Analysis
- max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/09/2026, 23:03
Behavioral task
behavioral1
Sample
2026-09-16_29dde709340c35a1440c49080fe45dff_elex_karagany_rhadamanthys_smoke-loader_stealc_stop_tofsee_vertexnet.exe
Resource
win10v2004-20260911-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-16_29dde709340c35a1440c49080fe45dff_elex_karagany_rhadamanthys_smoke-loader_stealc_stop_tofsee_vertexnet.exe
Resource
win11ltsc2024-20260911-en
5 signatures
150 seconds
General
- Target 2026-09-16_29dde709340c35a1440c49080fe45dff_elex_karagany_rhadamanthys_smoke-loader_stealc_stop_tofsee_vertexnet.exe
- Size 143KB
- Sample260916-21tkdsfc97
- SHA256 1bc705e20dcb5e0c93d806eca4d784fd3acaff2c6adfa4d8761b52f4620af14e
- MD5 29dde709340c35a1440c49080fe45dff
- SHA1 035399118d8a8e816167cf9ad534c48997a99660
- SHA512 eff1f803154616930586768c85bcdfd4b01f98251b6a7380262fada471965428182e8e2494f5b11a9addcb9b047c1aabe61afdf6feff2088174c7ae1b62d9f71
- SSDEEP 3072:RsD2ADkpFGkTXlDJA6ba2esDetNxVgbTGV9X4:RplzpTVDVa2en/V6Mp
- TLSH T1CAE38C2279D0C032D06B11715AB9D7B5996AFA33177484C7F3840FBD6E612E09B7E34A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
vertexnet
C2
-
soicau7ball.com
Mutex
-
VN_MUTEX16
Attributes
-
C2Path
/login/
Signatures
- Detects VertexNET stealer 1 IoCs
resource yara_rule behavioral1/files/0x0008000000022adf-2.dat family_vertexnet - Executes dropped EXE 1 IoCs
pid Process 1200 soicau7ball.com - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vnet = "C:\\Users\\Admin\\AppData\\Local\\Temp\\soicau7ball.com" 2026-09-16_29dde709340c35a1440c49080fe45dff_elex_karagany_rhadamanthys_smoke-loader_stealc_stop_tofsee_vertexnet.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-16_29dde709340c35a1440c49080fe45dff_elex_karagany_rhadamanthys_smoke-loader_stealc_stop_tofsee_vertexnet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language soicau7ball.com
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-16_29dde709340c35a1440c49080fe45dff_elex_karagany_rhadamanthys_smoke-loader_stealc_stop_tofsee_vertexnet.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-16_29dde709340c35a1440c49080fe45dff_elex_karagany_rhadamanthys_smoke-loader_stealc_stop_tofsee_vertexnet.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4868
-
C:\Users\Admin\AppData\Local\Temp\soicau7ball.comC:\Users\Admin\AppData\Local\Temp\soicau7ball.com1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1200
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\soicau7ball.com
- Size 143KB
- SHA256 1bc705e20dcb5e0c93d806eca4d784fd3acaff2c6adfa4d8761b52f4620af14e
- MD5 29dde709340c35a1440c49080fe45dff
- SHA1 035399118d8a8e816167cf9ad534c48997a99660
- SHA512 eff1f803154616930586768c85bcdfd4b01f98251b6a7380262fada471965428182e8e2494f5b11a9addcb9b047c1aabe61afdf6feff2088174c7ae1b62d9f71
- SSDEEP 3072:RsD2ADkpFGkTXlDJA6ba2esDetNxVgbTGV9X4:RplzpTVDVa2en/V6Mp
- TLSH T1CAE38C2279D0C032D06B11715AB9D7B5996AFA33177484C7F3840FBD6E612E09B7E34A
- MD5 SHA1 SHA512 SSDEEP TLSH