Analysis
- max time kernel
149s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/11/2026, 03:39
Behavioral task
behavioral1
Sample
2026-11-09_0bffdc58a79f0e0915c2edf4a36aed04_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 2026-11-09_0bffdc58a79f0e0915c2edf4a36aed04_elex_rhadamanthys_smoke-loader.exe
- Size 248KB
- Sample261111-d7lalaeb66
- SHA256 410e2ac034b55293523dc71e20329b194f2e2039d1f9a1b60bb539e7145003e2
- MD5 0bffdc58a79f0e0915c2edf4a36aed04
- SHA1 67c1520473144c6e73ca6588117788308fca8dc7
- SHA512 7fb3450eb5b16f60bdedcb3a546cc021c65ed3a9a42aa2dd917e50b619de033ccf787e65d6e6bd06d69cc699b293af046b1d7e89d2ba966a85bcd89eff64e077
- SSDEEP 3072:5kGHJWGq2cnAAOaOcnrxJWCCCh5LlowIiq2OndK/FFFVTl7JCUv5biMdpV:k2cAAOjcrhN0AF77JPbiMTV
- TLSH T143448C0275D08071E46542B02A29969D2E39FD31CA639E4B73E88ECE3BF05C2B675777
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Soulclose 4 IoCs
resource yara_rule behavioral1/files/0x0007000000024619-12.dat family_soulclose behavioral1/files/0x00040000000006d9-16.dat family_soulclose behavioral1/files/0x0002000000023204-346.dat family_soulclose behavioral1/files/0x0003000000023022-1332.dat family_soulclose - Executes dropped EXE 2 IoCs
pid Process 4732 2026-11-09_0bffdc58a79f0e0915c2edf4a36aed04_elex_rhadamanthys_smoke-loader.exe 4744 avp.exe - Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created F:\autorun.inf avp.exe File opened for modification C:\autorun.inf avp.exe File created C:\autorun.inf avp.exe File opened for modification F:\autorun.inf avp.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe avp.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe avp.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe avp.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe avp.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe avp.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe avp.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe avp.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe avp.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe avp.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe avp.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe avp.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe avp.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe avp.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe avp.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe avp.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe avp.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe avp.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe avp.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe avp.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe avp.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe avp.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe avp.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe avp.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe avp.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe avp.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe avp.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe avp.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe avp.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe avp.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe avp.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE avp.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE avp.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE avp.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe avp.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE avp.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe avp.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe avp.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe avp.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe avp.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe avp.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe avp.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe avp.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe avp.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe avp.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE avp.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe avp.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe avp.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe avp.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe avp.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe avp.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe avp.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe avp.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe avp.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe avp.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe avp.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe avp.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe avp.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe avp.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE avp.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe avp.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe avp.exe File opened for modification C:\Program Files\dotnet\dotnet.exe avp.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe avp.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE avp.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\avp.exe 2026-11-09_0bffdc58a79f0e0915c2edf4a36aed04_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Windows\avp.exe avp.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1304 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-09_0bffdc58a79f0e0915c2edf4a36aed04_elex_rhadamanthys_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-09_0bffdc58a79f0e0915c2edf4a36aed04_elex_rhadamanthys_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avp.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2348 2026-11-09_0bffdc58a79f0e0915c2edf4a36aed04_elex_rhadamanthys_smoke-loader.exe 4744 avp.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2348 wrote to memory of 1304 2348 2026-11-09_0bffdc58a79f0e0915c2edf4a36aed04_elex_rhadamanthys_smoke-loader.exe 85 PID 1304 wrote to memory of 4732 1304 cmd.exe 87 PID 1304 wrote to memory of 4744 1304 cmd.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-09_0bffdc58a79f0e0915c2edf4a36aed04_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-09_0bffdc58a79f0e0915c2edf4a36aed04_elex_rhadamanthys_smoke-loader.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\2026-11-09_0bffdc58a79f0e0915c2edf4a36aed04_elex_rhadamanthys_smoke-loaderkill.bat2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\2026-11-09_0bffdc58a79f0e0915c2edf4a36aed04_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-09_0bffdc58a79f0e0915c2edf4a36aed04_elex_rhadamanthys_smoke-loader.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4732
-
-
C:\Windows\avp.exe"C:\Windows\avp.exe"3⤵
- Executes dropped EXE
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4744
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 653KB
- SHA256 7d7c9d6c3be918c04c115a689e548621ef38bca309b558698100cd3f98b95482
- MD5 0a7e7266f2491df944b6e88dfb1a55bf
- SHA1 cd04fefc28150e7b3b06db48c13853f1831ebebe
- SHA512 b2287b20f1701b153496cc852ae6c65c7ccc9cf81b52359b108beb3c3071eb2053e88f0db77ef812c8610c8d5126fdae2d7e99117f8643b2bb593e440c4d75b2
- SSDEEP 12288:/cVOjcSXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:/cVOjcW0Le5ji0hmxNrM
- TLSH T1D2E41916F6748335D072C0B9C5D2A69EE971344297318DCB4286CBBC3FA7AE68536732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2026-11-09_0bffdc58a79f0e0915c2edf4a36aed04_elex_rhadamanthys_smoke-loader.exe.exe
- Size 144KB
- SHA256 beed5b7478f92c9fb1bbb62ffceb5321a5c12a7c1aa9b20151bf22064589cd46
- MD5 eb4b5c8ab9da5585ccc975cd3d072115
- SHA1 05b95b6a3c6d85a55c43d9fce816d8df179da9ab
- SHA512 26f7289c39b9bcbf196d4f82e328e1fb24a60cac2c40842f6c208e9f1f1a71b026534882112f6e948367214babc63630eec7bf5f7092f31bb91d90c1c07a3095
- SSDEEP 3072:ACCh5LlowIiq2OndK/FFFVTl7JCUv5biMdpV:8N0AF77JPbiMTV
- TLSH T1CDE38D0276E49071D4B302354A686B615E7DFE758F71CF0B73E8898D4AB45C0BA3A7A3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2026-11-09_0bffdc58a79f0e0915c2edf4a36aed04_elex_rhadamanthys_smoke-loaderkill.bat
- Size 759B
- SHA256 021730ad8ae2b5e09c3bd451bc5841c4d3ca63918318f8868937b685ef65dda0
- MD5 9d456054d02bac89f1c07b9c4775e882
- SHA1 3abdc002c523086b1c35f1e83f4e22b549dff46e
- SHA512 36bcb4144f660cb1883e3b2e093704f874642f751008127d4e7737cfff219a17434f3e95130a49af4b8a5adc729effba27684235ffed42f16acd5ed8f7496739
- TLSH T1C501DD05511F8D9D0706D01B02A474CCC5813F6323AF3BB5F661C95D05D75DBA77A351
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Downloads\SelectCompare.exe
- Size 903KB
- SHA256 40a23b0dbb3ced0b073143936e5dc471b09633b55381b2cfb0c8e95d21d726c9
- MD5 8682f3fa4b627cab239d51d3ac312ee3
- SHA1 1087ad732a8a3bd92d2949c3cbf11336f42b8f3d
- SHA512 82251933c76326b4a4bb2e7f4be4e600ad6680f7a44ff035a41068e2e8b61948baeaf30c3e825d5bc87e3b8f2a126a1b4289ad2f9b0b2090314ee43dfafe8fb3
- SSDEEP 24576:/cVOjcJLafsnzhWGvyGwtr/LNqcWWngRbWHWIZqus+006:/cVYcJLl8GvfwtrT8cRnAbW2qc
- TLSH T1211522229A0006BAE55C84F03E2A45DE26563D22C6C73CA762554FFF3BE54D324F5A3B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\SelectCompare.exe
- Size 1007KB
- SHA256 00a003870a39314001c253210f1a30f4bd83007b0275982b4b025a104a519b4a
- MD5 a80548b46482678c0dc4ccde980f34f9
- SHA1 5b42a9d1d86958fd47db038fe3e6884dda401403
- SHA512 4f40a23eeff10f2e4d7e5cfafbe5323a24fce30c2cf1cd09264d59f6a0ec28437e26f634d8fcf6fcaa3651dc9c3a9dcc5654749af64373f4171ffea747cd50fc
- SSDEEP 24576:/cVOjcccVOjcJLafsnzhWGvyGwtr/LNqcWWngRbWHWIZqus+006:/cVYcccVYcJLl8GvfwtrT8cRnAbW2qc
- TLSH T19E251222AA00517AE61885F03A1A85DE25167D31C6873CA772964FEF3BF14D334F5A3B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\avp.exe
- Size 104KB
- SHA256 e3830f59182c010aa17dbbcbf8b17051293104c98e78cdc5df1408ed9f00f533
- MD5 d99c058ddefedfa9cf3d814a14965ec6
- SHA1 785f7b0a387d66e7eb86d4b8d8cee00d3f2184c7
- SHA512 67112b83ef5d57a2bcbdc30e48a49d05f135694923633aa283fa81d18628e7010f9b6f0caf8dad7915c92c813268994eca0e9eb6e2712fb8e54ca1e7c41b436a
- SSDEEP 1536://pkGKk1kGWG3gdkncnbOCwmhlVa4866QcmZEToDBLAncn2gdx1kGW:5kGHJWGq2cnAAOaOcnrxJW
- TLSH T1C3A35B13A940907AE21885F0791A85EE29197C35C1876DA732D68FEE3BF189374F173B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\autorun.inf
- Size 29B
- SHA256 5a55c4d8a2046edd408714e9e1f7fcb3d4b96b49a1b9c709bb53392f02db9cac
- MD5 9d45d9aabca604b890b0cbfac7a62db7
- SHA1 256ab9f644964d584015c84226f1dcc1ae4f7621
- SHA512 540c2b27312dc4417f913a40f1b5b4406abb7f7d1b80ff70cf458ad0a2282b05b70db15e2b9e4b5a61656dffdfe80a4c01fa29d5dff433d4fdb3e7d8a772f445
- MD5 SHA1 SHA512