8dbe8b1f6b1b49aecec104108763c87d7f306619515fc11442e8616ba64761f9

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/08/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-22_97eab0b1747e2f747ae1a69aa4046a9e_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 1.0MB
Sample260823-e1ls8axwat
SHA256 8dbe8b1f6b1b49aecec104108763c87d7f306619515fc11442e8616ba64761f9
MD5 97eab0b1747e2f747ae1a69aa4046a9e
SHA1 c2af932b61c11d6512bd9e6d5fca071e765c7cc0
SHA512 dca1906c9a2c1a220a95986f565a314d30c0fcb9005224e80c566bf6d3418b42a3ec33aee73da68ef9fbb03de5d7a296a964c10bc5a6c4b954c38f917a33730f
SSDEEP 12288:+AW0LyGgGvWhK1g0iDutUi9niuBahyqDC8hph1Dn2FGvZe4OUW:+l0LyGgGGEtV8Fp2FGvZe4O
TLSH
T1AA25BF21B640E02AE49714B25DEFC7A966287F74071D20D3B2D07FDE29B16E26F32617
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3964	iCjFn00000.exe

Executes dropped EXE 2 IoCs

pid	Process
3964	iCjFn00000.exe
4716	iCjFn00000.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\iCjFn00000 = "C:\\ProgramData\\iCjFn00000\\iCjFn00000.exe"	iCjFn00000.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_97eab0b1747e2f747ae1a69aa4046a9e_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iCjFn00000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iCjFn00000.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3964	iCjFn00000.exe
Token: SeDebugPrivilege	4716	iCjFn00000.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3964	iCjFn00000.exe
3964	iCjFn00000.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3964	iCjFn00000.exe
3964	iCjFn00000.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3964	iCjFn00000.exe
3964	iCjFn00000.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 3964	2432	2026-08-22_97eab0b1747e2f747ae1a69aa4046a9e_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-08-22_97eab0b1747e2f747ae1a69aa4046a9e_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_97eab0b1747e2f747ae1a69aa4046a9e_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2432
- C:\ProgramData\iCjFn00000\iCjFn00000.exe
  "C:\ProgramData\iCjFn00000\iCjFn00000.exe" "C:\Users\Admin\AppData\Local\Temp\2026-08-22_97eab0b1747e2f747ae1a69aa4046a9e_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3964

C:\ProgramData\iCjFn00000\iCjFn00000.exe
C:\ProgramData\iCjFn00000\iCjFn00000.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

iCjFn00000

Path C:\ProgramData\iCjFn00000\iCjFn00000
Size 104B
SHA256 da1102057ecc21aa1c51da3beec41fa3201863d9d8b4e01f2752710cb6542538
MD5 81e3510b1f57cf96ed35db53574c1261
SHA1 07ae48983b83aac95c6d3edb5763247c5b0df542
SHA512 191ca6804645b3029dc386d93c3e63734197f65e1c93511d75f52a20433ec7214f060ef32388c06be585bc1efc9b35979643360b21559ef3d005ba81929fa477
TLSH
T10EB012D50C1097405212BB207919B000E5E403019218CC7D5C1238CEC38B4151AC502C
MD5 SHA1 SHA512 TLSH

Submit Download

iCjFn00000.exe

Path C:\ProgramData\iCjFn00000\iCjFn00000.exe
Size 1.0MB
SHA256 1ed748b45ad53b6b8092c11ecefcb44b36feb206646cc3c1ab5c913675a518a8
MD5 66e6a6205dcc5afa7066edc85bd19293
SHA1 d2fc3dfeeee428f94074d6a0c1a040fc5735d74b
SHA512 05b349f307025ded28b4cd4cb27e1b7c53020c7f7f5e2aef79ee3b7577eb77cd311dbd8457f14e1f8e0eb4209ae2b28a446be5a5a44d53144f5662a580481312
SSDEEP 12288:VAW0LyGgGvWhK1g0iDutUi9niuBahyqDC8hph1Dn2FGvZe4OUW:Vl0LyGgGGEtV8Fp2FGvZe4O
TLSH
T1AE25BF21B640E02AE49714B25DEFC7A966287F74071D20D3B2D07FDE29B16E26F32617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2432-0-0x0000000000F97000-0x0000000000F98000-memory.dmp

Download

memory/3964-8-0x0000000000337000-0x0000000000338000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads