b1a79d3ccc5278fb0c253120c529a8608f7afb633c9e98e8818c744b3381e583

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 07:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_63e8144d638b12ad17c2f2cd7be9caa6_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 1.0MB
Sample260809-jnw6mshd97
SHA256 b1a79d3ccc5278fb0c253120c529a8608f7afb633c9e98e8818c744b3381e583
MD5 63e8144d638b12ad17c2f2cd7be9caa6
SHA1 0de18f3c2fd3898cd5a9e5370d273d214021c128
SHA512 acc2cfae71a89548f99cc213dd4ee721c5540c44019737f0d642ba2fa844b301c0d053b8f08d7812a70a086e44e6a7a25c4494e70092908db25662d9776d7edc
SSDEEP 12288:RAW0LyGgGvWhK1g0iDutUi9niuBahyqDC8hph1Dn2FGvZe4OUW:Rl0LyGgGGEtV8Fp2FGvZe4O
TLSH
T11B25BF21B640E02AE49714B25DEFC7A966287F74071D20D3B2D07FDE29B16E26F32617
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4424	kLoJa00000.exe

Executes dropped EXE 2 IoCs

pid	Process
4424	kLoJa00000.exe
4344	kLoJa00000.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\kLoJa00000 = "C:\\ProgramData\\kLoJa00000\\kLoJa00000.exe"	kLoJa00000.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_63e8144d638b12ad17c2f2cd7be9caa6_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kLoJa00000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kLoJa00000.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4424	kLoJa00000.exe
Token: SeDebugPrivilege	4344	kLoJa00000.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4424	kLoJa00000.exe
4424	kLoJa00000.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4424	kLoJa00000.exe
4424	kLoJa00000.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4424	kLoJa00000.exe
4424	kLoJa00000.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 440 wrote to memory of 4424	440	2026-08-09_63e8144d638b12ad17c2f2cd7be9caa6_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-08-09_63e8144d638b12ad17c2f2cd7be9caa6_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_63e8144d638b12ad17c2f2cd7be9caa6_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:440
- C:\ProgramData\kLoJa00000\kLoJa00000.exe
  "C:\ProgramData\kLoJa00000\kLoJa00000.exe" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_63e8144d638b12ad17c2f2cd7be9caa6_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4424

C:\ProgramData\kLoJa00000\kLoJa00000.exe
C:\ProgramData\kLoJa00000\kLoJa00000.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

kLoJa00000

Path C:\ProgramData\kLoJa00000\kLoJa00000
Size 104B
SHA256 f68c482baf7b8a25a1fee5d485cfea45789693da3beb5c492ac2df2a44501f00
MD5 28b270e73690fe8dc3b609050d375ba6
SHA1 8c11995f8e57fe5c96cea1ad7d7978ec51f7383b
SHA512 72bdd7e518bfbe100dc7e9a3ce1a8cb5b329241c4fbf876bbe7fb8be62fac4454c4e86bff398eae6f7da0f8eb3902db882a79586e81f4de48be8ea1f4c5a7b1b
TLSH
T180B012D666A57312616E0C77DDF6A49D114912611736801741140841114A3268AB4919
MD5 SHA1 SHA512 TLSH

Submit Download

kLoJa00000.exe

Path C:\ProgramData\kLoJa00000\kLoJa00000.exe
Size 1.0MB
SHA256 36eedc4cd2c631cf075133dae213711b7b5f4266df3d415db22347a734131954
MD5 37d9f3201cec6b389391d83a69dec614
SHA1 c43abd067909c145460fccafb64ae1dab095e76d
SHA512 78955aff29f44b0665a4c32427dbb840d1e6cf36b307a6abbdb189a259043d437257b3240c71583e2930ef9a6ae8cb50ac9719fd9909dd9dbd2b96253cd7c387
SSDEEP 12288:YAW0LyGgGvWhK1g0iDutUi9niuBahyqDC8hph1Dn2FGvZe4OUW:Yl0LyGgGGEtV8Fp2FGvZe4O
TLSH
T15625BF21B640E02AE49714B25DEFC7A966287F74071D20D3B2D07FDE29B16E26F32617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/440-0-0x0000000000C37000-0x0000000000C38000-memory.dmp

Download

memory/4424-8-0x0000000001057000-0x0000000001058000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads