ae8b5cf43b463b0625dfba2b1f30f23c10e7c6242de3dc74896c5e95eb46413a

General

Target
2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Size 149KB
Sample260805-vr1tsacf99
SHA256 ae8b5cf43b463b0625dfba2b1f30f23c10e7c6242de3dc74896c5e95eb46413a
MD5 e1d6bbcf249e5a14d05f9a5fca0b14e1
SHA1 f5beac1e88e5b673e5762cc34bf4a45d6e77f3a4
SHA512 053d2c5ecc58735e438dba2468d516f68b0592bbe7f623349f9c8693667fdd279ebe0fc5023092ef7835dd0614bbeabd4bef438357ae39ff05e8f4ef820669b3
SSDEEP 3072:vbuMGq4hOSOVOSjsvhAtAr2oX/sP+OUjmmrBv4DtmfQY1/31H2:TGq4sHVO+E2wOAfVem/R31W
TLSH
T192E3E021BBA1C472E52321305CB181B6A67B7592177845DBBBD91FBE8F702C05E3932B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 4 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\c:\windows\mdm.exe = "c:\\windows\\mdm.exe:*:Enabled:Microsoft Firevall Engine"	2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe

Executes dropped EXE 5 IoCs

pid	Process
2556	FBCHX.exe
4004	2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
3064	2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
5116	mdm.exe
2780	TLVrw.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4004 set thread context of 3064	4004	2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	88

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\mdm.exe	2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
File created	\??\c:\windows\mdm.exe	2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
File created	\??\c:\windows\TLVrw.exe	mdm.exe
File opened for modification	\??\c:\windows\mdm.exe	TLVrw.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1532	2780	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FBCHX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mdm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TLVrw.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3064	2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
3064	2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
3064	2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
3064	2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
3064	2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
3064	2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
3064	2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
3064	2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
3064	2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
3064	2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3064	2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 2556	880	2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	86
PID 2556 wrote to memory of 4004	2556	FBCHX.exe	87
PID 4004 wrote to memory of 3064	4004	2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	88
PID 4004 wrote to memory of 3064	4004	2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	88
PID 4004 wrote to memory of 3064	4004	2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	88
PID 4004 wrote to memory of 3064	4004	2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	88
PID 4004 wrote to memory of 3064	4004	2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	88
PID 3064 wrote to memory of 5116	3064	2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	89
PID 5116 wrote to memory of 2780	5116	mdm.exe	90
PID 2780 wrote to memory of 3004	2780	TLVrw.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:880
- C:\Users\Admin\AppData\Local\Temp\FBCHX.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe" 52YZKSxJ
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Users\Admin\AppData\Local\Temp\2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\FBCHX.exe" kM7XYTY7
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4004
  - - C:\Users\Admin\AppData\Local\Temp\2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
      JIW4KiKM
      4⤵
      Modifies firewall policy service
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3064
    - - \??\c:\windows\mdm.exe
        
        c:\windows\mdm.exe
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5116
      - \??\c:\windows\TLVrw.exe
        
        "c:\windows\mdm.exe" POWwRelf
        6⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2780
        
        \??\c:\windows\TLVrw.exe
        
        "c:\windows\TLVrw.exe"
        7⤵
        
        PID:3004
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 276
        7⤵
        Program crash
        
        PID:1532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2780 -ip 2780
1⤵
PID:2096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FBCHX.exe

Path C:\Users\Admin\AppData\Local\Temp\FBCHX.exe
Size 149KB
SHA256 6c460adbdd58aaf0bc90b485e1ed6e7b32b9cb9ed7e3720675673966b7853991
MD5 7b7edbc62bfd03a1f71064d26d94723d
SHA1 39ebddd1525bc36040b1a3b9ffc1b78ee2866ad9
SHA512 683e5c8b452e5c7c5c5db43dade1611a7b63a2aeab348906fecc36041a9fba83dd57f47b1799e59af3142fe75806aa48f20c4b98cdca2a1e49b7e50132a3f435
SSDEEP 3072:vbuMGq4hOSOVfjsvbB3pmYuett8g4VKkcTarLhRKSMa:TGq4sHV7a3peett82TanhRCa
TLSH
T1E7E3D039799194B2E163253008B092B7B5577D6127B845C7B39C1FBE6FB02D18E3836B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TLVrw.exe

Path C:\Windows\TLVrw.exe
Size 149KB
SHA256 27583b5c453c0eaa4157c16c6f8dc982905e19a851d0e3b7a61272144c9788f9
MD5 ba11e10f47873e56075f4161969bbbc9
SHA1 631adb73035c860b2a9650c5caea457407317582
SHA512 6c053f70632e5d5fed74abf7abe75683c4f098b948eed79e6e0a48dcfdb0b4b73fa421fb3a57bdbed2f359b996d4cb9adfa4d5c77e0e4b2acca77b8742b41d39
SSDEEP 3072:vbuMGq4hOSOVDjsvL50jx1J1xNAPPLewXRn2A27G:TGq4sHV3A50jvJHh6R2AN
TLSH
T1C5E3E025BB51C432E5A226304870E6B7B66B7A6113B845CBB7982FBD5F702C05E3831F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3064-38-0x0000000000400000-0x000000000049D000-memory.dmp

Download

memory/3064-41-0x0000000000400000-0x000000000049D000-memory.dmp

Download

memory/3064-42-0x0000000000400000-0x000000000049D000-memory.dmp

Download

memory/3064-43-0x0000000000400000-0x000000000049D000-memory.dmp

Download

memory/3064-49-0x0000000000400000-0x000000000049D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads