0cafa34165f6e64dc0a60ea3e755d6f0012aaa61b347e62f86c29d4ff98b909f

General

Target
2026-08-22_3d791551bca1d722671c412e8fe1a79a_elex_rhadamanthys_smoke-loader_stealc_tofsee.exe
Size 1.4MB
Sample260823-llsrjsvgna
SHA256 0cafa34165f6e64dc0a60ea3e755d6f0012aaa61b347e62f86c29d4ff98b909f
MD5 3d791551bca1d722671c412e8fe1a79a
SHA1 1a906f771758841388f3d6d2e0fde57e708650a8
SHA512 d98646dc60f04d99ba5403ad2476d45a99bdfe23e4129ce1b1176cad4dc342c65ed3055b6d65231e227a156b775d93550e21ca543a0b0158e540504450547c02
SSDEEP 24576:w7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOMnvaYA+w5BMGmA0UTP6:L6F0eMpAAYEhpZnjhwXPn0UTi
TLSH
T191657D64F783C4F5F92314F0444BE7FBA530AE2540318D6BFBC9EF11BA72A926529606
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2128	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_3d791551bca1d722671c412e8fe1a79a_elex_rhadamanthys_smoke-loader_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3892 wrote to memory of 2128	3892	2026-08-22_3d791551bca1d722671c412e8fe1a79a_elex_rhadamanthys_smoke-loader_stealc_tofsee.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-08-22_3d791551bca1d722671c412e8fe1a79a_elex_rhadamanthys_smoke-loader_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_3d791551bca1d722671c412e8fe1a79a_elex_rhadamanthys_smoke-loader_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3892
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OneDrive.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
Size 3.5MB
SHA256 134b506ff2b426b281e92fd4422910d93824a9401f6b3af34fcd283b9fc4a8be
MD5 b668212ce1538c3be3daa9b5e1d9ef22
SHA1 6f73d2c38315c73cdd128113ffc1fd8209c24bef
SHA512 4211bd151f746292b840d94c4e6d0b9be4ca37bba00e994a6f6a550594b7ee5afc141b95478de60203fbb8bb722385734d338dc3b6b7ca973e5b1e5ff05e5799
SSDEEP 24576:z7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsObqwHRs47WXnueVulvspdbl:Q6F0eMpAAYEhpqqy37WXnu6ulvKdfLMq
TLSH
T145F539E2BE92F0B1E4D20CB1390BE6BED5237C348C238997B783F72D6573651562A116
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX5762.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX5762.tmp
Size 1.2MB
SHA256 7999e6bec3442107b9a51b485b1c188213bb2010f1bbb09ed0630b91f41ab0ec
MD5 7455e66a194e2313f75441e5518c1fb5
SHA1 e1fa6e19995ba1b3b2041a503a6717e1b9dd4f63
SHA512 8814182549011c3c2e776aa9bf0f230cb7d091fc56e25ed3e293af1d2b11cbe692b417c7ce6d94a9fd41aed2519bfa8b7a646b219522e104fe6ec545dd02859c
SSDEEP 24576:w7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOMnvaYA+w5B:L6F0eMpAAYEhpZnjhwX
TLSH
T13E456C94E783C4F5FD2314F1444FE7FBA5309E1940318D6BFBC8EE11BAB2A622529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX5A14.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX5A14.tmp
Size 1.2MB
SHA256 df525f1499a16eaf131230537ff4a31d18beeca02cdd4d1276b7f509148187cb
MD5 eee1940321a716822bffff258916b027
SHA1 f31c762ff52ceaf421fe8bef97d04497af5e304c
SHA512 42b0bf20b570d735a9fab14c92c70ab9d6030e935cd04e65f8edb716a37fc5910d62b7c35020fd50d915d4c37adf5c2315563441313813c9432878bf15b7312f
SSDEEP 24576:Y7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOxnvaYA+wD/:z6F0eMpAAYEhpgnjhwb
TLSH
T123456C94E783C4F5FD2314F1444FE7FBA5309E1940318D6BFBC8EE11BAB2A622529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX5A25.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX5A25.tmp
Size 1.2MB
SHA256 5437f13b18fe6de790273a18a5399e0fee7d7b4bf9746256fe0e68047c38543b
MD5 2a9605416faa0fb5e2a0c1ba6d84ef66
SHA1 d3a1d1868eaa8dbbb37fc48cc01b85c310be3442
SHA512 ff98107375e60fea75a51f9bfa0a991d2d5a75d82a4d3228acf476a2fb7e8f47028714e87fe1bdf077fc959e4d57c04a8d836b1297dfc45df33981fa1ef404bc
SSDEEP 24576:w7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOanvaYA+w5R:L6F0eMpAAYEhp7njhwn
TLSH
T13E456C54E783C4F5FD2314F1444FE7FBA5309E1A40318D6BFBC8EE11BAB2A622529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 186KB
SHA256 1aa3927c7985386d42759656665c7b422ee226df16a19446af6d9a6613b8ae9b
MD5 2124a793ac7d675e1b2d5fdee19a87d0
SHA1 3a1a6ae7c218e41c4eb303c548db9ec06bd6a6b5
SHA512 d5b7b789108c00901e96a3f336c2176a6e7f50e73cb485974e8bb7af1b513b099e88eb6800ed1f0c53969a86a6870130a477c9b17cad0e00f9de4ac90252e051
SSDEEP 3072:81TlCN3DeL0dA/VkvpS6zpQDt0v2E6LGHxdOWTtDwqytR2TBf9AqqpUwIT:ilGXd4OvDzewKLGHj0qTBlznBT
TLSH
T161146B2472D1C072E163207446B5C7F64E7ABC716662B88FABCB1BB64F346D1D22934E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3892-260-0x0000000000400000-0x000000000053D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads