Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/08/2026, 03:44
Behavioral task
behavioral1
Sample
2026-08-07_cf71862613656205b3379b8e8a732769_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 2026-08-07_cf71862613656205b3379b8e8a732769_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 387KB
- Sample260807-eahzmsdg68
- SHA256 92d218b6b4083af5f7664566f3e88187691899efeb3161c1f278e23da2a15ceb
- MD5 cf71862613656205b3379b8e8a732769
- SHA1 3838ba2e9e8ba8937cc7f430ed1d400115e65369
- SHA512 6a6cde6f07fb96831ebea7cff1698c067a746a9c5db7a4e0b5fee36b695546ec50f13d8327976af02849dbb5a55e5e1bafc1531a04324f7d4cecb44434de1ee2
- SSDEEP 6144:S8efQ6QPJGcLbjg0EuDK4UnUHOkb8734A2P6gt99Wvtxrpp29xQp4/J:76QPJGcE0hKRg04zPZt9mtPOP
- TLSH T1BD84BF217240C035E3A6073559A6E6F559A86E3A1394E08FF7787E795F312C3AA3324F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 252 dyteu.exe 3560 beopb.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5688 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_cf71862613656205b3379b8e8a732769_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dyteu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beopb.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe 3560 beopb.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4148 wrote to memory of 252 4148 2026-08-07_cf71862613656205b3379b8e8a732769_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 89 PID 4148 wrote to memory of 5688 4148 2026-08-07_cf71862613656205b3379b8e8a732769_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 90 PID 252 wrote to memory of 3560 252 dyteu.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_cf71862613656205b3379b8e8a732769_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_cf71862613656205b3379b8e8a732769_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\dyteu.exe"C:\Users\Admin\AppData\Local\Temp\dyteu.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:252 -
C:\Users\Admin\AppData\Local\Temp\beopb.exe"C:\Users\Admin\AppData\Local\Temp\beopb.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3560
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5688
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
- Size 412B
- SHA256 764f500c78453ea322f6d8d588a7d2262b054ca861d190dcfc60a48fa30a35f4
- MD5 13087eff612e15da653594f47b914769
- SHA1 7616669fb8f6107f837ebfac68c07dbdc6d265fb
- SHA512 1dc3ab0123e88464354cd45c5ad19b848faa508cc8de0de9b1209c5dc2c336fabcfa05fde28535978e5674167cf2a759aa8240e5c24302ab1c29087853caf935
- TLSH T165E0E51100AFC96A060CD01F42E8B54E816075143FC72B75A230864C52D949EF1FB346
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\beopb.exe
- Size 297KB
- SHA256 21bcb294670eeefbc1e871850c082331da65516a155f5c97a1f511e7b540c539
- MD5 9823380f47c109995b83be3f9aa295b0
- SHA1 262b552bc9fca92632e92c46d5a694a83bf003ac
- SHA512 980dc1c763651e2d6dc1421cef852b546c5fbe851916d1df3fce306aee0fa22910c7cda3b76f355e4931c16d62d7b50e411e40becc3b0a09d18ac5ffaebaf633
- SSDEEP 6144:nzCnkGXC4JfDu67rIULCFVugtxvIKsAHp2b:nzK9fJru+IU+F6KsAMb
- TLSH T107547B1076508076E72A07710556EAF40AA8AE3916E4E48FF7787E392E312D39B7724F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\dyteu.exe
- Size 387KB
- SHA256 67c0be2720598c10c925a6d3583b05a73e410b59b77e4ae45abe76b6da51e68f
- MD5 796624691978accdf89c4220a9ec0329
- SHA1 5b5f0c6986f77ebae8de238b23af50dd9cca0223
- SHA512 2da52783cf3c54b9f27c26141f205d2ce58828912d69227452dc032aa24c5fd7c51325cce89bdd024365aa7be8f1e107cc380e4af55a2cc5231960ed5c50bd44
- SSDEEP 6144:S8efQ6QPJGcLbjg0EuDK4UnUHOkb8734A2P6gt99Wvtxrpp29xQp4/3:76QPJGcE0hKRg04zPZt9mtPOd
- TLSH T11D84BF217240C035E3A6073559A6E6F559A86E3A1394E08FF7787E795F312C3AA3324F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
- Size 512B
- SHA256 b5ff9eb8475af4d617743faa49913e95278de3c2043c36fdb760c8dc2b1d5896
- MD5 91d2fef8a092db5902fdf843634c9b07
- SHA1 4386729389997a58bd24f2254ffe04b8ac213e66
- SHA512 6b72ea9c62da75e5e7d883e7ba77714d90f31c809cf20ded0628c4fe859a3265c74ee2bc63a706d6ec4935f51335777278d850ba5aa308077d8b99de00040658
- TLSH T162F02BDA20D4B0273313E013C34873952B630CC808974D88030473304C3182C8584151
- MD5 SHA1 SHA512 TLSH