Analysis
- max time kernel
150s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/08/2026, 04:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-22_07147c5aee9189c4cad596cd451e5237_amadey_elex_karagany_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
23 signatures
150 seconds
General
- Target 2026-08-22_07147c5aee9189c4cad596cd451e5237_amadey_elex_karagany_rhadamanthys_smoke-loader.exe
- Size 4.4MB
- Sample260822-fd8vxaeq9z
- SHA256 ff7e853d1aedea3e791579bcf3e12a1e8b1433224694b0109a4798bea820895a
- MD5 07147c5aee9189c4cad596cd451e5237
- SHA1 a633582e13ef891fb46003838f2492209470ce13
- SHA512 2b62a94bc3ce2440907f7514234d4b7f500cea35acdd8b41b1080eb7cdefacdf1f338671eb683e5e15f3401f052517dc2c6771f705857e0fd2298c5bdb80d657
- SSDEEP 98304:WCfAP2MGOokxsq/9pGD3x9HcqVwVeFzUrT9zS/+owxV/:WZ5GTkOq/eDnNVwVLG/twx9
- TLSH T15126332066B5C034E6B211BAA8F397B5E92FBCB05B7819C765C423FA16A09F4DC70747
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
metasploit
Version
-
windows/single_exec
Signatures
- Family: MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
- Glupteba payload 23 IoCs
resource yara_rule behavioral1/memory/4556-2-0x0000000003860000-0x000000000417E000-memory.dmp family_glupteba behavioral1/memory/4556-5-0x0000000003860000-0x000000000417E000-memory.dmp family_glupteba behavioral1/memory/4556-4-0x0000000000400000-0x0000000002FBA000-memory.dmp family_glupteba behavioral1/memory/2128-6-0x0000000003460000-0x00000000038A0000-memory.dmp family_glupteba behavioral1/memory/2128-7-0x0000000000400000-0x0000000002FBA000-memory.dmp family_glupteba behavioral1/memory/2128-12-0x0000000000400000-0x0000000002FBA000-memory.dmp family_glupteba behavioral1/memory/908-18-0x0000000000400000-0x0000000002FBA000-memory.dmp family_glupteba behavioral1/memory/4200-21-0x0000000000400000-0x0000000002FBA000-memory.dmp family_glupteba behavioral1/memory/2996-22-0x0000000000400000-0x0000000002FBA000-memory.dmp family_glupteba behavioral1/memory/3356-24-0x0000000000400000-0x0000000002FBA000-memory.dmp family_glupteba behavioral1/memory/2996-26-0x0000000000400000-0x0000000002FBA000-memory.dmp family_glupteba behavioral1/memory/2504-27-0x0000000000400000-0x0000000002FBA000-memory.dmp family_glupteba behavioral1/memory/2996-33-0x0000000000400000-0x0000000002FBA000-memory.dmp family_glupteba behavioral1/memory/2996-34-0x0000000000400000-0x0000000002FBA000-memory.dmp family_glupteba behavioral1/memory/2996-35-0x0000000000400000-0x0000000002FBA000-memory.dmp family_glupteba behavioral1/memory/2996-36-0x0000000000400000-0x0000000002FBA000-memory.dmp family_glupteba behavioral1/memory/2996-37-0x0000000000400000-0x0000000002FBA000-memory.dmp family_glupteba behavioral1/memory/2996-38-0x0000000000400000-0x0000000002FBA000-memory.dmp family_glupteba behavioral1/memory/2996-39-0x0000000000400000-0x0000000002FBA000-memory.dmp family_glupteba behavioral1/memory/2996-40-0x0000000000400000-0x0000000002FBA000-memory.dmp family_glupteba behavioral1/memory/2996-41-0x0000000000400000-0x0000000002FBA000-memory.dmp family_glupteba behavioral1/memory/2996-42-0x0000000000400000-0x0000000002FBA000-memory.dmp family_glupteba behavioral1/memory/2996-45-0x0000000000400000-0x0000000002FBA000-memory.dmp family_glupteba - Detects Windows executables referencing non-Windows User-Agents 20 IoCs
resource yara_rule behavioral1/memory/4556-4-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/2128-7-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/2128-12-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/908-18-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/4200-21-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/2996-22-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/3356-24-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/2996-26-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/2504-27-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/2996-33-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/2996-34-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/2996-35-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/2996-36-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/2996-37-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/2996-38-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/2996-39-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/2996-40-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/2996-41-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/2996-42-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/2996-45-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA - Detects executables containing URLs to raw contents of a Github gist 20 IoCs
resource yara_rule behavioral1/memory/4556-4-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral1/memory/2128-7-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral1/memory/2128-12-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral1/memory/908-18-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral1/memory/4200-21-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral1/memory/2996-22-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral1/memory/3356-24-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral1/memory/2996-26-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral1/memory/2504-27-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral1/memory/2996-33-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral1/memory/2996-34-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral1/memory/2996-35-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral1/memory/2996-36-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral1/memory/2996-37-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral1/memory/2996-38-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral1/memory/2996-39-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral1/memory/2996-40-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral1/memory/2996-41-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral1/memory/2996-42-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral1/memory/2996-45-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables referencing many varying, potentially fake Windows User-Agents 20 IoCs
resource yara_rule behavioral1/memory/4556-4-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral1/memory/2128-7-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral1/memory/2128-12-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral1/memory/908-18-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral1/memory/4200-21-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral1/memory/2996-22-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral1/memory/3356-24-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral1/memory/2996-26-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral1/memory/2504-27-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral1/memory/2996-33-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral1/memory/2996-34-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral1/memory/2996-35-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral1/memory/2996-36-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral1/memory/2996-37-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral1/memory/2996-38-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral1/memory/2996-39-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral1/memory/2996-40-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral1/memory/2996-41-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral1/memory/2996-42-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA behavioral1/memory/2996-45-0x0000000000400000-0x0000000002FBA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 848 netsh.exe - Executes dropped EXE 6 IoCs
pid Process 2996 csrss.exe 908 csrss.exe 4200 csrss.exe 3356 csrss.exe 2504 csrss.exe 1124 injector.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BitterSound = "\"C:\\Windows\\rss\\csrss.exe\"" 2026-08-22_07147c5aee9189c4cad596cd451e5237_amadey_elex_karagany_rhadamanthys_smoke-loader.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
description ioc Process File opened for modification \??\WinMonFS csrss.exe - Drops file in System32 directory 6 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FFA110365478402FA10A3985CC7CA2D csrss.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft csrss.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache csrss.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData csrss.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FFA110365478402FA10A3985CC7CA2D csrss.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content csrss.exe - Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN 2026-08-22_07147c5aee9189c4cad596cd451e5237_amadey_elex_karagany_rhadamanthys_smoke-loader.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\rss 2026-08-22_07147c5aee9189c4cad596cd451e5237_amadey_elex_karagany_rhadamanthys_smoke-loader.exe File created C:\Windows\rss\csrss.exe 2026-08-22_07147c5aee9189c4cad596cd451e5237_amadey_elex_karagany_rhadamanthys_smoke-loader.exe - Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3756 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-22_07147c5aee9189c4cad596cd451e5237_amadey_elex_karagany_rhadamanthys_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-22_07147c5aee9189c4cad596cd451e5237_amadey_elex_karagany_rhadamanthys_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe - Modifies data under HKEY_USERS 41 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs csrss.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2888 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4556 2026-08-22_07147c5aee9189c4cad596cd451e5237_amadey_elex_karagany_rhadamanthys_smoke-loader.exe 4556 2026-08-22_07147c5aee9189c4cad596cd451e5237_amadey_elex_karagany_rhadamanthys_smoke-loader.exe 2128 2026-08-22_07147c5aee9189c4cad596cd451e5237_amadey_elex_karagany_rhadamanthys_smoke-loader.exe 2128 2026-08-22_07147c5aee9189c4cad596cd451e5237_amadey_elex_karagany_rhadamanthys_smoke-loader.exe 2128 2026-08-22_07147c5aee9189c4cad596cd451e5237_amadey_elex_karagany_rhadamanthys_smoke-loader.exe 2128 2026-08-22_07147c5aee9189c4cad596cd451e5237_amadey_elex_karagany_rhadamanthys_smoke-loader.exe 2128 2026-08-22_07147c5aee9189c4cad596cd451e5237_amadey_elex_karagany_rhadamanthys_smoke-loader.exe 2128 2026-08-22_07147c5aee9189c4cad596cd451e5237_amadey_elex_karagany_rhadamanthys_smoke-loader.exe 2128 2026-08-22_07147c5aee9189c4cad596cd451e5237_amadey_elex_karagany_rhadamanthys_smoke-loader.exe 2128 2026-08-22_07147c5aee9189c4cad596cd451e5237_amadey_elex_karagany_rhadamanthys_smoke-loader.exe 2128 2026-08-22_07147c5aee9189c4cad596cd451e5237_amadey_elex_karagany_rhadamanthys_smoke-loader.exe 2128 2026-08-22_07147c5aee9189c4cad596cd451e5237_amadey_elex_karagany_rhadamanthys_smoke-loader.exe 908 csrss.exe 908 csrss.exe 3356 csrss.exe 3356 csrss.exe 2996 csrss.exe 2996 csrss.exe 1124 injector.exe 1124 injector.exe 1124 injector.exe 1124 injector.exe 1124 injector.exe 1124 injector.exe 1124 injector.exe 1124 injector.exe 1124 injector.exe 1124 injector.exe 1124 injector.exe 1124 injector.exe 1124 injector.exe 1124 injector.exe 1124 injector.exe 1124 injector.exe 1124 injector.exe 1124 injector.exe 1124 injector.exe 1124 injector.exe 1124 injector.exe 1124 injector.exe 1124 injector.exe 1124 injector.exe 1124 injector.exe 1124 injector.exe 1124 injector.exe 1124 injector.exe 1124 injector.exe 1124 injector.exe 1124 injector.exe 1124 injector.exe 1124 injector.exe 1124 injector.exe 1124 injector.exe 1124 injector.exe 1124 injector.exe 1124 injector.exe 1124 injector.exe 1124 injector.exe 1124 injector.exe 1124 injector.exe 1124 injector.exe 1124 injector.exe 1124 injector.exe 1124 injector.exe - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 4556 2026-08-22_07147c5aee9189c4cad596cd451e5237_amadey_elex_karagany_rhadamanthys_smoke-loader.exe Token: SeImpersonatePrivilege 4556 2026-08-22_07147c5aee9189c4cad596cd451e5237_amadey_elex_karagany_rhadamanthys_smoke-loader.exe Token: SeSystemEnvironmentPrivilege 2128 2026-08-22_07147c5aee9189c4cad596cd451e5237_amadey_elex_karagany_rhadamanthys_smoke-loader.exe Token: SeDebugPrivilege 908 csrss.exe Token: SeImpersonatePrivilege 908 csrss.exe Token: SeSystemEnvironmentPrivilege 2996 csrss.exe Token: SeDebugPrivilege 3356 csrss.exe Token: SeImpersonatePrivilege 3356 csrss.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2128 wrote to memory of 3756 2128 2026-08-22_07147c5aee9189c4cad596cd451e5237_amadey_elex_karagany_rhadamanthys_smoke-loader.exe 93 PID 3756 wrote to memory of 848 3756 cmd.exe 95 PID 2128 wrote to memory of 2996 2128 2026-08-22_07147c5aee9189c4cad596cd451e5237_amadey_elex_karagany_rhadamanthys_smoke-loader.exe 96 PID 2996 wrote to memory of 1124 2996 csrss.exe 114 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-22_07147c5aee9189c4cad596cd451e5237_amadey_elex_karagany_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-22_07147c5aee9189c4cad596cd451e5237_amadey_elex_karagany_rhadamanthys_smoke-loader.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\2026-08-22_07147c5aee9189c4cad596cd451e5237_amadey_elex_karagany_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-22_07147c5aee9189c4cad596cd451e5237_amadey_elex_karagany_rhadamanthys_smoke-loader.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:848
-
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe /51-513⤵
- Executes dropped EXE
- Manipulates WinMonFS driver.
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Scheduled Task/Job: Scheduled Task
PID:2888
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1124
-
-
-
-
C:\Windows\rss\csrss.exe"C:\Windows\rss\csrss.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:908 -
C:\Windows\rss\csrss.exe"C:\Windows\rss\csrss.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4200
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3356 -
C:\Windows\rss\csrss.exe"C:\Windows\rss\csrss.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2504
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
- Size 281KB
- SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
- MD5 d98e33b66343e7c96158444127a117f6
- SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
- SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
- SSDEEP 3072:qbHszDaOJ8u2HHFIWr6e29kOnK7qFQ8wMii5I7kGvNjzMuszHshoY46bEydJ+dK9:SA3IlIA6e29vngqS8wMmuooh8z+8F
- TLSH T17B546C5AB2A918F8ED77823CC8525516F672B8160730D6EF03A447672F276E09D3FB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\rss\csrss.exe
- Size 4.4MB
- SHA256 ff7e853d1aedea3e791579bcf3e12a1e8b1433224694b0109a4798bea820895a
- MD5 07147c5aee9189c4cad596cd451e5237
- SHA1 a633582e13ef891fb46003838f2492209470ce13
- SHA512 2b62a94bc3ce2440907f7514234d4b7f500cea35acdd8b41b1080eb7cdefacdf1f338671eb683e5e15f3401f052517dc2c6771f705857e0fd2298c5bdb80d657
- SSDEEP 98304:WCfAP2MGOokxsq/9pGD3x9HcqVwVeFzUrT9zS/+owxV/:WZ5GTkOq/eDnNVwVLG/twx9
- TLSH T15126332066B5C034E6B211BAA8F397B5E92FBCB05B7819C765C423FA16A09F4DC70747
- MD5 SHA1 SHA512 SSDEEP TLSH