76b9205a019db0aadf6569548b46b3c104e39d1d005fc998015a336a7e220cb3

General

Target
2026-08-24_cab1e8fb86b8e2c73d597e9d552f592c_elex_rhadamanthys_smoke-loader_stealc_tofsee.exe
Size 1.3MB
Sample260825-bhp65swapf
SHA256 76b9205a019db0aadf6569548b46b3c104e39d1d005fc998015a336a7e220cb3
MD5 cab1e8fb86b8e2c73d597e9d552f592c
SHA1 3ef96817c4da3eda79a5354cab5f6d5507c0eeee
SHA512 248508688719718d50b2b9307f07185a902b1e6439a9cca50e50a9e13d29f72a7a4b590a1cabdc1776c9b884e092c25f05ca94295a0c8786f69a92af26b2d3ef
SSDEEP 24576:97VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOg3YA+wcZMGmA0UTP9:W6F0eMpAAYEhpTohwIPn0UTl
TLSH
T183556C54F783C4F2E92310F0444BE7FB9530AE2580318D6BFBC9FF11BAB2A526569616
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4728	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-24_cab1e8fb86b8e2c73d597e9d552f592c_elex_rhadamanthys_smoke-loader_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 4728	4588	2026-08-24_cab1e8fb86b8e2c73d597e9d552f592c_elex_rhadamanthys_smoke-loader_stealc_tofsee.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-24_cab1e8fb86b8e2c73d597e9d552f592c_elex_rhadamanthys_smoke-loader_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_cab1e8fb86b8e2c73d597e9d552f592c_elex_rhadamanthys_smoke-loader_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OneDriveSetup.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe
Size 28.0MB
SHA256 ff372b85a9f38f397881ae1b11aa85ac0af33d3cd709a59a328b5f6a979b9f12
MD5 4dd9fff31f2d594bd39ecb628b0b33a0
SHA1 a45c6cd4da113ba29b8b6618adde485e2e82041f
SHA512 27693d37c307c7744c93e7f43545cff6a1488ad2cf1b0d125b723efc4de4e144cfa6598577d3834907f241a2691c2904a66f62c83371d2d274a19db04ab9a105
SSDEEP 393216:+Jlw5ZbDO6RGmb8hFZtxwbTNXp3YCkxJoPMAvqkWgoj6RVFK+q3HvUUw0vX3:+/WO1c877xqpyovvVWJ6VFK+q3cSvX3
TLSH
T1D65712D1BFD9A070F4A306707979967E4537BC214B32C1DB6287F61C2A709D16A3AB23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDrive.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
Size 3.5MB
SHA256 a9133c37617715b2423f5ac9c51768ee4bcaa3b1e016961a6614e74cf86b11dc
MD5 2e1f19bd3bfcdb5aeceb481f19c4c70d
SHA1 0afd1d3b6196cdc2b63b17519a990a6d71f97752
SHA512 2dc71a3b05eb0bec5806e734359eb0cfa7c2b08ed57ea644ba4f07d01902c46acaa3d5af38821ae7199151ce9e682833afc1cc514f31fd36a9503bb1b8ec62da
SSDEEP 24576:T7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOsqVWRs47WXnueVulvspdb3:w6F0eMpAAYEhpFqo37WXnu6ulvKdfLME
TLSH
T150F539E2BE92F0B1E4D20CB1390BE6BED5237C348C238997B783F72D6573651562A116
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX4895.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX4895.tmp
Size 1.1MB
SHA256 e243a94789d37c34d6607f1d3c18eb389c49c0f4627d1dc2852a00f68641f41c
MD5 b939b70a274f39314e60aa55e9fd03fd
SHA1 bb075848dc378de1f986957296cf77034ac56180
SHA512 1e347748f53e17dec56d253fd3d504cd4b4692da1dc2ab00273a9161cf7bd4b06ce173bba3db72cd692bef1d75e2cae16deab96873b309ae7c39787a05e914a2
SSDEEP 24576:97VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO53YA+wpp:W6F0eMpAAYEhpmohwP
TLSH
T14A455C54E783C5F6ED2310F0444BE7FBA5309E2980318D67FBC8FE11BAB2E522569616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 186KB
SHA256 1aa3927c7985386d42759656665c7b422ee226df16a19446af6d9a6613b8ae9b
MD5 2124a793ac7d675e1b2d5fdee19a87d0
SHA1 3a1a6ae7c218e41c4eb303c548db9ec06bd6a6b5
SHA512 d5b7b789108c00901e96a3f336c2176a6e7f50e73cb485974e8bb7af1b513b099e88eb6800ed1f0c53969a86a6870130a477c9b17cad0e00f9de4ac90252e051
SSDEEP 3072:81TlCN3DeL0dA/VkvpS6zpQDt0v2E6LGHxdOWTtDwqytR2TBf9AqqpUwIT:ilGXd4OvDzewKLGHj0qTBlznBT
TLSH
T161146B2472D1C072E163207446B5C7F64E7ABC716662B88FABCB1BB64F346D1D22934E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 f905371a5beaef3521ccc1fa1ac9991bda7893a5f73171b01ce9b0ede1c4c546
MD5 584250e02b1361d63caa1eacb600a387
SHA1 b5f807fd9ef5ed1f94eaf4ab20e6678ab0d1202f
SHA512 c0d95d3f3934cd906ef1456f44cdeb35be748073007b386bfc12bb9904fe3a9274cdb95d251a02438f9184b0aacacc133e4c902a60da8f89333ffaa473c77789
SSDEEP 24576:97VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOg3YA+wcZ:W6F0eMpAAYEhpTohwI
TLSH
T1E3455B54E783C5F6ED2310F0444BE7FBA5309E2980318D67FBC8FE11BAB2E522569616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4588-156-0x0000000000400000-0x000000000052D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads