Analysis
- max time kernel
122s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/07/2026, 03:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
29 signatures
150 seconds
General
- Target 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe
- Size 472KB
- Sample260730-d8bsjsbc37
- SHA256 36f6b04de2e49f348f7922e2484c2dd275d5895845d6758761099983c3a76771
- MD5 38e4c77d4b7887ca08cd2666ef42634a
- SHA1 1ce4cfc2183981603aad44320bcdaed9411dfb90
- SHA512 653cd388d98ca986a8b0ecfc7f905e48380d815170c3502b584f7522374b48f9ae95ab77a443725f878c1fec86241891dbc1ced45d3a21e2466c5e967291e4ca
- SSDEEP 6144:PgyLEbWaR5Cch2gg649gxaNWcUkvDDDDoVmkjx2Xym/Raw:YUaWaR5v0ggh9gsWrkgVYi1w
- TLSH T155A4F110FB50D43CF5C681FABBF6DBFE64299F24039421C7A3C8955B17384D26A3668A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
-
http://www.klkjwre9fqwieluoi.info/
-
http://kukutrustnet777888.info/
Extracted
Family
-
gh0strat
C2
-
127.0.0.1
Extracted
Family
-
bdaejec
C2
-
ddos.dnsnb8.net
Signatures
- Detects Bdaejec Backdoor. 2 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral1/memory/5012-21-0x00000000001B0000-0x00000000001B9000-memory.dmp family_bdaejec_backdoor behavioral1/memory/5012-45-0x00000000001B0000-0x00000000001B9000-memory.dmp family_bdaejec_backdoor - Gh0st RAT payload 3 IoCs
resource yara_rule behavioral1/memory/1864-26-0x0000000010000000-0x0000000010015000-memory.dmp family_gh0strat behavioral1/memory/3296-63-0x0000000000400000-0x0000000000478000-memory.dmp family_gh0strat behavioral1/memory/1864-58-0x0000000000400000-0x0000000000478000-memory.dmp family_gh0strat - Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe - UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe - Windows security bypass 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe - Detects executables packed with ASPack 3 IoCs
resource yara_rule behavioral1/files/0x0005000000023208-8.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/5012-21-0x00000000001B0000-0x00000000001B9000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/5012-45-0x00000000001B0000-0x00000000001B9000-memory.dmp INDICATOR_EXE_Packed_ASPack - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 39 IoCs
resource yara_rule behavioral1/memory/1864-6-0x00000000008B0000-0x000000000193E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1864-7-0x00000000008B0000-0x000000000193E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1864-15-0x00000000008B0000-0x000000000193E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1864-20-0x00000000008B0000-0x000000000193E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1864-13-0x00000000008B0000-0x000000000193E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1864-10-0x00000000008B0000-0x000000000193E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1864-12-0x00000000008B0000-0x000000000193E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1864-9-0x00000000008B0000-0x000000000193E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1864-14-0x00000000008B0000-0x000000000193E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1864-37-0x00000000008B0000-0x000000000193E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1864-38-0x00000000008B0000-0x000000000193E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1864-39-0x00000000008B0000-0x000000000193E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1864-40-0x00000000008B0000-0x000000000193E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1864-41-0x00000000008B0000-0x000000000193E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1864-64-0x00000000008B0000-0x000000000193E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1864-65-0x00000000008B0000-0x000000000193E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1864-67-0x00000000008B0000-0x000000000193E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1864-70-0x00000000008B0000-0x000000000193E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1864-72-0x00000000008B0000-0x000000000193E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1864-78-0x00000000008B0000-0x000000000193E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1864-86-0x00000000008B0000-0x000000000193E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1864-88-0x00000000008B0000-0x000000000193E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1864-92-0x00000000008B0000-0x000000000193E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1864-94-0x00000000008B0000-0x000000000193E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1864-95-0x00000000008B0000-0x000000000193E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1864-99-0x00000000008B0000-0x000000000193E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1864-100-0x00000000008B0000-0x000000000193E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1864-102-0x00000000008B0000-0x000000000193E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1864-107-0x00000000008B0000-0x000000000193E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1864-109-0x00000000008B0000-0x000000000193E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1864-110-0x00000000008B0000-0x000000000193E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1864-113-0x00000000008B0000-0x000000000193E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1864-115-0x00000000008B0000-0x000000000193E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1864-117-0x00000000008B0000-0x000000000193E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1864-118-0x00000000008B0000-0x000000000193E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1864-121-0x00000000008B0000-0x000000000193E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1864-122-0x00000000008B0000-0x000000000193E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1864-123-0x00000000008B0000-0x000000000193E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/files/0x000200000001e72d-126.dat INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 41 IoCs
resource yara_rule behavioral1/memory/1864-6-0x00000000008B0000-0x000000000193E000-memory.dmp UPX behavioral1/memory/1864-7-0x00000000008B0000-0x000000000193E000-memory.dmp UPX behavioral1/memory/1864-15-0x00000000008B0000-0x000000000193E000-memory.dmp UPX behavioral1/memory/1864-20-0x00000000008B0000-0x000000000193E000-memory.dmp UPX behavioral1/memory/1864-13-0x00000000008B0000-0x000000000193E000-memory.dmp UPX behavioral1/memory/1864-10-0x00000000008B0000-0x000000000193E000-memory.dmp UPX behavioral1/memory/1864-12-0x00000000008B0000-0x000000000193E000-memory.dmp UPX behavioral1/memory/1864-9-0x00000000008B0000-0x000000000193E000-memory.dmp UPX behavioral1/memory/1864-14-0x00000000008B0000-0x000000000193E000-memory.dmp UPX behavioral1/memory/1864-37-0x00000000008B0000-0x000000000193E000-memory.dmp UPX behavioral1/memory/1864-38-0x00000000008B0000-0x000000000193E000-memory.dmp UPX behavioral1/memory/1864-39-0x00000000008B0000-0x000000000193E000-memory.dmp UPX behavioral1/memory/1864-40-0x00000000008B0000-0x000000000193E000-memory.dmp UPX behavioral1/memory/3296-43-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/memory/1864-41-0x00000000008B0000-0x000000000193E000-memory.dmp UPX behavioral1/memory/3296-63-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/memory/1864-58-0x0000000000400000-0x0000000000478000-memory.dmp UPX behavioral1/memory/1864-64-0x00000000008B0000-0x000000000193E000-memory.dmp UPX behavioral1/memory/1864-65-0x00000000008B0000-0x000000000193E000-memory.dmp UPX behavioral1/memory/1864-67-0x00000000008B0000-0x000000000193E000-memory.dmp UPX behavioral1/memory/1864-70-0x00000000008B0000-0x000000000193E000-memory.dmp UPX behavioral1/memory/1864-72-0x00000000008B0000-0x000000000193E000-memory.dmp UPX behavioral1/memory/1864-78-0x00000000008B0000-0x000000000193E000-memory.dmp UPX behavioral1/memory/1864-86-0x00000000008B0000-0x000000000193E000-memory.dmp UPX behavioral1/memory/1864-88-0x00000000008B0000-0x000000000193E000-memory.dmp UPX behavioral1/memory/1864-92-0x00000000008B0000-0x000000000193E000-memory.dmp UPX behavioral1/memory/1864-94-0x00000000008B0000-0x000000000193E000-memory.dmp UPX behavioral1/memory/1864-95-0x00000000008B0000-0x000000000193E000-memory.dmp UPX behavioral1/memory/1864-99-0x00000000008B0000-0x000000000193E000-memory.dmp UPX behavioral1/memory/1864-100-0x00000000008B0000-0x000000000193E000-memory.dmp UPX behavioral1/memory/1864-102-0x00000000008B0000-0x000000000193E000-memory.dmp UPX behavioral1/memory/1864-107-0x00000000008B0000-0x000000000193E000-memory.dmp UPX behavioral1/memory/1864-109-0x00000000008B0000-0x000000000193E000-memory.dmp UPX behavioral1/memory/1864-110-0x00000000008B0000-0x000000000193E000-memory.dmp UPX behavioral1/memory/1864-113-0x00000000008B0000-0x000000000193E000-memory.dmp UPX behavioral1/memory/1864-115-0x00000000008B0000-0x000000000193E000-memory.dmp UPX behavioral1/memory/1864-117-0x00000000008B0000-0x000000000193E000-memory.dmp UPX behavioral1/memory/1864-118-0x00000000008B0000-0x000000000193E000-memory.dmp UPX behavioral1/memory/1864-121-0x00000000008B0000-0x000000000193E000-memory.dmp UPX behavioral1/memory/1864-122-0x00000000008B0000-0x000000000193E000-memory.dmp UPX behavioral1/memory/1864-123-0x00000000008B0000-0x000000000193E000-memory.dmp UPX -
resource yara_rule behavioral1/files/0x0005000000023208-8.dat aspack_v212_v242 - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation wEVxmJ.exe - Executes dropped EXE 2 IoCs
pid Process 5012 wEVxmJ.exe 3296 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe - Windows security modification 2 TTPs 7 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe" 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe" 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe File opened (read-only) \??\S: 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe File opened (read-only) \??\W: 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe File opened (read-only) \??\Y: 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe File opened (read-only) \??\E: 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe File opened (read-only) \??\G: 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe File opened (read-only) \??\O: 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe File opened (read-only) \??\P: 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe File opened (read-only) \??\U: 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe File opened (read-only) \??\X: 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe File opened (read-only) \??\Z: 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe File opened (read-only) \??\J: 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe File opened (read-only) \??\L: 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe File opened (read-only) \??\N: 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe File opened (read-only) \??\Q: 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe File opened (read-only) \??\T: 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe File opened (read-only) \??\H: 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe File opened (read-only) \??\I: 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe File opened (read-only) \??\K: 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe File opened (read-only) \??\V: 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe File opened (read-only) \??\M: 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification F:\autorun.inf 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe File opened for modification C:\autorun.inf 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe -
resource yara_rule behavioral1/memory/1864-6-0x00000000008B0000-0x000000000193E000-memory.dmp upx behavioral1/memory/1864-7-0x00000000008B0000-0x000000000193E000-memory.dmp upx behavioral1/memory/1864-15-0x00000000008B0000-0x000000000193E000-memory.dmp upx behavioral1/memory/1864-20-0x00000000008B0000-0x000000000193E000-memory.dmp upx behavioral1/memory/1864-13-0x00000000008B0000-0x000000000193E000-memory.dmp upx behavioral1/memory/1864-10-0x00000000008B0000-0x000000000193E000-memory.dmp upx behavioral1/memory/1864-12-0x00000000008B0000-0x000000000193E000-memory.dmp upx behavioral1/memory/1864-9-0x00000000008B0000-0x000000000193E000-memory.dmp upx behavioral1/memory/1864-14-0x00000000008B0000-0x000000000193E000-memory.dmp upx behavioral1/memory/1864-37-0x00000000008B0000-0x000000000193E000-memory.dmp upx behavioral1/memory/1864-38-0x00000000008B0000-0x000000000193E000-memory.dmp upx behavioral1/memory/1864-39-0x00000000008B0000-0x000000000193E000-memory.dmp upx behavioral1/memory/1864-40-0x00000000008B0000-0x000000000193E000-memory.dmp upx behavioral1/memory/1864-41-0x00000000008B0000-0x000000000193E000-memory.dmp upx behavioral1/memory/1864-64-0x00000000008B0000-0x000000000193E000-memory.dmp upx behavioral1/memory/1864-65-0x00000000008B0000-0x000000000193E000-memory.dmp upx behavioral1/memory/1864-67-0x00000000008B0000-0x000000000193E000-memory.dmp upx behavioral1/memory/1864-70-0x00000000008B0000-0x000000000193E000-memory.dmp upx behavioral1/memory/1864-72-0x00000000008B0000-0x000000000193E000-memory.dmp upx behavioral1/memory/1864-78-0x00000000008B0000-0x000000000193E000-memory.dmp upx behavioral1/memory/1864-86-0x00000000008B0000-0x000000000193E000-memory.dmp upx behavioral1/memory/1864-88-0x00000000008B0000-0x000000000193E000-memory.dmp upx behavioral1/memory/1864-92-0x00000000008B0000-0x000000000193E000-memory.dmp upx behavioral1/memory/1864-94-0x00000000008B0000-0x000000000193E000-memory.dmp upx behavioral1/memory/1864-95-0x00000000008B0000-0x000000000193E000-memory.dmp upx behavioral1/memory/1864-99-0x00000000008B0000-0x000000000193E000-memory.dmp upx behavioral1/memory/1864-100-0x00000000008B0000-0x000000000193E000-memory.dmp upx behavioral1/memory/1864-102-0x00000000008B0000-0x000000000193E000-memory.dmp upx behavioral1/memory/1864-107-0x00000000008B0000-0x000000000193E000-memory.dmp upx behavioral1/memory/1864-109-0x00000000008B0000-0x000000000193E000-memory.dmp upx behavioral1/memory/1864-110-0x00000000008B0000-0x000000000193E000-memory.dmp upx behavioral1/memory/1864-113-0x00000000008B0000-0x000000000193E000-memory.dmp upx behavioral1/memory/1864-115-0x00000000008B0000-0x000000000193E000-memory.dmp upx behavioral1/memory/1864-117-0x00000000008B0000-0x000000000193E000-memory.dmp upx behavioral1/memory/1864-118-0x00000000008B0000-0x000000000193E000-memory.dmp upx behavioral1/memory/1864-121-0x00000000008B0000-0x000000000193E000-memory.dmp upx behavioral1/memory/1864-122-0x00000000008B0000-0x000000000193E000-memory.dmp upx behavioral1/memory/1864-123-0x00000000008B0000-0x000000000193E000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe wEVxmJ.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe wEVxmJ.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe wEVxmJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe wEVxmJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe wEVxmJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe wEVxmJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE wEVxmJ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe wEVxmJ.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe wEVxmJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe wEVxmJ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE wEVxmJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe wEVxmJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe wEVxmJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe wEVxmJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe wEVxmJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\SoundRec.exe wEVxmJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe wEVxmJ.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe wEVxmJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe wEVxmJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe wEVxmJ.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe wEVxmJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe wEVxmJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe wEVxmJ.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe wEVxmJ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE wEVxmJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe wEVxmJ.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe wEVxmJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe wEVxmJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe wEVxmJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe wEVxmJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe wEVxmJ.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe wEVxmJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE wEVxmJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe wEVxmJ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe wEVxmJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe wEVxmJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe wEVxmJ.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe wEVxmJ.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe wEVxmJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe wEVxmJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe wEVxmJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe wEVxmJ.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe wEVxmJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE wEVxmJ.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe wEVxmJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe wEVxmJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe wEVxmJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe wEVxmJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE wEVxmJ.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe wEVxmJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe wEVxmJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe wEVxmJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe wEVxmJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe wEVxmJ.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe wEVxmJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe wEVxmJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe wEVxmJ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe wEVxmJ.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe wEVxmJ.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe wEVxmJ.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe wEVxmJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe wEVxmJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe wEVxmJ.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3520 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wEVxmJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe Token: SeDebugPrivilege 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1864 wrote to memory of 5012 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 85 PID 1864 wrote to memory of 796 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 9 PID 1864 wrote to memory of 804 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 10 PID 1864 wrote to memory of 448 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 14 PID 1864 wrote to memory of 2912 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 50 PID 1864 wrote to memory of 3016 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 52 PID 1864 wrote to memory of 1124 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 53 PID 1864 wrote to memory of 3280 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 56 PID 1864 wrote to memory of 3444 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 57 PID 1864 wrote to memory of 3628 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 58 PID 1864 wrote to memory of 3720 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 59 PID 1864 wrote to memory of 3780 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 60 PID 1864 wrote to memory of 3860 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 61 PID 1864 wrote to memory of 3476 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 62 PID 1864 wrote to memory of 4680 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 65 PID 1864 wrote to memory of 4224 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 76 PID 1864 wrote to memory of 5012 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 85 PID 1864 wrote to memory of 5012 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 85 PID 1864 wrote to memory of 796 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 9 PID 1864 wrote to memory of 804 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 10 PID 1864 wrote to memory of 448 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 14 PID 1864 wrote to memory of 2912 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 50 PID 1864 wrote to memory of 3016 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 52 PID 1864 wrote to memory of 1124 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 53 PID 1864 wrote to memory of 3280 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 56 PID 1864 wrote to memory of 3444 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 57 PID 1864 wrote to memory of 3628 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 58 PID 1864 wrote to memory of 3720 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 59 PID 1864 wrote to memory of 3780 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 60 PID 1864 wrote to memory of 3860 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 61 PID 1864 wrote to memory of 3476 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 62 PID 1864 wrote to memory of 4680 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 65 PID 1864 wrote to memory of 4224 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 76 PID 1864 wrote to memory of 5012 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 85 PID 1864 wrote to memory of 5012 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 85 PID 1864 wrote to memory of 4580 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe PID 1864 wrote to memory of 4552 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 86 PID 1864 wrote to memory of 2960 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 87 PID 1864 wrote to memory of 3296 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 88 PID 1864 wrote to memory of 3296 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 88 PID 1864 wrote to memory of 796 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 9 PID 1864 wrote to memory of 804 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 10 PID 1864 wrote to memory of 448 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 14 PID 1864 wrote to memory of 2912 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 50 PID 1864 wrote to memory of 3016 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 52 PID 1864 wrote to memory of 1124 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 53 PID 1864 wrote to memory of 3280 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 56 PID 1864 wrote to memory of 3444 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 57 PID 1864 wrote to memory of 3628 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 58 PID 1864 wrote to memory of 3720 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 59 PID 1864 wrote to memory of 3780 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 60 PID 1864 wrote to memory of 3860 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 61 PID 1864 wrote to memory of 3476 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 62 PID 1864 wrote to memory of 4680 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 65 PID 1864 wrote to memory of 4224 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 76 PID 1864 wrote to memory of 2960 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 87 PID 1864 wrote to memory of 5080 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 91 PID 1864 wrote to memory of 4792 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 92 PID 1864 wrote to memory of 796 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 9 PID 1864 wrote to memory of 804 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 10 PID 1864 wrote to memory of 448 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 14 PID 1864 wrote to memory of 2912 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 50 PID 1864 wrote to memory of 3016 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 52 PID 1864 wrote to memory of 1124 1864 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe 53 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:796
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:804
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:448
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2912
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:3016
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:1124
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\wEVxmJ.exeC:\Users\Admin\AppData\Local\Temp\wEVxmJ.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5a476d1d.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3520
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3444
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3628
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3720
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3780
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3860
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3476
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4680
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4224
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:4552
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exeC:\Users\Admin\AppData\Local\Temp\2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3296
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:5080
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4792
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵PID:404
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:4152
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:1540
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PROGRAM FILES\7-ZIP\Uninstall.exe
- Size 110KB
- SHA256 6311e0f841d2142e8e4ef40bd586bb27e0317518da004ec5d758bca43fd3f9f7
- MD5 2c813daaa29059421db75b84f949a4b4
- SHA1 779df570a876a79bf1299c25ef66611005c0c4e6
- SHA512 83b06c820edd6b1018475562e2f08cc0d5528b67de04ed424ac235bb15945703f3e7dc8e6c1bfd14e07522b01cf896807a030a41eb68e0b4005983e16a786135
- SSDEEP 3072:9aNVHsGCHfLHCBoN7SV5TnelP2Lg6/rymkVUgrV:9a7xcGoN7SvoPDI/kOgrV
- TLSH T15AB30256DFA810F4E3B3293170B7799746B6DD3098E4CD6A83A1678E1834680FD823D3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2026-07-30_38e4c77d4b7887ca08cd2666ef42634a_elex_rhadamanthys_smoke-loader_wapomi.exe
- Size 472KB
- SHA256 36f6b04de2e49f348f7922e2484c2dd275d5895845d6758761099983c3a76771
- MD5 38e4c77d4b7887ca08cd2666ef42634a
- SHA1 1ce4cfc2183981603aad44320bcdaed9411dfb90
- SHA512 653cd388d98ca986a8b0ecfc7f905e48380d815170c3502b584f7522374b48f9ae95ab77a443725f878c1fec86241891dbc1ced45d3a21e2466c5e967291e4ca
- SSDEEP 6144:PgyLEbWaR5Cch2gg649gxaNWcUkvDDDDoVmkjx2Xym/Raw:YUaWaR5v0ggh9gsWrkgVYi1w
- TLSH T155A4F110FB50D43CF5C681FABBF6DBFE64299F24039421C7A3C8955B17384D26A3668A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\521F44F4.exe
- Size 1B
- SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
- MD5 68b329da9893e34099c7d8ad5cb9c940
- SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
- SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\521F44F4.exe
- Size 1B
- SHA256 08f271887ce94707da822d5263bae19d5519cb3614e0daedc4c7ce5dab7473f1
- MD5 69691c7bdcc3ce6d5d8a1361f22d04ac
- SHA1 c63ae6dd4fc9f9dda66970e827d13f7c73fe841c
- SHA512 253405e03b91441a6dd354a9b72e040068b1bfe10e83eb1a64a086c05525d8ccae2bf09130c624af50d55c3522a4fbb7c18cfc8dd843e5f4801d9ad2b5164b12
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\5a476d1d.bat
- Size 187B
- SHA256 8b10efbe4ef099b43f875ddd1402a26fc33fd283d2fd6e860fe4d4931b32f174
- MD5 670881533b0960e22299acc544ba7beb
- SHA1 cfce2a0afd31070173169e6021c9a5dbb41097de
- SHA512 493550c3b3b1060423e7b3ec20bee437372f2c6ac436ac7508ac19f22d4c758fb336d8761323fa82bc65ffcce05476461bf57cd8718eb167ddabd51757036ceb
- TLSH T1C6C01202C28AC69A159460571AE1714CC07718583BA92B116B30845C629640EB6D3702
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wEVxmJ.exe
- Size 15KB
- SHA256 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
- MD5 56b2c3810dba2e939a8bb9fa36d3cf96
- SHA1 99ee31cd4b0d6a4b62779da36e0eeecdd80589fc
- SHA512 27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
- SSDEEP 384:7XZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:1QGPL4vzZq2o9W7GsxBbPr
- TLSH T10B62BFB34EC098FFC4CD353340823687CB7B4670DABA617F826288372895E19AC55595
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\jlsyw.exe
- Size 100KB
- SHA256 d8116131e1067e07b74b407ea589256723960997bc1bf9987cbf35a0814adbd9
- MD5 7561b72e3a603ff864016ff3b925ed8c
- SHA1 a3e60a9959462f5c44efe034b0db8d0ee3c0aca8
- SHA512 36745b3c4b570c010b3122032a9b5096827663305166b2a86f92dd92eeb8d8163d1ef010a6e69977bfcb420ab53bd4bff90c76b47488434e649dac6bac50e46f
- SSDEEP 1536:QlcFS71tMPYUmICHLVGH2kk6yAVhoOmtWqSig4bdKjIC3x9:CcFS78BmvZGH2k/UOKWLig4bdwx
- TLSH T167A3127F1667E9B6C5EC4ABBEAA5A9F4DB0F75B04A6226070DC460B2DB310D08CC0168
- MD5 SHA1 SHA512 SSDEEP TLSH