Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/08/2026, 13:31
Behavioral task
behavioral1
Sample
2026-08-17_300af62e3d02efc1b351420440e3bf2f_elex_karagany_rhadamanthys_smoke-loader_stealc_stop_tofsee_vertexnet.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-17_300af62e3d02efc1b351420440e3bf2f_elex_karagany_rhadamanthys_smoke-loader_stealc_stop_tofsee_vertexnet.exe
Resource
win11ltsc2024-20260709-en
5 signatures
150 seconds
General
- Target 2026-08-17_300af62e3d02efc1b351420440e3bf2f_elex_karagany_rhadamanthys_smoke-loader_stealc_stop_tofsee_vertexnet.exe
- Size 143KB
- Sample260817-qsgeback6w
- SHA256 1e5bf8921662ab62c9c58b6b34aa5cb876c1800ac831d4cd6a116192899b9555
- MD5 300af62e3d02efc1b351420440e3bf2f
- SHA1 5e42e237a53f4bd14d023978600c070357c3ffaa
- SHA512 333601b351e8da1b49d7230e20ec10367c0420ac3cc43a0e83d71b795eeed7efdf9028155f1475805419c4e8206c1e2608c61e725f0c718f14ee66ae8cb5e133
- SSDEEP 3072:BsD2ADkpFGkTXlDJA6ba2esDetNxVgbTGV9X4:BplzpTVDVa2en/V6Mp
- TLSH T1FDE38C227AD0C032D06B11715A79D7B69969FA33177484C7F3840FBD6E612E09B7E34A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
vertexnet
C2
-
eu-secretdeals.info
Mutex
-
VN_MUTEX16
Attributes
-
C2Path
/VertexNet/
Signatures
- Detects VertexNET stealer 1 IoCs
resource yara_rule behavioral2/files/0x000600000001b6c1-0.dat family_vertexnet - Executes dropped EXE 1 IoCs
pid Process 2576 eu-secretdeals.info - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\vnet = "C:\\Users\\Admin\\AppData\\Local\\Temp\\eu-secretdeals.info" 2026-08-17_300af62e3d02efc1b351420440e3bf2f_elex_karagany_rhadamanthys_smoke-loader_stealc_stop_tofsee_vertexnet.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-17_300af62e3d02efc1b351420440e3bf2f_elex_karagany_rhadamanthys_smoke-loader_stealc_stop_tofsee_vertexnet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eu-secretdeals.info
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-17_300af62e3d02efc1b351420440e3bf2f_elex_karagany_rhadamanthys_smoke-loader_stealc_stop_tofsee_vertexnet.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-17_300af62e3d02efc1b351420440e3bf2f_elex_karagany_rhadamanthys_smoke-loader_stealc_stop_tofsee_vertexnet.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4192
-
C:\Users\Admin\AppData\Local\Temp\eu-secretdeals.infoC:\Users\Admin\AppData\Local\Temp\eu-secretdeals.info1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2576
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\eu-secretdeals.info
- Size 143KB
- SHA256 1e5bf8921662ab62c9c58b6b34aa5cb876c1800ac831d4cd6a116192899b9555
- MD5 300af62e3d02efc1b351420440e3bf2f
- SHA1 5e42e237a53f4bd14d023978600c070357c3ffaa
- SHA512 333601b351e8da1b49d7230e20ec10367c0420ac3cc43a0e83d71b795eeed7efdf9028155f1475805419c4e8206c1e2608c61e725f0c718f14ee66ae8cb5e133
- SSDEEP 3072:BsD2ADkpFGkTXlDJA6ba2esDetNxVgbTGV9X4:BplzpTVDVa2en/V6Mp
- TLSH T1FDE38C227AD0C032D06B11715A79D7B69969FA33177484C7F3840FBD6E612E09B7E34A
- MD5 SHA1 SHA512 SSDEEP TLSH