Analysis
- max time kernel
149s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/10/2026, 06:23
Behavioral task
behavioral1
Sample
2026-10-22_844d4e9d62216943db3ace8d1ec583ae_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 2026-10-22_844d4e9d62216943db3ace8d1ec583ae_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 386KB
- Sample261024-g5yppaed65
- SHA256 fae49dfbe184f3456c8b600982b1f966f2e3e8766f7f09e3f1a8b9886e38b665
- MD5 844d4e9d62216943db3ace8d1ec583ae
- SHA1 76b6a5bf258798640ff838a4fb399754c2be6c37
- SHA512 c148fae72e030f63daf7d559fba1ce2614950388e53dfba0207759ada84275a3df01cce58612fdc3c44211ade99e982aff8dade64d73eb43ba91c8fd042393e1
- SSDEEP 6144:S8efQ6QPJGcLbjg0EuDK4UnUHOkb8734A2P6gt99Wvtxrpp29xQpY:76QPJGcE0hKRg04zPZt9mtPOL
- TLSH T13A84BF217240C035E3A6033559A6E6F559A86E3A1794E08FF7787E7A5F312C39A3324F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 4128 ygbos.exe 4536 myxuc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4312 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ygbos.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ygbos.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-22_844d4e9d62216943db3ace8d1ec583ae_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ygbos.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language myxuc.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe 4536 myxuc.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3708 wrote to memory of 4128 3708 2026-10-22_844d4e9d62216943db3ace8d1ec583ae_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 90 PID 3708 wrote to memory of 4312 3708 2026-10-22_844d4e9d62216943db3ace8d1ec583ae_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 91 PID 4128 wrote to memory of 4536 4128 ygbos.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_844d4e9d62216943db3ace8d1ec583ae_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_844d4e9d62216943db3ace8d1ec583ae_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\ygbos.exe"C:\Users\Admin\AppData\Local\Temp\ygbos.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\myxuc.exe"C:\Users\Admin\AppData\Local\Temp\myxuc.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4536
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4312
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
- Size 412B
- SHA256 550e0e05f95ff0703daa20b6f2799a5bd7368102c970805a6f460b9aa393ca15
- MD5 ae1ab0782d6e532cd953840ec305110d
- SHA1 45e19e90e21ef8bd3671ebc874b7e38ca0a6ff48
- SHA512 ad0c0704b35a65f3a8f403441545eb64236baacbe28bf995edf4eedd0e4f33355ac5f6199281d1cbbe1866d09035a3ce27f00c5d252bc028011ee05962440b77
- TLSH T138E06501419FDA3F501C903F06A9F58E817455543EC637B46624C69C91E944DB9E6202
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
- Size 512B
- SHA256 ba9d7f3c0cb39ec6ef15d4d848bd0c54b6f2c3e3e814ca158ad05990033e2818
- MD5 63cf007f9fa7e5c26891b29ebafb7a57
- SHA1 18e41b2dd55d2d1d74ca454aa2dc01ab768d8ae5
- SHA512 83f76818d7cdd68bebc0ca223d042d1869d092c768ab96f555e832acfe29f48279e472b06b830a945af8221488d50510aa6a6729a4e24c1d1dafa4479421135c
- TLSH T172F02BD92069F0193103D606E2857F691B430ED81DC36FD40145F2704C3EC2C4494210
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\myxuc.exe
- Size 297KB
- SHA256 de92031aa3f61816fa01b52101277d3690bbe937e0c5a3be3dc98cfb641363c3
- MD5 00c8ed74d3b5c98b193338a0e2970e31
- SHA1 14cc219d90d4838f1a827e0f06a022cb2453396a
- SHA512 005a9aac22e23d2462388efddf62ca3f4e3cf66c98fc740aeeac51bcc69d38be7063b767d0e977e4b8a0abee4f22da1cd8c4883e3caffa1da91550697c6a819d
- SSDEEP 6144:nzCnkGXC4JfDu67rIULCFVugtxvIKsAHp22:nzK9fJru+IU+F6KsAM2
- TLSH T1DF547B1076508076E72A07710556EBF40AA8AE3916E4E48FF7787E392E312D39B7724F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ygbos.exe
- Size 386KB
- SHA256 4787066d22fe1a0fec1a68fc355a4411a5931ab2b81cce0e6c168487820ff81e
- MD5 71f22fe0645e5cde44f51c73205bbade
- SHA1 eb76d2bfcf39ca3b025e32f729d330b20fe1c57b
- SHA512 c0097e434759ff2b11cf8207ddc11ce30f6e4858a0778094a90762447cb3cbeb60c00abcd74e4fcb87f567bc546c17119f1e8fa1ea28558553f8ac2e31f562b3
- SSDEEP 6144:S8efQ6QPJGcLbjg0EuDK4UnUHOkb8734A2P6gt99Wvtxrpp29xQpQ:76QPJGcE0hKRg04zPZt9mtPOL
- TLSH T11984BF217240C035E3A6033559A6E6F559A86E3A1794E08FF7787E7A5F312C39A3324F
- MD5 SHA1 SHA512 SSDEEP TLSH