87bc20c6d08117c42804bfdf9e016f00076ea8e7b6bf4978f1fab3be4c4c27a2

General

Target
2026-08-03_718b010ace27f386b0786a7cf3eb3e6a_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Size 149KB
Sample260803-werwsaxtew
SHA256 87bc20c6d08117c42804bfdf9e016f00076ea8e7b6bf4978f1fab3be4c4c27a2
MD5 718b010ace27f386b0786a7cf3eb3e6a
SHA1 71e5a089b8b93231cf118168da16155398a334fd
SHA512 ce706a3f8e83119e78d3ecfa7618c94a7f34e78f0a72a99106817229c7aa5384ddc817e53f3fa0a283a4ea6b2e07c3948d1c2721ca0dac2515575c5ada42951f
SSDEEP 3072:vbuMGq4hOSOVnjsv0XPcSRtHp1aEp8+WqstocQ1+:TGq4sHVjtRtHn5phc7z
TLSH
T11AE3D0257A52D872E2621670187496F2A66F7970137841CB77A90BFE2F706C18E3D32B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 4 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	2026-08-03_718b010ace27f386b0786a7cf3eb3e6a_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	2026-08-03_718b010ace27f386b0786a7cf3eb3e6a_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\c:\windows\mdm.exe = "c:\\windows\\mdm.exe:*:Enabled:Microsoft Firevall Engine"	2026-08-03_718b010ace27f386b0786a7cf3eb3e6a_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	2026-08-03_718b010ace27f386b0786a7cf3eb3e6a_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe

Executes dropped EXE 5 IoCs

pid	Process
3372	LoTKw.exe
864	2026-08-03_718b010ace27f386b0786a7cf3eb3e6a_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
2788	2026-08-03_718b010ace27f386b0786a7cf3eb3e6a_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
4288	mdm.exe
2144	ukAII.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 864 set thread context of 2788	864	2026-08-03_718b010ace27f386b0786a7cf3eb3e6a_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	87

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\mdm.exe	2026-08-03_718b010ace27f386b0786a7cf3eb3e6a_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
File created	\??\c:\windows\mdm.exe	2026-08-03_718b010ace27f386b0786a7cf3eb3e6a_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
File created	\??\c:\windows\ukAII.exe	mdm.exe
File opened for modification	\??\c:\windows\mdm.exe	ukAII.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4508	2144	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mdm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ukAII.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_718b010ace27f386b0786a7cf3eb3e6a_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LoTKw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_718b010ace27f386b0786a7cf3eb3e6a_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_718b010ace27f386b0786a7cf3eb3e6a_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2788	2026-08-03_718b010ace27f386b0786a7cf3eb3e6a_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
2788	2026-08-03_718b010ace27f386b0786a7cf3eb3e6a_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
2788	2026-08-03_718b010ace27f386b0786a7cf3eb3e6a_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
2788	2026-08-03_718b010ace27f386b0786a7cf3eb3e6a_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
2788	2026-08-03_718b010ace27f386b0786a7cf3eb3e6a_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
2788	2026-08-03_718b010ace27f386b0786a7cf3eb3e6a_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
2788	2026-08-03_718b010ace27f386b0786a7cf3eb3e6a_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
2788	2026-08-03_718b010ace27f386b0786a7cf3eb3e6a_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
2788	2026-08-03_718b010ace27f386b0786a7cf3eb3e6a_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
2788	2026-08-03_718b010ace27f386b0786a7cf3eb3e6a_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2788	2026-08-03_718b010ace27f386b0786a7cf3eb3e6a_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 3372	3004	2026-08-03_718b010ace27f386b0786a7cf3eb3e6a_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	85
PID 3372 wrote to memory of 864	3372	LoTKw.exe	86
PID 864 wrote to memory of 2788	864	2026-08-03_718b010ace27f386b0786a7cf3eb3e6a_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	87
PID 864 wrote to memory of 2788	864	2026-08-03_718b010ace27f386b0786a7cf3eb3e6a_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	87
PID 864 wrote to memory of 2788	864	2026-08-03_718b010ace27f386b0786a7cf3eb3e6a_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	87
PID 864 wrote to memory of 2788	864	2026-08-03_718b010ace27f386b0786a7cf3eb3e6a_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	87
PID 864 wrote to memory of 2788	864	2026-08-03_718b010ace27f386b0786a7cf3eb3e6a_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	87
PID 2788 wrote to memory of 4288	2788	2026-08-03_718b010ace27f386b0786a7cf3eb3e6a_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	88
PID 4288 wrote to memory of 2144	4288	mdm.exe	89
PID 2144 wrote to memory of 3576	2144	ukAII.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-03_718b010ace27f386b0786a7cf3eb3e6a_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_718b010ace27f386b0786a7cf3eb3e6a_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Users\Admin\AppData\Local\Temp\LoTKw.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-03_718b010ace27f386b0786a7cf3eb3e6a_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe" raWFIFiW
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3372
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_718b010ace27f386b0786a7cf3eb3e6a_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\LoTKw.exe" nfYlBokL
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:864
  - - C:\Users\Admin\AppData\Local\Temp\2026-08-03_718b010ace27f386b0786a7cf3eb3e6a_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
      AsdWc2df
      4⤵
      Modifies firewall policy service
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2788
    - - \??\c:\windows\mdm.exe
        
        c:\windows\mdm.exe
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4288
      - \??\c:\windows\ukAII.exe
        
        "c:\windows\mdm.exe" 2qlhino4
        6⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2144
        
        \??\c:\windows\ukAII.exe
        
        "c:\windows\ukAII.exe"
        7⤵
        
        PID:3576
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 276
        7⤵
        Program crash
        
        PID:4508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2144 -ip 2144
1⤵
PID:3460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LoTKw.exe

Path C:\Users\Admin\AppData\Local\Temp\LoTKw.exe
Size 149KB
SHA256 e1fcb59bd0a322393843b8220143a637a2ddbcfddf523ab1ab37e443c1cea57d
MD5 f5253d665de97a320860a7e6879a905c
SHA1 04d16a17d436bfb665ae61a74df0c1328a8427c6
SHA512 2e76c11c629a0e9634898b297671ba31575f99a4dc5abc86970d1e81c33ca44ffee881a18375d1f8f29331b44fceb1785b3392fb0f74fbca9cac080fc0d3b86f
SSDEEP 3072:vbuMGq4hOSOVGjsvJFhkZtf37yhFKfWuMzZY/TstkJP3bcH06H:TGq4sHVKujkZtfeTKf+Kgtk1m06H
TLSH
T125E3E025BAD19472E18236700D71C5B7A66F752203B806CBB7982BBE5F705C19F3832B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ukAII.exe

Path C:\Windows\ukAII.exe
Size 149KB
SHA256 07afcc173b206aba9991d6db2553d5a715e3e4a8f9d56d5fc491e51666a57d5e
MD5 2c5353851430b5c7c231611b38415980
SHA1 9fedc2b77f9a985878c9b812d4e963dcd6989029
SHA512 e7434e5476fd8591fa826143a44a81f6868181b248887bbcc5c00ebbb85a53df355902e8c5322d93f760a1d6bea1588279bd444a87e2da4b1d793d519352dcc4
SSDEEP 3072:vbuMGq4hOSOVijsvLG0+7feIQJIcKb9EsOazLO+/f6T/lZb6AYFn:TGq4sHVOkGNGIQJIb9zOaf4lZb63
TLSH
T11EE3D025BA91C432E55226306D71C2F3B52B759217B842CB7B9C1FBE5E706C19A3832F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2788-38-0x0000000000400000-0x000000000049D000-memory.dmp

Download

memory/2788-42-0x0000000000400000-0x000000000049D000-memory.dmp

Download

memory/2788-41-0x0000000000400000-0x000000000049D000-memory.dmp

Download

memory/2788-43-0x0000000000400000-0x000000000049D000-memory.dmp

Download

memory/2788-49-0x0000000000400000-0x000000000049D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads