Analysis
- max time kernel
150s - max time network
131s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/08/2026, 03:45
Behavioral task
behavioral1
Sample
2026-08-07_c0c63214cb68863432b97d4577708a70_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 2026-08-07_c0c63214cb68863432b97d4577708a70_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 387KB
- Sample260807-ea5teazvft
- SHA256 7bbba9719bd7970aada5ee18323405bc98195781de611ad1594f48548de4217e
- MD5 c0c63214cb68863432b97d4577708a70
- SHA1 3626d30e51cf7d348a8d30bf7fe4dafe6b63ffdd
- SHA512 b796fe371c5151003c4fde9ef72a1ae3dc66d888a80472a9497b4d214ffda868a08252989d15b74b6a0e08f00f8929ef0dac33ba5a9ae5af128f3b1f2fc5f041
- SSDEEP 6144:S8efQ6QPJGcLbjg0EuDK4UnUHOkb8734A2P6gt99Wvtxrpp29xQp4T:76QPJGcE0hKRg04zPZt9mtPOR
- TLSH T18A84BF217240C035E3A6073559A6E6F559A86E3A1394E08FF7787E795F312C3AA3324F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation 2026-08-07_c0c63214cb68863432b97d4577708a70_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe Key value queried \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation ryhor.exe - Executes dropped EXE 2 IoCs
pid Process 1172 ryhor.exe 376 foebr.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5024 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c0c63214cb68863432b97d4577708a70_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ryhor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language foebr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe 376 foebr.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3316 wrote to memory of 1172 3316 2026-08-07_c0c63214cb68863432b97d4577708a70_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 87 PID 3316 wrote to memory of 5024 3316 2026-08-07_c0c63214cb68863432b97d4577708a70_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 88 PID 1172 wrote to memory of 376 1172 ryhor.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c0c63214cb68863432b97d4577708a70_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_c0c63214cb68863432b97d4577708a70_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\ryhor.exe"C:\Users\Admin\AppData\Local\Temp\ryhor.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\foebr.exe"C:\Users\Admin\AppData\Local\Temp\foebr.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:376
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5024
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
- Size 412B
- SHA256 d18fd78851c25d9df42d9427889bd5e2814c3a358f32322949698b56e9069bbe
- MD5 9b576f2c6248b989bb74df132bb9ab43
- SHA1 8061a0970e1615b20a3d48a3b5f8c7f3e5ef82c3
- SHA512 fd2a603cd5d69cde8dfea12c0a825b8da0378da61ab9920b7cc7bedc3dea5fce3c96c5b20235534d0760d5e7f8f2784bc0cab839e02f458339dc187961215b4d
- TLSH T13FE02B4142AFD92E0409E01F12B475CFC17955182FE627316220C29D51D988FB4EA243
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\foebr.exe
- Size 297KB
- SHA256 7403c6243090a810b83b95cfb48f8ba5b9929273012a8d9c5451ffbf594bd237
- MD5 6b126e7d2bde823946de38c42273e25a
- SHA1 40dcc98479ccbeecd01b4463087d05cb787ae39c
- SHA512 bb36135f763b52793f44b9d8cbac4c32423149d23370426be45f90216fe0a2edd425516387b6881a2c6c3c8c351258567b3ad74c651d951853627ce83ea7791d
- SSDEEP 6144:nzCnkGXC4JfDu67rIULCFVugtxvIKsAHp2s:nzK9fJru+IU+F6KsAMs
- TLSH T1E6547B1076508076E72A07710556EBF40AA8AE3916E4E48FF7787E392E312D39B7724F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
- Size 512B
- SHA256 fd83c0fa3587dda76b3d7c4eecc354ba45591e3ff86177df08480d9f9c34ad69
- MD5 87b7b7d1772f15d9080ef14208e6da29
- SHA1 0cce8226fc274d02c4489ebafae437164a51d4b1
- SHA512 1beb4b82fa3cd59c1a21e825d83debe01f7ef3b74d6c14b407c8a9af0090a64a8fcc31545d2a1bc8be542b07a49ef959cf023ef31057eae412769529f0d8c6d5
- TLSH T12CF04CD621E5A171B11BA517E244679663AB4D8C59C74D844029B3708CB6A5CC454291
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ryhor.exe
- Size 387KB
- SHA256 b770d45fecfc3ea4c20fadb0d1080eaac244878b2cc158beb985bb7415995df6
- MD5 cac8fc907748121ccaf77f002abc165b
- SHA1 6432c76debd0292a63141ff24440aa01843c3641
- SHA512 0748a79671591f967c9a428de09d394919fc2e34562edd8559511d6e7ed21fbae9a790535a9e8cc96619754caf9618443a69d0c2fee046074eda5b3027b67a80
- SSDEEP 6144:S8efQ6QPJGcLbjg0EuDK4UnUHOkb8734A2P6gt99Wvtxrpp29xQp4N:76QPJGcE0hKRg04zPZt9mtPOr
- TLSH T17484BF217240C035E3A6073559A6E6F559A86E3A1394E08FF7787E795F312C3AA3324F
- MD5 SHA1 SHA512 SSDEEP TLSH