Analysis
- max time kernel
149s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/10/2026, 14:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 182KB
- Sample261002-ry3eeacb95
- SHA256 4ff125b37f3b80c68d131b2f537018441957ff9ec8c4cd11ffe0a1bce6e20f18
- MD5 53e200109916a27cea53656b04c1c463
- SHA1 6e4a8cca6f157df3f6396c486de33e4c39211361
- SHA512 b4a0ba2bc74f865deca8dada36d29721d79d579488a0b8878196bd97a2611ba594f69ae3f626b0a27bf8fb66c49ddc9bb49d3881e882dad102f36ead8fcc9229
- SSDEEP 3072:uaOddgHEko0aMDxUXIuNW8E6/dlcSJujYm6QgucN6Huvseh:uaPK2aIujrdOSvm6QgunOvb
- TLSH T1D3048C2135D0C073D45712718AB58BBA9E7EB8320BA1A5CBB7D80A7E1F742E19B35347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe - Executes dropped EXE 1 IoCs
pid Process 3508 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification \??\c:\windows\SysWOW64\stordiag.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\waitfor.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\mmc.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\mspaint.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\net1.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\secedit.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\taskmgr.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\dwwin.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\instnm.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\searchprotocolhost.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\shrpubw.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\windowspowershell\v1.0\powershell.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\camerasettingsuihost.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\cipher.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\kanji_2.uce 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\odbcconf.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\regsvr32.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\dplaysvr.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\fixmapi.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\systeminfo.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\systempropertiescomputername.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\winrs.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\cliconfg.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\expand.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\gb2312.uce 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\help.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\muiunattend.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\rdpsauachelper.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\schtasks.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\takeown.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\bitsadmin.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\cmmon32.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\control.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\convert.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\cscript.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\ime\shared\imewdbld.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\mcbuilder.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\mrinfo.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\dccw.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\dialer.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\notepad.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\packagedcwalauncher.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\poqexec.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\rekeywiz.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\searchindexer.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\utilman.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\regedit.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\autofmt.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\certreq.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\tar.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\tpminit.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\unregmp2.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\cmstp.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\com\comrepl.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\perfmon.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\robocopy.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\tracert.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\wevtutil.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\windows.warp.jitservice.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\windowspowershell\v1.0\powershell_ise.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\dllhst3g.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\mshta.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\openwith.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\passwordonwakesettingflyout.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification \??\c:\windows\2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\notepad.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\speech_onecore\engines\tts\en-us\nusdata\m1033zira.keyboard.wve 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.19041.1288_none_6c70124c60e2b4ef\r\vmcompute.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-hgattest-catrustlet_31bf3856ad364e35_10.0.19041.1_none_13a24884d12d6915\vmplatformca.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.264_none_1477a882bdce0df2\f\vmms.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.19041.928_none_6012c8cabf808ff7\pcaui.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\screenclipping\screenclippinghost.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\speech_onecore\engines\tts\es-es\nusdata\m3082pablo.keyboard.wve 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\speech_onecore\engines\tts\fr-fr\nusdata\m1036hortense.keyboard.wve 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\systemapps\microsoft.bioenrollment_cw5n1h2txyewy\bioenrollmenthost.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_hyperv-compute-containerdiagnosticstool_31bf3856ad364e35_10.0.19041.928_none_6571ff6e96271a64\f\hcsdiag.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.1288_none_a518f9eb1ab503d0\f\hvax64.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-onecore-c..periencehost-broker_31bf3856ad364e35_10.0.19041.746_none_1ce3c0f12fb5f8ec\r\cloudexperiencehostbroker.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.19041.746_none_4b0a936d86cdd479\r\oobeldr.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_addinutil_b77a5c561934e089_4.0.15805.0_none_fcd173bc1b434b81\addinutil.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_comsvcconfig_b03f5f7f11d50a3a_4.0.15805.0_none_468e01fabfc37212\comsvcconfig.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_curl_31bf3856ad364e35_10.0.19041.1_none_345cbd92bc885eba\curl.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.1288_none_a518f9eb1ab503d0\f\hvix64.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.1266_none_ab5bdb26141e0be5\f\vmms.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-onecore-c..periencehost-broker_31bf3856ad364e35_10.0.19041.746_none_1ce3c0f12fb5f8ec\f\cloudexperiencehostbroker.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.19041.746_none_4b0a936d86cdd479\windeploy.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-onecore-pnp-drvinst_31bf3856ad364e35_10.0.19041.1_none_0b4eeb140948562c\drvinst.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\systemapps\microsoft.windows.apprep.chxapp_cw5n1h2txyewy\chxsmartscreen.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\systemapps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\narratorquickstart.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_bsdtar_31bf3856ad364e35_10.0.19041.1_none_0c1f19c50b5e5f6e\tar.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_hyperv-compute-guestcomputeservice_31bf3856ad364e35_10.0.19041.264_none_6b6699b671c8f5a8\f\vmcomputeagent.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.1288_none_a518f9eb1ab503d0\hvix64.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-onecore-tetheringservice_31bf3856ad364e35_10.0.19041.1_none_43a1294286598aee\icsentitlementhost.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-onecore-utilityvm-setupagent_31bf3856ad364e35_10.0.19041.1_none_cf994a1a65720fd5\wcsetupagent.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\systemapps\microsoft.windows.callingshellapp_cw5n1h2txyewy\callingshellapp.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\systemapps\microsoft.windows.oobenetworkcaptiveportal_cw5n1h2txyewy\oobenetworkcaptiveportal.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\systemapps\microsoft.windows.oobenetworkconnectionflow_cw5n1h2txyewy\oobenetworkconnectionflow.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\inputapp\textinputhost.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_hyperv-commandline-tool_31bf3856ad364e35_10.0.19041.1_none_e2f75fda217d5015\hvc.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.928_none_33e0d5558cdd7c61\cexecsvc.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-onecore-i..atedusermode-kernel_31bf3856ad364e35_10.0.19041.1023_none_5c93ef2449c89609\f\securekernel.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-onecore-pnp-drvinst_31bf3856ad364e35_10.0.19041.1202_none_ca1e0a7a1f21274c\drvinst.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-client-li..m-service-migration_31bf3856ad364e35_10.0.19041.84_none_8ea6a37043f4ae90\r\clipup.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-onecore-i..atedusermode-kernel_31bf3856ad364e35_10.0.19041.207_none_c5e1b9def3522696\r\securekernel.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-onecore-u..iedwritefilter-mgmt_31bf3856ad364e35_10.0.19041.1_none_82af78fa7992ecce\uwfmgr.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.19041.928_none_6012c8cabf808ff7\f\pcaui.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\systemapps\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\startmenuexperiencehost.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\systemapps\parentalcontrols_cw5n1h2txyewy\wpcuapapp.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_aspnet_regbrowsers_b03f5f7f11d50a3a_10.0.19041.1_none_82a36c559596820a\aspnet_regbrowsers.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_hyperv-compute-containerdiagnosticstool_31bf3856ad364e35_10.0.19041.1_none_3d521dedd6c76700\hcsdiag.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_hyperv-compute-containerdiagnosticstool_31bf3856ad364e35_10.0.19041.928_none_6571ff6e96271a64\r\hcsdiag.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_hyperv-vmsp_31bf3856ad364e35_10.0.19041.1_none_39d506065bd87607\vmsp.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.19041.264_none_62496caeba2daa52\nvspinfo.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.264_none_0e32f443c4669fed\r\hvax64.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\systemapps\microsoft.accountscontrol_cw5n1h2txyewy\accountscontrolhost.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\systemapps\microsoft.windows.secureassessmentbrowser_cw5n1h2txyewy\secureassessmentbrowser.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_hyperv-compute-guestcomputeservice_31bf3856ad364e35_10.0.19041.264_none_6b6699b671c8f5a8\r\vmcomputeagent.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.19041.264_none_d58a0ca50a94510c\f\vmcompute.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-hns-diagnosticstool_31bf3856ad364e35_10.0.19041.423_none_841c30f68571c385\f\hnsdiag.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.19041.264_none_13222f28beaa00a7\f\vmwp.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.19041.264_none_13222f28beaa00a7\vmwp.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.19041.1288_none_e25de9f9d964cdad\conhost.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\speech_onecore\engines\tts\ja-jp\nusdata\m1041ichiro.keyboard.wve 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\systemapps\microsoft.ecapp_8wekyb3d8bbwe\microsoft.ecapp.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\systemapps\microsoft.windows.fileexplorer_cw5n1h2txyewy\fileexplorer.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_eventviewersettings_31bf3856ad364e35_10.0.19041.1_none_aae8e58aa310aa7d\eventvwr.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.19041.1288_none_f92f7256107c0e35\nvspinfo.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.19041.746_none_a8b46aaa6c07ca3d\credentialuibroker.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
pid pid_target Process procid_target 5012 3056 WerFault.exe 85 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3056 wrote to memory of 3508 3056 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Windows\2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3508
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 321202⤵
- Program crash
PID:5012
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3056 -ip 30561⤵PID:4408
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Path C:\Windows\2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 182KB
- SHA256 4ff125b37f3b80c68d131b2f537018441957ff9ec8c4cd11ffe0a1bce6e20f18
- MD5 53e200109916a27cea53656b04c1c463
- SHA1 6e4a8cca6f157df3f6396c486de33e4c39211361
- SHA512 b4a0ba2bc74f865deca8dada36d29721d79d579488a0b8878196bd97a2611ba594f69ae3f626b0a27bf8fb66c49ddc9bb49d3881e882dad102f36ead8fcc9229
- SSDEEP 3072:uaOddgHEko0aMDxUXIuNW8E6/dlcSJujYm6QgucN6Huvseh:uaPK2aIujrdOSvm6QgunOvb
- TLSH T1D3048C2135D0C073D45712718AB58BBA9E7EB8320BA1A5CBB7D80A7E1F742E19B35347
- MD5 SHA1 SHA512 SSDEEP TLSH
2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Path C:\Windows\2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 142KB
- SHA256 c89fb0df5f0e320893ea3a17246f079d1bdad3d94b500bdff39249d59c4a8450
- MD5 4c7fab53d14a11f3b84dcda20902bc65
- SHA1 8324c5cb44e5554b2d9311934d991d1716dac8ea
- SHA512 ef630fd92c6ea53667b01be103c13c90917518c827b136bf9717350e289543ef13f9eb77bdec29043f739808764cdaa0339691b3d62a6eae36db2954db0d4e7c
- SSDEEP 3072:oMDxUXIuNW8E6/dlcSJujYm6QgucN6Huvseh:o2aIujrdOSvm6QgunOvb
- TLSH T101E37B2132D4C073D45712718A75CBBA8A6EF8310BA169CBB7D90A7E1F782E18B35357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Panther\mainqueueonline0.que
- Size 68KB
- SHA256 23e097c2c369c3ec8b88dc8fe1ee9e44ab0bb71026f5000acbcd9943613661d6
- MD5 6a5d7f4126ef0538dfaabe66646baac4
- SHA1 088bd696557cd182d523d9666876528f8944ae0b
- SHA512 8d1cd805d9a5255630936936b2eb93e1fd7aaf9fc2758c4fd81f37c8502879802618e52d5ab7c0b094c19709c0b8c0c3dd73f7f0cea2ebdac48ef4d23ab3afaa
- SSDEEP 768:uixSjVfhabM14NKdggaEirclgo0cYSXiw8YAb:uixOVfhWKdggaEko0sXz8Y
- TLSH T12C637215BBE41527F1F69F30E9BB4305A97AFC632B26E69E4240150D2C623C0A97737B
- MD5 SHA1 SHA512 SSDEEP TLSH