Analysis
- max time kernel
36s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/09/2026, 23:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
21 signatures
150 seconds
General
- Target 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 253KB
- Sample260924-3j7lcssz2p
- SHA256 8d4f2e23f2489e50ec0026465dab0055f000df0280ebe68ee44bb1081298b001
- MD5 c292e855d58d4bbfbe41204002f4aa27
- SHA1 8be1b11720d0bcd10ce869a10012b242435e4fa0
- SHA512 c70f6dda88810da5888cd045fb50b6e208e4b1deca158f0d68018e72ac64dd64fc93ffd60a230015b3ed654d2447736bf70458f4edc507ddd83bd0ba0e0c83be
- SSDEEP 6144:65wAJyQJ1MLgEfLopykMXN95hFT8uXzZ6:G7BJ1McEMpjCL73
- TLSH T1164401517841B473ED30C57A848688A94ABDBD215B63E9477A403BFF3F712F1A8321E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
-
http://www.klkjwre9fqwieluoi.info/
-
http://kukutrustnet777888.info/
Signatures
- Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" CacheMgr.exe - UAC bypass 3 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" CacheMgr.exe - Windows security bypass 2 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe - Detects Reflective DLL injection artifacts 4 IoCs
resource yara_rule behavioral2/memory/1604-11-0x0000000001C20000-0x0000000001C36000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader behavioral2/memory/5064-36-0x0000000000C90000-0x0000000000CA6000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader behavioral2/memory/1604-38-0x0000000001C20000-0x0000000001C36000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader behavioral2/memory/5064-39-0x0000000000C90000-0x0000000000CA6000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 50 IoCs
resource yara_rule behavioral2/memory/1604-2-0x0000000000B70000-0x0000000001BFE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1604-5-0x0000000000B70000-0x0000000001BFE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1604-13-0x0000000000B70000-0x0000000001BFE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1604-14-0x0000000000B70000-0x0000000001BFE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1604-12-0x0000000000B70000-0x0000000001BFE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1604-9-0x0000000000B70000-0x0000000001BFE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1604-8-0x0000000000B70000-0x0000000001BFE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1604-7-0x0000000000B70000-0x0000000001BFE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1604-10-0x0000000000B70000-0x0000000001BFE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1604-6-0x0000000000B70000-0x0000000001BFE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1604-25-0x0000000000B70000-0x0000000001BFE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5064-44-0x0000000003140000-0x00000000041CE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5064-43-0x0000000003140000-0x00000000041CE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5064-45-0x0000000003140000-0x00000000041CE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5064-46-0x0000000003140000-0x00000000041CE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5064-47-0x0000000003140000-0x00000000041CE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5064-48-0x0000000003140000-0x00000000041CE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5064-50-0x0000000003140000-0x00000000041CE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5064-49-0x0000000003140000-0x00000000041CE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5064-54-0x0000000003140000-0x00000000041CE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5064-56-0x0000000003140000-0x00000000041CE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5064-57-0x0000000003140000-0x00000000041CE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5064-58-0x0000000003140000-0x00000000041CE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5064-59-0x0000000003140000-0x00000000041CE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5064-60-0x0000000003140000-0x00000000041CE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5064-61-0x0000000003140000-0x00000000041CE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5064-63-0x0000000003140000-0x00000000041CE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5064-65-0x0000000003140000-0x00000000041CE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5064-66-0x0000000003140000-0x00000000041CE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5064-68-0x0000000003140000-0x00000000041CE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5064-71-0x0000000003140000-0x00000000041CE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5064-72-0x0000000003140000-0x00000000041CE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5064-74-0x0000000003140000-0x00000000041CE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5064-76-0x0000000003140000-0x00000000041CE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5064-78-0x0000000003140000-0x00000000041CE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5064-83-0x0000000003140000-0x00000000041CE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5064-86-0x0000000003140000-0x00000000041CE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5064-88-0x0000000003140000-0x00000000041CE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5064-90-0x0000000003140000-0x00000000041CE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5064-92-0x0000000003140000-0x00000000041CE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5064-93-0x0000000003140000-0x00000000041CE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5064-95-0x0000000003140000-0x00000000041CE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5064-97-0x0000000003140000-0x00000000041CE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5064-100-0x0000000003140000-0x00000000041CE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5064-101-0x0000000003140000-0x00000000041CE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5064-103-0x0000000003140000-0x00000000041CE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5064-105-0x0000000003140000-0x00000000041CE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5064-107-0x0000000003140000-0x00000000041CE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5064-109-0x0000000003140000-0x00000000041CE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/files/0x000c00000001c5ea-112.dat INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 52 IoCs
resource yara_rule behavioral2/memory/1604-2-0x0000000000B70000-0x0000000001BFE000-memory.dmp UPX behavioral2/memory/1604-5-0x0000000000B70000-0x0000000001BFE000-memory.dmp UPX behavioral2/memory/1604-13-0x0000000000B70000-0x0000000001BFE000-memory.dmp UPX behavioral2/memory/1604-14-0x0000000000B70000-0x0000000001BFE000-memory.dmp UPX behavioral2/memory/1604-12-0x0000000000B70000-0x0000000001BFE000-memory.dmp UPX behavioral2/memory/1604-9-0x0000000000B70000-0x0000000001BFE000-memory.dmp UPX behavioral2/memory/1604-8-0x0000000000B70000-0x0000000001BFE000-memory.dmp UPX behavioral2/memory/1604-7-0x0000000000B70000-0x0000000001BFE000-memory.dmp UPX behavioral2/memory/1604-10-0x0000000000B70000-0x0000000001BFE000-memory.dmp UPX behavioral2/memory/1604-6-0x0000000000B70000-0x0000000001BFE000-memory.dmp UPX behavioral2/memory/5064-31-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral2/memory/1604-25-0x0000000000B70000-0x0000000001BFE000-memory.dmp UPX behavioral2/memory/1604-37-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral2/memory/5064-44-0x0000000003140000-0x00000000041CE000-memory.dmp UPX behavioral2/memory/5064-43-0x0000000003140000-0x00000000041CE000-memory.dmp UPX behavioral2/memory/5064-45-0x0000000003140000-0x00000000041CE000-memory.dmp UPX behavioral2/memory/5064-46-0x0000000003140000-0x00000000041CE000-memory.dmp UPX behavioral2/memory/5064-47-0x0000000003140000-0x00000000041CE000-memory.dmp UPX behavioral2/memory/5064-48-0x0000000003140000-0x00000000041CE000-memory.dmp UPX behavioral2/memory/5064-50-0x0000000003140000-0x00000000041CE000-memory.dmp UPX behavioral2/memory/5064-49-0x0000000003140000-0x00000000041CE000-memory.dmp UPX behavioral2/memory/5064-54-0x0000000003140000-0x00000000041CE000-memory.dmp UPX behavioral2/memory/5064-56-0x0000000003140000-0x00000000041CE000-memory.dmp UPX behavioral2/memory/5064-57-0x0000000003140000-0x00000000041CE000-memory.dmp UPX behavioral2/memory/5064-58-0x0000000003140000-0x00000000041CE000-memory.dmp UPX behavioral2/memory/5064-59-0x0000000003140000-0x00000000041CE000-memory.dmp UPX behavioral2/memory/5064-60-0x0000000003140000-0x00000000041CE000-memory.dmp UPX behavioral2/memory/5064-61-0x0000000003140000-0x00000000041CE000-memory.dmp UPX behavioral2/memory/5064-63-0x0000000003140000-0x00000000041CE000-memory.dmp UPX behavioral2/memory/5064-65-0x0000000003140000-0x00000000041CE000-memory.dmp UPX behavioral2/memory/5064-66-0x0000000003140000-0x00000000041CE000-memory.dmp UPX behavioral2/memory/5064-68-0x0000000003140000-0x00000000041CE000-memory.dmp UPX behavioral2/memory/5064-71-0x0000000003140000-0x00000000041CE000-memory.dmp UPX behavioral2/memory/5064-72-0x0000000003140000-0x00000000041CE000-memory.dmp UPX behavioral2/memory/5064-74-0x0000000003140000-0x00000000041CE000-memory.dmp UPX behavioral2/memory/5064-76-0x0000000003140000-0x00000000041CE000-memory.dmp UPX behavioral2/memory/5064-78-0x0000000003140000-0x00000000041CE000-memory.dmp UPX behavioral2/memory/5064-83-0x0000000003140000-0x00000000041CE000-memory.dmp UPX behavioral2/memory/5064-86-0x0000000003140000-0x00000000041CE000-memory.dmp UPX behavioral2/memory/5064-88-0x0000000003140000-0x00000000041CE000-memory.dmp UPX behavioral2/memory/5064-90-0x0000000003140000-0x00000000041CE000-memory.dmp UPX behavioral2/memory/5064-92-0x0000000003140000-0x00000000041CE000-memory.dmp UPX behavioral2/memory/5064-93-0x0000000003140000-0x00000000041CE000-memory.dmp UPX behavioral2/memory/5064-95-0x0000000003140000-0x00000000041CE000-memory.dmp UPX behavioral2/memory/5064-97-0x0000000003140000-0x00000000041CE000-memory.dmp UPX behavioral2/memory/5064-100-0x0000000003140000-0x00000000041CE000-memory.dmp UPX behavioral2/memory/5064-101-0x0000000003140000-0x00000000041CE000-memory.dmp UPX behavioral2/memory/5064-103-0x0000000003140000-0x00000000041CE000-memory.dmp UPX behavioral2/memory/5064-105-0x0000000003140000-0x00000000041CE000-memory.dmp UPX behavioral2/memory/5064-107-0x0000000003140000-0x00000000041CE000-memory.dmp UPX behavioral2/memory/5064-109-0x0000000003140000-0x00000000041CE000-memory.dmp UPX behavioral2/memory/5064-118-0x0000000000400000-0x0000000000434000-memory.dmp UPX - Deletes itself 1 TTPs 1 IoCs
pid Process 5064 CacheMgr.exe - Executes dropped EXE 1 IoCs
pid Process 5064 CacheMgr.exe - Windows security modification 2 TTPs 14 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" CacheMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" CacheMgr.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\StubPath = "\"C:\\ProgramData\\CacheMgr.exe\" -as" 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe - Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: CacheMgr.exe -
resource yara_rule behavioral2/memory/1604-2-0x0000000000B70000-0x0000000001BFE000-memory.dmp upx behavioral2/memory/1604-5-0x0000000000B70000-0x0000000001BFE000-memory.dmp upx behavioral2/memory/1604-13-0x0000000000B70000-0x0000000001BFE000-memory.dmp upx behavioral2/memory/1604-14-0x0000000000B70000-0x0000000001BFE000-memory.dmp upx behavioral2/memory/1604-12-0x0000000000B70000-0x0000000001BFE000-memory.dmp upx behavioral2/memory/1604-9-0x0000000000B70000-0x0000000001BFE000-memory.dmp upx behavioral2/memory/1604-8-0x0000000000B70000-0x0000000001BFE000-memory.dmp upx behavioral2/memory/1604-7-0x0000000000B70000-0x0000000001BFE000-memory.dmp upx behavioral2/memory/1604-10-0x0000000000B70000-0x0000000001BFE000-memory.dmp upx behavioral2/memory/1604-6-0x0000000000B70000-0x0000000001BFE000-memory.dmp upx behavioral2/memory/1604-25-0x0000000000B70000-0x0000000001BFE000-memory.dmp upx behavioral2/memory/5064-44-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/5064-43-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/5064-45-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/5064-46-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/5064-47-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/5064-48-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/5064-50-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/5064-49-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/5064-54-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/5064-56-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/5064-57-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/5064-58-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/5064-59-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/5064-60-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/5064-61-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/5064-63-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/5064-65-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/5064-66-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/5064-68-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/5064-71-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/5064-72-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/5064-74-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/5064-76-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/5064-78-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/5064-83-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/5064-86-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/5064-88-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/5064-90-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/5064-92-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/5064-93-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/5064-95-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/5064-97-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/5064-100-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/5064-101-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/5064-103-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/5064-105-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/5064-107-0x0000000003140000-0x00000000041CE000-memory.dmp upx behavioral2/memory/5064-109-0x0000000003140000-0x00000000041CE000-memory.dmp upx - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4716 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CacheMgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe 5064 CacheMgr.exe 5064 CacheMgr.exe 5064 CacheMgr.exe 5064 CacheMgr.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe - Suspicious use of WriteProcessMemory 53 IoCs
description pid Process procid_target PID 1604 wrote to memory of 4716 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe 90 PID 1604 wrote to memory of 1168 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe 15 PID 1604 wrote to memory of 3160 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe 47 PID 1604 wrote to memory of 3236 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe 48 PID 1604 wrote to memory of 3784 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe 56 PID 1604 wrote to memory of 3288 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe 57 PID 1604 wrote to memory of 4328 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe 59 PID 1604 wrote to memory of 4408 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe 60 PID 1604 wrote to memory of 4472 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe 61 PID 1604 wrote to memory of 4832 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe 63 PID 1604 wrote to memory of 5004 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe 64 PID 1604 wrote to memory of 5148 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe 65 PID 1604 wrote to memory of 5244 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe 66 PID 1604 wrote to memory of 1360 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe 79 PID 1604 wrote to memory of 2876 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe 80 PID 1604 wrote to memory of 5972 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe 81 PID 1604 wrote to memory of 5684 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe 82 PID 1604 wrote to memory of 5744 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe 83 PID 1604 wrote to memory of 5064 1604 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe 92 PID 5064 wrote to memory of 1168 5064 CacheMgr.exe 15 PID 5064 wrote to memory of 3160 5064 CacheMgr.exe 47 PID 5064 wrote to memory of 3236 5064 CacheMgr.exe 48 PID 5064 wrote to memory of 3784 5064 CacheMgr.exe 56 PID 5064 wrote to memory of 3288 5064 CacheMgr.exe 57 PID 5064 wrote to memory of 4328 5064 CacheMgr.exe 59 PID 5064 wrote to memory of 4408 5064 CacheMgr.exe 60 PID 5064 wrote to memory of 4472 5064 CacheMgr.exe 61 PID 5064 wrote to memory of 4832 5064 CacheMgr.exe 63 PID 5064 wrote to memory of 5004 5064 CacheMgr.exe 64 PID 5064 wrote to memory of 5148 5064 CacheMgr.exe 65 PID 5064 wrote to memory of 5244 5064 CacheMgr.exe 66 PID 5064 wrote to memory of 1360 5064 CacheMgr.exe 79 PID 5064 wrote to memory of 2876 5064 CacheMgr.exe 80 PID 5064 wrote to memory of 5972 5064 CacheMgr.exe 81 PID 5064 wrote to memory of 5684 5064 CacheMgr.exe 82 PID 5064 wrote to memory of 5744 5064 CacheMgr.exe 83 PID 5064 wrote to memory of 1168 5064 CacheMgr.exe 15 PID 5064 wrote to memory of 3160 5064 CacheMgr.exe 47 PID 5064 wrote to memory of 3236 5064 CacheMgr.exe 48 PID 5064 wrote to memory of 3784 5064 CacheMgr.exe 56 PID 5064 wrote to memory of 3288 5064 CacheMgr.exe 57 PID 5064 wrote to memory of 4328 5064 CacheMgr.exe 59 PID 5064 wrote to memory of 4408 5064 CacheMgr.exe 60 PID 5064 wrote to memory of 4472 5064 CacheMgr.exe 61 PID 5064 wrote to memory of 4832 5064 CacheMgr.exe 63 PID 5064 wrote to memory of 5004 5064 CacheMgr.exe 64 PID 5064 wrote to memory of 5148 5064 CacheMgr.exe 65 PID 5064 wrote to memory of 5244 5064 CacheMgr.exe 66 PID 5064 wrote to memory of 1360 5064 CacheMgr.exe 79 PID 5064 wrote to memory of 2876 5064 CacheMgr.exe 80 PID 5064 wrote to memory of 5972 5064 CacheMgr.exe 81 PID 5064 wrote to memory of 5684 5064 CacheMgr.exe 82 PID 5064 wrote to memory of 5744 5064 CacheMgr.exe 83 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" CacheMgr.exe
Processes
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:1168
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:3160
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc1⤵PID:3236
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵PID:3784
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3288
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4328
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4408
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc1⤵PID:4472
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:4832
-
C:\Windows\system32\ctfmon.exe/QuitInfo:0000000000000268;000000000000026C;1⤵PID:5004
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵PID:5148
-
C:\Windows\System32\SecurityHealthSystray.exe"C:\Windows\System32\SecurityHealthSystray.exe"1⤵PID:5244
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:1360
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe"3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1604 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop.exe" "C:\ProgramData\CacheMgr.exe"4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4716
-
-
C:\ProgramData\CacheMgr.exe"C:\ProgramData\CacheMgr.exe" -as4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5064
-
-
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵PID:5972
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5684
-
C:\Windows\System32\smartscreen.exeC:\Windows\System32\smartscreen.exe -Embedding1⤵PID:5744
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:3116
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Indicator Removal
1File Deletion
1Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\CacheMgr.exe
- Size 253KB
- SHA256 8d4f2e23f2489e50ec0026465dab0055f000df0280ebe68ee44bb1081298b001
- MD5 c292e855d58d4bbfbe41204002f4aa27
- SHA1 8be1b11720d0bcd10ce869a10012b242435e4fa0
- SHA512 c70f6dda88810da5888cd045fb50b6e208e4b1deca158f0d68018e72ac64dd64fc93ffd60a230015b3ed654d2447736bf70458f4edc507ddd83bd0ba0e0c83be
- SSDEEP 6144:65wAJyQJ1MLgEfLopykMXN95hFT8uXzZ6:G7BJ1McEMpjCL73
- TLSH T1164401517841B473ED30C57A848688A94ABDBD215B63E9477A403BFF3F712F1A8321E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SYSTEM.INI
- Size 256B
- SHA256 4e09a9d0fc5a040d8fb6e9330cee8c2c5632dc6e920033ac2d92b5e1683ca7ec
- MD5 e74d045bb4d769eba378a3bdd2525105
- SHA1 5f27b801f04f4df36f44a4cbcac33acdcffa9397
- SHA512 62d84d06954e8d1cd1607007d4aec24c5ecf99f3236ba1115fa803ca0ba3d11d162941747bf40c379f1d876cbf25d526b564fc3c3d42bf247cf8e9fac42214d7
- TLSH T122D05E0E4BDD11AD9042003E3178E0C27339AF11DC320F5C5039678164287E9BF7E2AE
- MD5 SHA1 SHA512 TLSH
- Path C:\vhvtsv.pif
- Size 100KB
- SHA256 12ac2c1d527d85b33d2f9184baab96d4711eb654d91bd14d4452e6bc11491c64
- MD5 52321083f4b743a380ee474ea74cdc75
- SHA1 0242cc97116424af59058af897403e241ef4d56f
- SHA512 e3385e06d534849f4fb4196926c2f19f648739a112c2a6d2320418945c424a6b6c17542ee118d479559942b662007fe8ae232a37109870955ea1f915e66e9109
- SSDEEP 1536:/2jwWVDR1avF8H1AnpRHbb61Ct3eoc/1JIXlaKXjYYp5hnK:/6b1auCn/X6s9XlaJYpj
- TLSH T1FAA312EAA0F6436BCBF86F3952303A69027B1B0D20C1594B45FD54315C87F9AA05AF3B
- MD5 SHA1 SHA512 SSDEEP TLSH