Analysis
- max time kernel
149s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/08/2026, 03:45
Behavioral task
behavioral1
Sample
2026-08-07_c0c63214cb68863432b97d4577708a70_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 2026-08-07_c0c63214cb68863432b97d4577708a70_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 387KB
- Sample260807-ea5teazvft
- SHA256 7bbba9719bd7970aada5ee18323405bc98195781de611ad1594f48548de4217e
- MD5 c0c63214cb68863432b97d4577708a70
- SHA1 3626d30e51cf7d348a8d30bf7fe4dafe6b63ffdd
- SHA512 b796fe371c5151003c4fde9ef72a1ae3dc66d888a80472a9497b4d214ffda868a08252989d15b74b6a0e08f00f8929ef0dac33ba5a9ae5af128f3b1f2fc5f041
- SSDEEP 6144:S8efQ6QPJGcLbjg0EuDK4UnUHOkb8734A2P6gt99Wvtxrpp29xQp4T:76QPJGcE0hKRg04zPZt9mtPOR
- TLSH T18A84BF217240C035E3A6073559A6E6F559A86E3A1394E08FF7787E795F312C3AA3324F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 4136 tyyzo.exe 1960 xuavj.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5232 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tyyzo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xuavj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c0c63214cb68863432b97d4577708a70_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe 1960 xuavj.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2984 wrote to memory of 4136 2984 2026-08-07_c0c63214cb68863432b97d4577708a70_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 89 PID 2984 wrote to memory of 5232 2984 2026-08-07_c0c63214cb68863432b97d4577708a70_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 90 PID 4136 wrote to memory of 1960 4136 tyyzo.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c0c63214cb68863432b97d4577708a70_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_c0c63214cb68863432b97d4577708a70_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\tyyzo.exe"C:\Users\Admin\AppData\Local\Temp\tyyzo.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\xuavj.exe"C:\Users\Admin\AppData\Local\Temp\xuavj.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1960
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5232
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
- Size 412B
- SHA256 d18fd78851c25d9df42d9427889bd5e2814c3a358f32322949698b56e9069bbe
- MD5 9b576f2c6248b989bb74df132bb9ab43
- SHA1 8061a0970e1615b20a3d48a3b5f8c7f3e5ef82c3
- SHA512 fd2a603cd5d69cde8dfea12c0a825b8da0378da61ab9920b7cc7bedc3dea5fce3c96c5b20235534d0760d5e7f8f2784bc0cab839e02f458339dc187961215b4d
- TLSH T13FE02B4142AFD92E0409E01F12B475CFC17955182FE627316220C29D51D988FB4EA243
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
- Size 512B
- SHA256 1f6c2fed13a7a6caecdb84f110e6f06e9180a741381b7931a3f29512bb8fa3ab
- MD5 de54814dbb68afba1102557633483c28
- SHA1 82cd1f0cccdad518383eabe9f331612f1f67da6b
- SHA512 389a41e03658fe1c5a546a80d7dee811494d973bd0dc4a3ea8408532510ad50f621ddf00ce617696c47bf41c5377251813b0e0d8008d7229666306298d1215cf
- TLSH T146F08C8A2074A00A3002F037C25827D123530CEC37838E88400832308C3686C8208222
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tyyzo.exe
- Size 387KB
- SHA256 4db59d1893d41b716d91f9ddde5a651ef189f640655fe8889316eb720310f733
- MD5 4530d81e0612662b9bb9f7dc1e925d1d
- SHA1 f6d92e0c0daa9f415dcf495f37d6305c10b026a2
- SHA512 a213b37f58f2c85e5030563348e74a84605a72e3ddedc97e3df9fd11c3a8572d96d0336f474195ddfca13293fbafe42e3057973bc1b89b5616bf01d8a78de57d
- SSDEEP 6144:S8efQ6QPJGcLbjg0EuDK4UnUHOkb8734A2P6gt99Wvtxrpp29xQp4I:76QPJGcE0hKRg04zPZt9mtPOO
- TLSH T11484BF217240C035E3A6073559A6E6F559A86E3A1394E08FF7787E795F312C3AA3324F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\xuavj.exe
- Size 297KB
- SHA256 2a2e0dc513af87c116fd59aa22a003616c759cb65e44051f834c95565e96c490
- MD5 8fb28e69f4f0f449295b6b69ab92b3f8
- SHA1 2ddb63cc7cf7344982d37f3432a8940e6c6fdd8e
- SHA512 1dc7afa4f3088b67dfd9660e18445980a59bd38d8366399326223901da53cd45e72652f2b7c7a00fc973518e0d617ca4515bd16882d586d37973c8d236cb24d1
- SSDEEP 6144:nzCnkGXC4JfDu67rIULCFVugtxvIKsAHp2A:nzK9fJru+IU+F6KsAMA
- TLSH T1DF547B1076508076E72A07710556EBF40AA8AE3916E4E48FF7787E392E312D39B7724F
- MD5 SHA1 SHA512 SSDEEP TLSH