 3bee644bf681b53daffa791d5e6f4116
- SHA1 98b403d018eec99903ac4d740480e693b694548c
- SHA512 c3784c1ee8a736ca0fbf3969949e86f0280af4e15a232f0c69ea44e1ffce2b3f3d2524ecfade569e83404203204aae82791357528a2fbe8605e135673e983be3
- SSDEEP 3072:TPP3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTBCA:jIlKgzelZNQSBQGH/CSpWqTD
- TLSH T15A24F2453C93C4B3D441493589E58BD18B7F6D037AE2E15BFF990E4B4EB02884BA73A1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe
- Size 275KB
- SHA256 076fbd0a138ad22fd74a700fea0868bcc07db36eeb7e3ef13df70eb55e820e03
- MD5 0fc7a561974871c275dc6cc3f8020e6b
- SHA1 571d8af88dadcf04d73fa117c781b5da3e56c038
- SHA512 0ac7eeac98a5e3c12089dd9a29ef4afddabd953f001a645409436c19aa710dcb5a2106fdad9d6a558a55415df2c3cf7abfc4dc49f5f5d3a2d4f6018219e59b4e
- SSDEEP 3072:TPP3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTBBUNRD5b:jIlKgzelZNQSBQGH/CSpWqT3UjD5
- TLSH T16354F1413D53C4F3D441493188A78BE18B7F6C23BAD1E10BFBA93B4BDEB12945A67294
- MD5 SHA1 SHA512 SSDEEP TLSH