89c69359cd420dea5f59ad81c5609f7dfcd3ca305231a6ea126629b1c68aa634

Analysis

max time kernel
148s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 17:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_fe73056664466df2ef73b24ec88a5f27_elex_rhadamanthys_smoke-loader_stealc_tofsee.exe
Size 1.3MB
Sample260807-vhzkcssxft
SHA256 89c69359cd420dea5f59ad81c5609f7dfcd3ca305231a6ea126629b1c68aa634
MD5 fe73056664466df2ef73b24ec88a5f27
SHA1 bdd25e7f4fcb513befa40f8a7aa2451386e80be6
SHA512 c414457655d9651ad32008b85a79957e1ec72aec4b82046847a7360caff744b02bd3da3d9e682e86b71565eb1241cb2401cd85594254ac6110c4f31e781409f6
SSDEEP 24576:d7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOo1YA+wE/MGmA0UTPk:26F0eMpAAYEhpX+hwaPn0UTs
TLSH
T12B557C64E783C4F1E92314F0444BE7FBA530AE264031CD6BFBC9EF11BA72E526529616
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3496	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_fe73056664466df2ef73b24ec88a5f27_elex_rhadamanthys_smoke-loader_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5452 wrote to memory of 3496	5452	2026-08-07_fe73056664466df2ef73b24ec88a5f27_elex_rhadamanthys_smoke-loader_stealc_tofsee.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-07_fe73056664466df2ef73b24ec88a5f27_elex_rhadamanthys_smoke-loader_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_fe73056664466df2ef73b24ec88a5f27_elex_rhadamanthys_smoke-loader_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5452
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 1.6MB
SHA256 56d0825b411ee16ea935a905148ddea1b89f722834b2945d449b5abbc1684856
MD5 777dbe0089eb4f45889631ddc837c1a9
SHA1 244c9aa59f49ee561b6b58db9105125ae2049dda
SHA512 e9b5f393fed4d9065820c6661af36f312fb82ecf1d0c2e843a08651f120fe6bd6a1a63bb98bfe6b9c4051550d63e20c13ea5940708cec2e1b6e3e8796f998e27
SSDEEP 24576:97VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO71YA+wPT83npi63i3:W6F0eMpAAYEhps+hwL8XpiMC
TLSH
T197756B50F7C780B1F97316B0496BE7BA5530BD218831C92FE7C8EE09B9B2951A539723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX93AE.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX93AE.tmp
Size 1.1MB
SHA256 b82b610662736e8f8634e77491485fbc280d7a05a7f8e2b159d4296d303bd964
MD5 22078c75f4ef1fdcbdfbe78f6ef6da5f
SHA1 a39968181ac2152b64744f3931926d2b343aeb51
SHA512 3777e6e55aa786d627fc4140e15e151047f979449f4e1b97bcf67d3498cd8f5317bafe64d8064f7ac0c86e880815fe1a982ba519a1e0f14efcf065763d59aaef
SSDEEP 24576:97VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO81YA+wlP:W6F0eMpAAYEhpf+hwR
TLSH
T185455B54E783C4F5FD2314F0444BEBFBA5309E1A40318D6BFBC8EE11BAB2E526529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 186KB
SHA256 1aa3927c7985386d42759656665c7b422ee226df16a19446af6d9a6613b8ae9b
MD5 2124a793ac7d675e1b2d5fdee19a87d0
SHA1 3a1a6ae7c218e41c4eb303c548db9ec06bd6a6b5
SHA512 d5b7b789108c00901e96a3f336c2176a6e7f50e73cb485974e8bb7af1b513b099e88eb6800ed1f0c53969a86a6870130a477c9b17cad0e00f9de4ac90252e051
SSDEEP 3072:81TlCN3DeL0dA/VkvpS6zpQDt0v2E6LGHxdOWTtDwqytR2TBf9AqqpUwIT:ilGXd4OvDzewKLGHj0qTBlznBT
TLSH
T161146B2472D1C072E163207446B5C7F64E7ABC716662B88FABCB1BB64F346D1D22934E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 463e3d4ea3464ea0c1d0d090677ff3022932c2c50ca6338e77e6c1ef8b8a325f
MD5 f8abfb8bfb1e86d1301d263df9418c61
SHA1 26acb19293c4c11476fbf6e443f19457587fd565
SHA512 03ee1511405f43428c7aba8298829f5099d85d5f5d0a3f26587c63599a9f8cfb6abc69895ea379d6486644db00bbe4dd32eafc6517969d42a9d548a7f754f294
SSDEEP 24576:d7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOo1YA+wE/:26F0eMpAAYEhpX+hwa
TLSH
T185455C54E783C4F5FD2314F0444BEBFBA5309E1A40318D6BFBC8EE11BAB2E526529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 4fe5e374ee9d38438b2eefb8e2c7a3864b358bd6cbbc7194165b977100744922
MD5 7c90a56216bf7395d8ae99d2f02fe63d
SHA1 cc642df2de6bd2c632e0601c1481ee65a2a5cb39
SHA512 994b3bfaa548fb99e7fa3d2a7b04c6dc7dfd9f9120455fac1ca6bde8ac45d1bf71426c13a31cf97e67d57763724b6b5b53e837de197d02ab00b4b4d9c7a310ca
SSDEEP 24576:97VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOh1YA+wqc:W6F0eMpAAYEhpK+hw7
TLSH
T1F3455C54E783C4F5FD2314F0444BEBFBA5309E1A40318D6BFBC8EE11BAB2E526529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5452-153-0x0000000000400000-0x0000000000529000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads