Analysis
- max time kernel
148s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 14:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 182KB
- Sample261002-ry3eeacb95
- SHA256 4ff125b37f3b80c68d131b2f537018441957ff9ec8c4cd11ffe0a1bce6e20f18
- MD5 53e200109916a27cea53656b04c1c463
- SHA1 6e4a8cca6f157df3f6396c486de33e4c39211361
- SHA512 b4a0ba2bc74f865deca8dada36d29721d79d579488a0b8878196bd97a2611ba594f69ae3f626b0a27bf8fb66c49ddc9bb49d3881e882dad102f36ead8fcc9229
- SSDEEP 3072:uaOddgHEko0aMDxUXIuNW8E6/dlcSJujYm6QgucN6Huvseh:uaPK2aIujrdOSvm6QgunOvb
- TLSH T1D3048C2135D0C073D45712718AB58BBA9E7EB8320BA1A5CBB7D80A7E1F742E19B35347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5024 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification \??\c:\windows\SysWOW64\replace.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\shutdown.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\srdelayed.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\thumbnailextractionhost.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\cmd.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\com\migregdb.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\inputswitchtoasthandler.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\msfeedssync.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\tpminit.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\finger.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\ime\shared\imewdbld.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\kanji_1.uce 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\kanji_2.uce 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\rasdial.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\sc.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\setupugc.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\werfaultsecure.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\hdwwiz.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\mtstocom.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\packagedcwalauncher.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\wextract.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\wscript.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\bopomofo.uce 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\ime\imejp\imjpuex.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\instnm.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\launchtm.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\presentationhost.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\rasphone.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\runonce.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\winrtnetmuahostserver.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\cmdkey.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\cmmon32.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\gb2312.uce 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\iscsicpl.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\speech_onecore\common\speechmodeldownload.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\windowspowershell\v1.0\powershell_ise.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\cloudnotifications.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\esentutl.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\net1.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\typeperf.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\w32tm.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\comp.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\dism\dismhost.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\explorer.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\fsutil.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\msiexec.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\net.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\netcfgnotifyobjecthost.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\rrinstaller.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\ctfmon.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\dllhost.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\ime\imejp\imjpdct.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\userinit.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\verifiergui.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\netplwiz.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\rdpsaproxy.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\systray.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\wiaacmgr.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\win32calc.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\windowspowershell\v1.0\powershell.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\cmdl32.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\msctfime.ime 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\credwiz.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\SysWOW64\eventvwr.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-lpkinstall_31bf3856ad364e35_10.0.26100.1150_none_a51a55a6faf616d3\r\lpkinstall.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-pktmon-setup_31bf3856ad364e35_10.0.26100.1591_none_efac539d4dc51fdd\r\pktmon.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-rpc-ping_31bf3856ad364e35_10.0.26100.1_none_9aadb670a9451e5d\rpcping.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.26100.1591_none_f346527b3b1f36f2\bitlockerwizardelev.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.26100.1591_none_4ef9c76ea26d9c67\r\appvdllsurrogate.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-extrac32_31bf3856ad364e35_10.0.26100.1150_none_7710eb15b3cf4c31\r\extrac32.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-m..resentationsettings_31bf3856ad364e35_10.0.26100.1150_none_090eab20b35405f2\presentationsettings.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.26100.1150_none_49db19f88674c270\setup_wm.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.26100.1150_none_50956d2d42f20d39\rpcinfo.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-p..ioningsecureprocess_31bf3856ad364e35_10.0.26100.1150_none_32bd5b6fcfab5b78\psp.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\microsoft.net\framework\v4.0.30319\wsatconfig.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\windowsbackupclient.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-onecore-pnp-drvinst_31bf3856ad364e35_10.0.26100.1591_none_f11dd8b719f1a6f5\drvinst.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-d..-externaldictionary_31bf3856ad364e35_10.0.26100.1591_none_d85b84d668a60dd1\r\imewdbld.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.26100.1591_none_88f13a0c22218100\r\imjpdct.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-d..anagement-dmcfghost_31bf3856ad364e35_10.0.26100.1_none_2122cf9edbab3972\dmcfghost.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-packagemanager_31bf3856ad364e35_10.0.26100.1591_none_8897bf42a34b1ceb\r\pkgmgr.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_addinprocess32_b77a5c561934e089_10.0.26100.1_none_7e03589d55737e66\addinprocess32.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-gpowershell-exe_31bf3856ad364e35_10.0.26100.1591_none_d4511ac951bbf539\r\powershell_ise.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-p..nfiguration-cmdline_31bf3856ad364e35_10.0.26100.1_none_064f6097e94bbeed\powercfg.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.26100.1591_none_62c72aa79c6b13fd\robocopy.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.26100.1591_none_3f72725b5aa2e9e7\tokenbrokercookies.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-onecore-gameinputsvc_31bf3856ad364e35_10.0.26100.1301_none_2476c9fd1a91bf33\gameinputsvc.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\r\appvstreamingux.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.26100.1591_none_2e9ff92c8dae3783\cmimageworker.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.26100.1150_none_fb078fe8106f7572\r\cmmon32.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\microsoft.net\framework\v4.0.30319\smsvchost.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\notepad.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_hyperv-commandline-tool_31bf3856ad364e35_10.0.26100.1150_none_c8eda2cd3209b21d\r\hvc.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-e..crosoftedgedevtools_31bf3856ad364e35_10.0.26100.1150_none_4b9ba76194d03300\r\microsoftedgedevtools.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-lxss-wsl_31bf3856ad364e35_10.0.26100.1150_none_1ed5d4d47eca0768\wsl.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-ndkperf-setup_31bf3856ad364e35_10.0.26100.1150_none_862cccb1155d1695\ndkperfcmd.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-p..tionsnonwinpeplugin_31bf3856ad364e35_10.0.26100.1_none_a385593075152a7a\pnpunattend.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.26100.1591_none_09563e96d43be8d8\conhost.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-d..management-omadmprc_31bf3856ad364e35_10.0.26100.1150_none_51b04101eb60b5d4\r\omadmprc.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-m..cymanagerbrokerhost_31bf3856ad364e35_10.0.26100.1150_none_1ab61fff20240053\easpolicymanagerbrokerhost.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.26100.1150_none_fb078fe8106f7572\r\cmdl32.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.26100.1150_none_3a3e93ee89e96c57\r\phoneactivate.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\microsoft.net\framework\v4.0.30319\ngen.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-openwith_31bf3856ad364e35_10.0.26100.1591_none_08e0c9d322babcde\openwith.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.26100.1591_none_93c87ba6060f19c7\r\unlodctr.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.26100.1150_none_1da178eaf53e7c4d\r\printbrmengine.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.26100.1150_none_51a2aa17b537a668\svchost.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.26100.1150_none_7c0a3bab447f4af9\bytecodegenerator.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.26100.1150_none_25a595b3a76ab6cf\imebroker.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-deployment_31bf3856ad364e35_10.0.26100.1591_none_97aef1f19d54d967\setupugc.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-e..ageengine-utilities_31bf3856ad364e35_10.0.26100.1591_none_754be8247547f871\esentutl.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-m..resentationsettings_31bf3856ad364e35_10.0.26100.1150_none_090eab20b35405f2\r\presentationsettings.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v2.0.50727\msbuild.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-at_31bf3856ad364e35_10.0.26100.1150_none_e8e8f4e033ce6e38\at.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-directshow-dvdplay_31bf3856ad364e35_10.0.26100.1150_none_9d9573a1c9f40852\dvdplay.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-n..setup-compatibility_31bf3856ad364e35_10.0.26100.1150_none_0c098ad82e53afc9\r\netcfgnotifyobjecthost.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.26100.1150_none_4518f57e3fc4b0d8\r\pathping.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-regsvr32_31bf3856ad364e35_10.0.26100.1150_none_143e6dc7df6d80b5\r\regsvr32.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-p..alcontrols.appxmain_31bf3856ad364e35_10.0.26100.1591_none_3f2e181ddb9e8c83\wpcuapapp.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-p..ntalcontrolsmonitor_31bf3856ad364e35_10.0.26100.1591_none_e6af58ceedab4a7b\r\wpcmon.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\systemapps\microsoft.windows.appresolverux_cw5n1h2txyewy\appresolverux.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\webexperiencehostapp.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-b..onment-core-tcbboot_31bf3856ad364e35_10.0.26100.1742_none_9c21c77df9054577\tcblaunch.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-b..vironment-servicing_31bf3856ad364e35_10.0.26100.1150_none_c1fbd1a9557e5b13\bfsvc.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-defrag-cmdline_31bf3856ad364e35_10.0.26100.1150_none_63632032763f629f\defrag.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\wpf\xamlviewer\xamlviewer_v0300.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_aspnet_regsql_b03f5f7f11d50a3a_10.0.26100.1_none_ac6c889a5b4138e1\aspnet_regsql.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-a..nagement-uevservice_31bf3856ad364e35_10.0.26100.1591_none_19642579da3d47f4\agentservice.exe 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
pid pid_target Process procid_target 3712 5140 WerFault.exe 87 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5140 wrote to memory of 5024 5140 2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5140 -
C:\Windows\2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Windows\2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5024
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5140 -s 1189722⤵
- Program crash
PID:3712
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5140 -ip 51401⤵PID:2496
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Path C:\Windows\2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 182KB
- SHA256 4ff125b37f3b80c68d131b2f537018441957ff9ec8c4cd11ffe0a1bce6e20f18
- MD5 53e200109916a27cea53656b04c1c463
- SHA1 6e4a8cca6f157df3f6396c486de33e4c39211361
- SHA512 b4a0ba2bc74f865deca8dada36d29721d79d579488a0b8878196bd97a2611ba594f69ae3f626b0a27bf8fb66c49ddc9bb49d3881e882dad102f36ead8fcc9229
- SSDEEP 3072:uaOddgHEko0aMDxUXIuNW8E6/dlcSJujYm6QgucN6Huvseh:uaPK2aIujrdOSvm6QgunOvb
- TLSH T1D3048C2135D0C073D45712718AB58BBA9E7EB8320BA1A5CBB7D80A7E1F742E19B35347
- MD5 SHA1 SHA512 SSDEEP TLSH
2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Path C:\Windows\2026-10-01_53e200109916a27cea53656b04c1c463_elex_nymaim_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 142KB
- SHA256 c89fb0df5f0e320893ea3a17246f079d1bdad3d94b500bdff39249d59c4a8450
- MD5 4c7fab53d14a11f3b84dcda20902bc65
- SHA1 8324c5cb44e5554b2d9311934d991d1716dac8ea
- SHA512 ef630fd92c6ea53667b01be103c13c90917518c827b136bf9717350e289543ef13f9eb77bdec29043f739808764cdaa0339691b3d62a6eae36db2954db0d4e7c
- SSDEEP 3072:oMDxUXIuNW8E6/dlcSJujYm6QgucN6Huvseh:o2aIujrdOSvm6QgunOvb
- TLSH T101E37B2132D4C073D45712718A75CBBA8A6EF8310BA169CBB7D90A7E1F782E18B35357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\msbuild.exe
- Size 128KB
- SHA256 bf3e5c5d83c801200bf693442dddcdb3eb8b278a23d12c444fb82df8a8682066
- MD5 f1a855ac7a7b2e0a04efb254da046125
- SHA1 8e83ded13315f926f485c15584e16ca387ca627c
- SHA512 447040fb58991f54235ca480c5818f9693d59f50e980d0215907235b8c3922edc3ad44d9ff00ecc9f1d53436c46a6a3967da65ad281f2526d32c8ddfa21331ba
- SSDEEP 1536:uixOVfhWKdggaEko0A96ZJwk1oO+huJs4HN0Auo7G+DKSOaPFMVO3GGvv9:uaOddgHEko0zMFCHV1G+DKSOaPFIu9
- TLSH T1C5D36C12BBE84136F5FA49B068784B119A3BF9A32C22D24F78CC76581F72690ED31757
- MD5 SHA1 SHA512 SSDEEP TLSH