c0ab576ce1c3fead69ff4e41f9dc5db2c1a4885a834ae6c0612b8193b914bd19

Analysis

max time kernel
150s
max time network
75s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 21:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_4e0eaf8184a9c623ffd84baddb1b10c6_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 1.0MB
Sample260820-1tsh3swdkd
SHA256 c0ab576ce1c3fead69ff4e41f9dc5db2c1a4885a834ae6c0612b8193b914bd19
MD5 4e0eaf8184a9c623ffd84baddb1b10c6
SHA1 70819d672084babc2fb04ed396f8cf0e113dc2fb
SHA512 ee2df96bc2d51dd3363efe0a1b806279bc83b8b07aac9e5d72c08c635634fedc664b2035e5cc614d33cda125b7d1487d751b0c1ec57950acc789d3b00992ea40
SSDEEP 12288:ZAW0LyGgGvWhK1g0iDutUi9niuBahyqDC8hph1Dn2FGvZe4OUW:Zl0LyGgGGEtV8Fp2FGvZe4O
TLSH
T14A25BF21B640E02AE49714B25DEFC7A966287F74071D20D3B2D07FDE29B16E26F32617
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1744	oNmHp00000.exe

Executes dropped EXE 2 IoCs

pid	Process
1744	oNmHp00000.exe
4500	oNmHp00000.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\oNmHp00000 = "C:\\ProgramData\\oNmHp00000\\oNmHp00000.exe"	oNmHp00000.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_4e0eaf8184a9c623ffd84baddb1b10c6_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oNmHp00000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oNmHp00000.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1744	oNmHp00000.exe
Token: SeDebugPrivilege	4500	oNmHp00000.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1744	oNmHp00000.exe
1744	oNmHp00000.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1744	oNmHp00000.exe
1744	oNmHp00000.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1744	oNmHp00000.exe
1744	oNmHp00000.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 1744	4636	2026-08-20_4e0eaf8184a9c623ffd84baddb1b10c6_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-20_4e0eaf8184a9c623ffd84baddb1b10c6_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_4e0eaf8184a9c623ffd84baddb1b10c6_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4636
- C:\ProgramData\oNmHp00000\oNmHp00000.exe
  "C:\ProgramData\oNmHp00000\oNmHp00000.exe" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_4e0eaf8184a9c623ffd84baddb1b10c6_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1744

C:\ProgramData\oNmHp00000\oNmHp00000.exe
C:\ProgramData\oNmHp00000\oNmHp00000.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

oNmHp00000

Path C:\ProgramData\oNmHp00000\oNmHp00000
Size 104B
SHA256 328aae4bed663de99c4871f642e2e9e6b6694e9a970c95eda99bca1072d83f62
MD5 6d429f72d0b78839ed4193bdcf99b2a7
SHA1 98ad8eb489a0187b3d388ce45dcdb724aa736acb
SHA512 1c8156d5bf38f1dc32655815a920e167ecee4ebc2de6f9e1c5d5713b03fa81fda97636f1b03e5e9c5c0379fed7d768b9165111e6644adcb5757d12653b6db1d2
TLSH
T1C3B0127161C5C9DCB8F55EF813CC7445E40A6E32398CCE342A6CE647E310963B4C08C4
MD5 SHA1 SHA512 TLSH

Submit Download

oNmHp00000.exe

Path C:\ProgramData\oNmHp00000\oNmHp00000.exe
Size 1.0MB
SHA256 2fae400d7efce95dfb1d5eef64d768b3f6f30f73c1a785eed95f3a5a44f25eec
MD5 3a7d94020f5c46ee78bcd8b9c8235f22
SHA1 1100d13c0930abac654410bb2d9899241062131a
SHA512 3987ef7c3dd5b0702b073820cea09520da2453b5019ad58c22e95d21c0562deafc91ff39a0571de5d333eb34a99d523ff611be27ac43817dedd00435c67e552e
SSDEEP 12288:lAW0LyGgGvWhK1g0iDutUi9niuBahyqDC8hph1Dn2FGvZe4OUW:ll0LyGgGGEtV8Fp2FGvZe4O
TLSH
T13F25BF21B640E02AE49714B25DEFC7A966287F74071D20D3B2D07FDE29B16E26F32617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1744-9-0x0000000000717000-0x0000000000718000-memory.dmp

Download

memory/4636-0-0x0000000000A77000-0x0000000000A78000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads