Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/08/2026, 03:44
Behavioral task
behavioral1
Sample
2026-08-07_cf71862613656205b3379b8e8a732769_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 2026-08-07_cf71862613656205b3379b8e8a732769_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 387KB
- Sample260807-eahzmsdg68
- SHA256 92d218b6b4083af5f7664566f3e88187691899efeb3161c1f278e23da2a15ceb
- MD5 cf71862613656205b3379b8e8a732769
- SHA1 3838ba2e9e8ba8937cc7f430ed1d400115e65369
- SHA512 6a6cde6f07fb96831ebea7cff1698c067a746a9c5db7a4e0b5fee36b695546ec50f13d8327976af02849dbb5a55e5e1bafc1531a04324f7d4cecb44434de1ee2
- SSDEEP 6144:S8efQ6QPJGcLbjg0EuDK4UnUHOkb8734A2P6gt99Wvtxrpp29xQp4/J:76QPJGcE0hKRg04zPZt9mtPOP
- TLSH T1BD84BF217240C035E3A6073559A6E6F559A86E3A1394E08FF7787E795F312C3AA3324F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation 2026-08-07_cf71862613656205b3379b8e8a732769_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe Key value queried \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation vovuh.exe - Executes dropped EXE 2 IoCs
pid Process 3592 vovuh.exe 3904 rixiv.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3452 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_cf71862613656205b3379b8e8a732769_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vovuh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rixiv.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe 3904 rixiv.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4072 wrote to memory of 3592 4072 2026-08-07_cf71862613656205b3379b8e8a732769_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 84 PID 4072 wrote to memory of 3452 4072 2026-08-07_cf71862613656205b3379b8e8a732769_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 85 PID 3592 wrote to memory of 3904 3592 vovuh.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_cf71862613656205b3379b8e8a732769_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_cf71862613656205b3379b8e8a732769_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\vovuh.exe"C:\Users\Admin\AppData\Local\Temp\vovuh.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\rixiv.exe"C:\Users\Admin\AppData\Local\Temp\rixiv.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3904
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3452
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
- Size 412B
- SHA256 764f500c78453ea322f6d8d588a7d2262b054ca861d190dcfc60a48fa30a35f4
- MD5 13087eff612e15da653594f47b914769
- SHA1 7616669fb8f6107f837ebfac68c07dbdc6d265fb
- SHA512 1dc3ab0123e88464354cd45c5ad19b848faa508cc8de0de9b1209c5dc2c336fabcfa05fde28535978e5674167cf2a759aa8240e5c24302ab1c29087853caf935
- TLSH T165E0E51100AFC96A060CD01F42E8B54E816075143FC72B75A230864C52D949EF1FB346
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
- Size 512B
- SHA256 eb1b86a478e5fb23e82fe84f5351b6e5951c587cb5c0eacaf91da3f5cea0cfaa
- MD5 811e636a70ec7862b66aaa4a6f31368e
- SHA1 aa47a5411812762e2a3d86dd4d48d49befb653c5
- SHA512 57a7dfe1455f1e17eb75b9be619604caf04282ac82a2395dfb0fde1ad7a614d34ec905ee28ee16bf5cf585fe2772b52aa0175f7d67100c454e38fa0831818e74
- TLSH T1AEF04C9610E1B0417113B607E2585B9567634D980AD74D860015B2709CB49DDC4A9216
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\rixiv.exe
- Size 297KB
- SHA256 c0c692c2c179ede7db52f95fe4dff1a1ef3dd8450cb01c7b1ca1855972898881
- MD5 00a76c8eac247a9bb20973847b922c49
- SHA1 85986e2b27de58d7c7a8764a37682f50b45352f7
- SHA512 091a75ccec71edf4e555aeb9df9f72f887972781faa7be109d00f49075742190bfdd75670f26ee2084f83f57aa44a91bd2cf5636bbc57a1de1e1a3764aa1018f
- SSDEEP 6144:nzCnkGXC4JfDu67rIULCFVugtxvIKsAHp2r:nzK9fJru+IU+F6KsAMr
- TLSH T15F547B1076508076E72A07710556EAF40AA8AE3917E4E48FF7787E392E312D39B7724F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\vovuh.exe
- Size 387KB
- SHA256 a1621466e3607f3479a0632a85a277bd2e651f8555e7f005e4e2db3c382bd715
- MD5 7e97ac59c9be847bbf5740d06491596a
- SHA1 5f809250ea56fa0e0fd1cbf6bed496163ef3293a
- SHA512 4d4aedc93cef6a757024179c52350dcb3749498bfa1bf5f1a78d392e47dd80a1c6ab2e18d58a34e6515bd7297133a8c5be480ad5864aba3405ec49eac9da20ab
- SSDEEP 6144:S8efQ6QPJGcLbjg0EuDK4UnUHOkb8734A2P6gt99Wvtxrpp29xQp4/n:76QPJGcE0hKRg04zPZt9mtPOt
- TLSH T18784BF217240C035E3A6073559A6E6F559A86E3A1394E08FF7787E795F312C3AA3324F
- MD5 SHA1 SHA512 SSDEEP TLSH