89c69359cd420dea5f59ad81c5609f7dfcd3ca305231a6ea126629b1c68aa634

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 17:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_fe73056664466df2ef73b24ec88a5f27_elex_rhadamanthys_smoke-loader_stealc_tofsee.exe
Size 1.3MB
Sample260807-vhzkcssxft
SHA256 89c69359cd420dea5f59ad81c5609f7dfcd3ca305231a6ea126629b1c68aa634
MD5 fe73056664466df2ef73b24ec88a5f27
SHA1 bdd25e7f4fcb513befa40f8a7aa2451386e80be6
SHA512 c414457655d9651ad32008b85a79957e1ec72aec4b82046847a7360caff744b02bd3da3d9e682e86b71565eb1241cb2401cd85594254ac6110c4f31e781409f6
SSDEEP 24576:d7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOo1YA+wE/MGmA0UTPk:26F0eMpAAYEhpX+hwaPn0UTs
TLSH
T12B557C64E783C4F1E92314F0444BE7FBA530AE264031CD6BFBC9EF11BA72E526529616
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1640	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_fe73056664466df2ef73b24ec88a5f27_elex_rhadamanthys_smoke-loader_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 1640	2296	2026-08-07_fe73056664466df2ef73b24ec88a5f27_elex_rhadamanthys_smoke-loader_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-07_fe73056664466df2ef73b24ec88a5f27_elex_rhadamanthys_smoke-loader_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_fe73056664466df2ef73b24ec88a5f27_elex_rhadamanthys_smoke-loader_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX5F90.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX5F90.tmp
Size 1.1MB
SHA256 463e3d4ea3464ea0c1d0d090677ff3022932c2c50ca6338e77e6c1ef8b8a325f
MD5 f8abfb8bfb1e86d1301d263df9418c61
SHA1 26acb19293c4c11476fbf6e443f19457587fd565
SHA512 03ee1511405f43428c7aba8298829f5099d85d5f5d0a3f26587c63599a9f8cfb6abc69895ea379d6486644db00bbe4dd32eafc6517969d42a9d548a7f754f294
SSDEEP 24576:d7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOo1YA+wE/:26F0eMpAAYEhpX+hwa
TLSH
T185455C54E783C4F5FD2314F0444BEBFBA5309E1A40318D6BFBC8EE11BAB2E526529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX61E3.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX61E3.tmp
Size 1.1MB
SHA256 b82b610662736e8f8634e77491485fbc280d7a05a7f8e2b159d4296d303bd964
MD5 22078c75f4ef1fdcbdfbe78f6ef6da5f
SHA1 a39968181ac2152b64744f3931926d2b343aeb51
SHA512 3777e6e55aa786d627fc4140e15e151047f979449f4e1b97bcf67d3498cd8f5317bafe64d8064f7ac0c86e880815fe1a982ba519a1e0f14efcf065763d59aaef
SSDEEP 24576:97VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO81YA+wlP:W6F0eMpAAYEhpf+hwR
TLSH
T185455B54E783C4F5FD2314F0444BEBFBA5309E1A40318D6BFBC8EE11BAB2E526529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 186KB
SHA256 1aa3927c7985386d42759656665c7b422ee226df16a19446af6d9a6613b8ae9b
MD5 2124a793ac7d675e1b2d5fdee19a87d0
SHA1 3a1a6ae7c218e41c4eb303c548db9ec06bd6a6b5
SHA512 d5b7b789108c00901e96a3f336c2176a6e7f50e73cb485974e8bb7af1b513b099e88eb6800ed1f0c53969a86a6870130a477c9b17cad0e00f9de4ac90252e051
SSDEEP 3072:81TlCN3DeL0dA/VkvpS6zpQDt0v2E6LGHxdOWTtDwqytR2TBf9AqqpUwIT:ilGXd4OvDzewKLGHj0qTBlznBT
TLSH
T161146B2472D1C072E163207446B5C7F64E7ABC716662B88FABCB1BB64F346D1D22934E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2296-267-0x0000000000400000-0x0000000000529000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads