Analysis
- max time kernel
149s - max time network
85s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/08/2026, 04:20
Behavioral task
behavioral1
Sample
2026-08-07_94c8a41524f9dc25be399bb428f6d38e_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 2026-08-07_94c8a41524f9dc25be399bb428f6d38e_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 387KB
- Sample260807-eyft7axdla
- SHA256 a4b24bbebaa6e82d9bd4d22d60068389b10ef4463957308a9d1f641bdf0b6b3c
- MD5 94c8a41524f9dc25be399bb428f6d38e
- SHA1 f9c041c6d24938c09400b1684f12aa9c31ec463c
- SHA512 5b71fcfae099132479c17965d9d58ddbc174ce89e42d3fb413465d8de65b714e293663dee20bf4efd31df28e8b401d5da2cc86410cce749462311c04980a7716
- SSDEEP 6144:S8efQ6QPJGcLbjg0EuDK4UnUHOkb8734A2P6gt99Wvtxrpp29xQp4o:76QPJGcE0hKRg04zPZt9mtPOi
- TLSH T13284BF217240C035E3A6073559A6E6F559A86E3A1394E08FF7787E795F312C3AA3324F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 5508 cejyq.exe 5480 potin.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4248 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cejyq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language potin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_94c8a41524f9dc25be399bb428f6d38e_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe 5480 potin.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4984 wrote to memory of 5508 4984 2026-08-07_94c8a41524f9dc25be399bb428f6d38e_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 89 PID 4984 wrote to memory of 4248 4984 2026-08-07_94c8a41524f9dc25be399bb428f6d38e_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 90 PID 5508 wrote to memory of 5480 5508 cejyq.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_94c8a41524f9dc25be399bb428f6d38e_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_94c8a41524f9dc25be399bb428f6d38e_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\cejyq.exe"C:\Users\Admin\AppData\Local\Temp\cejyq.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\Users\Admin\AppData\Local\Temp\potin.exe"C:\Users\Admin\AppData\Local\Temp\potin.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5480
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4248
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
- Size 412B
- SHA256 e0a789d2ee6a9d46c8b56925ce6a5335d9de16aafc5d45668b0ff67268921baa
- MD5 f5855dd64623b35893887c6b3745d417
- SHA1 b0fc2e4551ab15360e253725e0addf19941b4a36
- SHA512 895f6862cd27735d9bfe832c2b5f5edccb58a74181a7547ff81abb4d95daf0ba3ae74757668a6e124be75a6e543e5c78fdf8724e5f7f2ed82ac439d0d59703e7
- TLSH T109E02B01429FEA3B0808D42F05F67ECDC19065143FC73B706320C25D51DD84EB1E7101
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\cejyq.exe
- Size 387KB
- SHA256 5cf09a70d1240e40ad325eb3b50631e673dbf55e84809037572c12be710f98d6
- MD5 e0d1968c1038ff827196094803bca966
- SHA1 3833632552a97d2d38ab58f8f62f05cd32b0959a
- SHA512 5322201e26a7ac8ff98c2ee2e2ded670fc7c27be355dc44256e9171e8d396958ad786eefe66e401794a478c011c7d76f9a02507be0425f97b7692a198c0e5a1c
- SSDEEP 6144:S8efQ6QPJGcLbjg0EuDK4UnUHOkb8734A2P6gt99Wvtxrpp29xQp4C:76QPJGcE0hKRg04zPZt9mtPOU
- TLSH T1DA84BF217240C035E3A6073559A6E6F559A86E3A1394E08FF7787E795F312C3AA3324F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
- Size 512B
- SHA256 2f3e28b868b3c93006d6a1987f1b078428b258bc01ab5b026b3fd1777716993d
- MD5 d91290c76ac0254f97305668343c4372
- SHA1 a0f17090b126dbafc542679b35f825118e61817a
- SHA512 88ce7fcf375f4b9f41c56c642eddebf918692b19201cbcaa4a20246aca5e660cfbd6f2ba91cb6abd64d2db547148181246d176e2f219d1e23d9536ec7b3fad05
- TLSH T1B6F08CC91060B02B3113E62AC2542BA82B574CAC14878CD40005B3314C3586C8194261
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\potin.exe
- Size 297KB
- SHA256 0cd5a60f71e8c93df1911d4fdfc92132efd5f1f41d2d47586e2e05521e179277
- MD5 b0835b911beb63ca8da73b5452082069
- SHA1 033b35f329473336b87cea1fe292a4d984940554
- SHA512 eee5a8788149f552dfc8b65a984f71d24401518ca70afb8ce1c1f2b65fdb2f4a65e8f8f9f41399d1c3340d4f10d77da3a84124442ca4a1ae533e155375e4e3f9
- SSDEEP 6144:nzCnkGXC4JfDu67rIULCFVugtxvIKsAHp2s:nzK9fJru+IU+F6KsAMs
- TLSH T1D4547B1076508076E72A07710556EAF40AA8AE3917E4E48FF7787E392E312D39B7724F
- MD5 SHA1 SHA512 SSDEEP TLSH