Analysis
- max time kernel
149s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/08/2026, 21:54
Behavioral task
behavioral1
Sample
2026-08-31_2bf521edc07000cf0f9da19af6071aba_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 2026-08-31_2bf521edc07000cf0f9da19af6071aba_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 387KB
- Sample260831-1slddaae47
- SHA256 0bf61548bc11b09c00759305b5528e587b3595373e6aa9a56bfa8044f7ffbac3
- MD5 2bf521edc07000cf0f9da19af6071aba
- SHA1 3ae03bedf7f5085df10edfd48558c92caecdaf6d
- SHA512 103e2c744ff9291ad3b49cf63ad7783de6d82ad7f334309731942dd167deff7940945698599e0624e4f3eadd5834815531b5935df8f2aa8e4823b009f757d502
- SSDEEP 6144:S8efQ6QPJGcLbjg0EuDK4UnUHOkb8734A2P6gt99Wvtxrpp29xQp4d:76QPJGcE0hKRg04zPZt9mtPOv
- TLSH T18F84BF217240C035E3A6033559A6E6F159A86E3A1794E08FF7787E795F312C3AA3324F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 876 ixzul.exe 1252 opqoa.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4320 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-31_2bf521edc07000cf0f9da19af6071aba_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ixzul.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language opqoa.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe 1252 opqoa.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5536 wrote to memory of 876 5536 2026-08-31_2bf521edc07000cf0f9da19af6071aba_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 89 PID 5536 wrote to memory of 4320 5536 2026-08-31_2bf521edc07000cf0f9da19af6071aba_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 90 PID 876 wrote to memory of 1252 876 ixzul.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-31_2bf521edc07000cf0f9da19af6071aba_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-31_2bf521edc07000cf0f9da19af6071aba_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5536 -
C:\Users\Admin\AppData\Local\Temp\ixzul.exe"C:\Users\Admin\AppData\Local\Temp\ixzul.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Users\Admin\AppData\Local\Temp\opqoa.exe"C:\Users\Admin\AppData\Local\Temp\opqoa.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1252
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4320
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
- Size 412B
- SHA256 1181c0f8ae38446d6a2631214f5a2df8b16da1fb8935de9d14cd5fbc5072a2c2
- MD5 f54e7d3ae7d7d4e4bdfdb01d86d34f15
- SHA1 ad817a0690cf59e93c4793521f23fcb7d1a86991
- SHA512 3be641fbc3eb73d6ab9874701c68c3440e0c2daa51ec438a44b54f15704b5daf5ce614dcb4002b928bace2b3106b858ce849147b68b657fa9483ced1c6994565
- TLSH T1F0E0E50180DFD92A0609D11F05ABB54EA26879183EC637346F20C24D91E944DB5B3142
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
- Size 512B
- SHA256 a3465a45876b78625918b3b4614caa842853d7f3ed12980a2ba13de9303fdd21
- MD5 0f4784ef2ee7283a2932948b70d89a87
- SHA1 6db4b80bfaca514d0c8ca00708dc7eba8195603f
- SHA512 423b6549b0611ca9d8569ef6a931716591c70fc0f0956ffa3702b59a8fa09b75d1457a3ffd870da28586292dd858d9408dae4557cd1de9e4f28710fc9a310c8d
- TLSH T134F09BDD20E5B1453317D127C2485B995F634D9C444BCFCC430A73704D3582C89992D0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ixzul.exe
- Size 387KB
- SHA256 168ee7d4d30fa2867fa0629721e318b102fc09219d6901d4ae635f8c27afae8e
- MD5 d8c81f5e633dec8f37b2ecf0572c0037
- SHA1 28c6e17d95ba387f398099d805b8354736d244e7
- SHA512 a0f57618003f432505628b15bffa838160750eb072cf07fb702d0c2a0c5af84c83066e0dde3687c0978ddd3a9c2a76ae43dae4b57a9ac14cacfbd6033bedd2a0
- SSDEEP 6144:S8efQ6QPJGcLbjg0EuDK4UnUHOkb8734A2P6gt99Wvtxrpp29xQp4m:76QPJGcE0hKRg04zPZt9mtPO4
- TLSH T14884BF217240C035E3A6033559A6E6F559A86E3A1794E08FF7787E795F312C3AA3324F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\opqoa.exe
- Size 297KB
- SHA256 615f93915af205b53228c23a3fd5e06410b693b6f55ace0816426dc585e278bb
- MD5 3e792a40439c92395a248a743e0cea5e
- SHA1 54d748f8b21bd4754bbe8d9544632ce2cf5a7389
- SHA512 3e60a850a88d3e1101ed5e979017f7a1587c6c3e298402775d5984dd7f8b3ec0e5b5763b3ddd6c4a1cb705b16e939e8538a5902941e614de583df2aaa92b2c74
- SSDEEP 6144:nzCnkGXC4JfDu67rIULCFVugtxvIKsAHp2b:nzK9fJru+IU+F6KsAMb
- TLSH T1F5547B1076508076E72A07710556EBF40AA8AE3916E4E48FF7787E392E312D39B7724F
- MD5 SHA1 SHA512 SSDEEP TLSH