e7388426c11ff5383308d7b11c57927faa73b425071ef26915d2952d83fb7849

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 14:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_c35525109c4f6c84a3f10f52bd2b3e5b_elex_rhadamanthys_smoke-loader_stealc_tofsee.exe
Size 1.6MB
Sample260806-sbkrhsdp5y
SHA256 e7388426c11ff5383308d7b11c57927faa73b425071ef26915d2952d83fb7849
MD5 c35525109c4f6c84a3f10f52bd2b3e5b
SHA1 fea3d2098cfd52620c381f5039b0d1ea1efc7154
SHA512 89161cbbd22ffa0129c6922caddaff11d504a394717e783c560fbc845f450a3b801e29b53a55ff7057645c0b1ebd358e5c947b21b56265d0f9c5c901d3be4001
SSDEEP 49152:C6F0eMpAAYEhpLU4UUU3UUUhhw6Pn0UTi:d0nAAYEpLU4UUU3UUUhhnfq
TLSH
T15185D376B683D4F1D81A14B0CF1AABF651605D7DC0E28B1BA6CDFE21FB7195130AA10E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
460	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_c35525109c4f6c84a3f10f52bd2b3e5b_elex_rhadamanthys_smoke-loader_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 460	1132	2026-08-06_c35525109c4f6c84a3f10f52bd2b3e5b_elex_rhadamanthys_smoke-loader_stealc_tofsee.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-06_c35525109c4f6c84a3f10f52bd2b3e5b_elex_rhadamanthys_smoke-loader_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_c35525109c4f6c84a3f10f52bd2b3e5b_elex_rhadamanthys_smoke-loader_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX408D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX408D.tmp
Size 1.2MB
SHA256 fb4630d5636ae06b39a83783594ad3d57e360fcdc106d1a6fd160c4abc21edaa
MD5 9a52c8fc70d7a75d7139b751b2bcd745
SHA1 935b726577f4637bd1de55d05fc0a6bd0a3c5fed
SHA512 9adfbc533078d1ef3958483a993ed6fb697f77a37455cb847c81551c14b533c5f9142b8498e0f55db72b0d2874be7eceaa083ae298d0d044cccfb31da2131e9e
SSDEEP 24576:y7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOrU4UUU3UUUm1YA+w/1:h6F0eMpAAYEhpAU4UUU3UUUhhw9
TLSH
T142456D54E787C4F5ED2314F0444BE7FBA5309E2980328D67FBC8FE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 186KB
SHA256 1aa3927c7985386d42759656665c7b422ee226df16a19446af6d9a6613b8ae9b
MD5 2124a793ac7d675e1b2d5fdee19a87d0
SHA1 3a1a6ae7c218e41c4eb303c548db9ec06bd6a6b5
SHA512 d5b7b789108c00901e96a3f336c2176a6e7f50e73cb485974e8bb7af1b513b099e88eb6800ed1f0c53969a86a6870130a477c9b17cad0e00f9de4ac90252e051
SSDEEP 3072:81TlCN3DeL0dA/VkvpS6zpQDt0v2E6LGHxdOWTtDwqytR2TBf9AqqpUwIT:ilGXd4OvDzewKLGHj0qTBlznBT
TLSH
T161146B2472D1C072E163207446B5C7F64E7ABC716662B88FABCB1BB64F346D1D22934E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.5MB
SHA256 01a1f6d6434f172c0ad3e4fa3dee5fe9bdc63fb61ab88b633c60875f4698cf6e
MD5 658021b43dd49d08e6802e8a4e82b84c
SHA1 0af61fe3b71a8aa17e53d32e414af4976cd53c41
SHA512 e90874c3495abd7b44954ac64735747b3e3e382568894aa7426490ca56341b4a4b2f2ca294f949d0f744f4d44f2eb25b659f5e2afec7f3d2861075cb3d4b1c47
SSDEEP 24576:R7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOQU4UUU3UUUm1YA+w25:C6F0eMpAAYEhpLU4UUU3UUUhhw6
TLSH
T13E659176B687D4F1D81A14B0CF1AABF651604D7DC0E28B1BA6CDFE21FB7195130AA10E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.5MB
SHA256 7ac6559584fe6c180fffbffff218c32b7e0458f4b7ccf244abe452f1872ca647
MD5 1f253dcc0469e287d059b1e74536e0f6
SHA1 bf3423c90a6b1aa58c301a67e122439a5e916919
SHA512 7b91f5cae47fc7674a7a6a47ad010523ed325ee3b280a860b241e58af56918ebec6f35992264bbd4eecebde1e2d79c9af9f023d4260b6a15beabc69b9f11a2ef
SSDEEP 24576:h7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO8U4UUU3UUUm1YA+w6u:y6F0eMpAAYEhpbU4UUU3UUUhhw1
TLSH
T135659176B687D4F1D81A14B0CF0AABF651604D7DC0E28B1BA6CDFE21FB7195134AA10E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.5MB
SHA256 24c0a434586d639fc91f1c6f8a7693ceb732f97aa12e1c9551849d5a8636a373
MD5 2b9df2fc21e9e9a7242758a9d632e1ca
SHA1 e1eab43554edb0183d41b5b3300afa15623a9afc
SHA512 59ce6977676aae321e919a356c5e559c810c04511e5e3a6d25bcf277689e68e23a001029ef24f26aa58b996de0bbf99ddf377b8ab757884012d6a69f17af66b0
SSDEEP 24576:B7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOfU4UUU3UUUm1YA+w7o:S6F0eMpAAYEhpsU4UUU3UUUhhw0
TLSH
T1E4659176B687D4F1D81A14B0CF0AABF651604D7DC0E28B1BA6CDFE21FB7195134AA10E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1132-153-0x0000000000400000-0x0000000000582000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads