Analysis
- max time kernel
150s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/11/2026, 03:39
Behavioral task
behavioral1
Sample
2026-11-09_0bffdc58a79f0e0915c2edf4a36aed04_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 2026-11-09_0bffdc58a79f0e0915c2edf4a36aed04_elex_rhadamanthys_smoke-loader.exe
- Size 248KB
- Sample261111-d7lalaeb66
- SHA256 410e2ac034b55293523dc71e20329b194f2e2039d1f9a1b60bb539e7145003e2
- MD5 0bffdc58a79f0e0915c2edf4a36aed04
- SHA1 67c1520473144c6e73ca6588117788308fca8dc7
- SHA512 7fb3450eb5b16f60bdedcb3a546cc021c65ed3a9a42aa2dd917e50b619de033ccf787e65d6e6bd06d69cc699b293af046b1d7e89d2ba966a85bcd89eff64e077
- SSDEEP 3072:5kGHJWGq2cnAAOaOcnrxJWCCCh5LlowIiq2OndK/FFFVTl7JCUv5biMdpV:k2cAAOjcrhN0AF77JPbiMTV
- TLSH T143448C0275D08071E46542B02A29969D2E39FD31CA639E4B73E88ECE3BF05C2B675777
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Soulclose 2 IoCs
resource yara_rule behavioral2/files/0x000c00000001c523-12.dat family_soulclose behavioral2/files/0x000300000001b2c4-17.dat family_soulclose - Executes dropped EXE 2 IoCs
pid Process 3416 2026-11-09_0bffdc58a79f0e0915c2edf4a36aed04_elex_rhadamanthys_smoke-loader.exe 2896 avp.exe - Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf avp.exe File created C:\autorun.inf avp.exe File opened for modification F:\autorun.inf avp.exe File created F:\autorun.inf avp.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE avp.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE avp.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE avp.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe avp.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe avp.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe avp.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe avp.exe File opened for modification C:\Program Files\Windows Media Player\setup_wm.exe avp.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe avp.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe avp.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe avp.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe avp.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe avp.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe avp.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE avp.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe avp.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe avp.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe avp.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_109328\java.exe avp.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe avp.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe avp.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe avp.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe avp.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe avp.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe avp.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe avp.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe avp.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe avp.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE avp.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe avp.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe avp.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe avp.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe avp.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe avp.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe avp.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe avp.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe avp.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe avp.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe avp.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe avp.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe avp.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{8118963C-5722-40D8-B50C-68BE87CFBD4C}\MicrosoftEdge_X64_139.0.3405.125.exe avp.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe avp.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe avp.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe avp.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe avp.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe avp.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe avp.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe avp.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe avp.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe avp.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe avp.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe avp.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe avp.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe avp.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe avp.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe avp.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe avp.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe avp.exe File opened for modification C:\Program Files\dotnet\dotnet.exe avp.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe avp.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe avp.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe avp.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseImdsCollector.exe avp.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\avp.exe 2026-11-09_0bffdc58a79f0e0915c2edf4a36aed04_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Windows\avp.exe avp.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 944 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-09_0bffdc58a79f0e0915c2edf4a36aed04_elex_rhadamanthys_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-09_0bffdc58a79f0e0915c2edf4a36aed04_elex_rhadamanthys_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avp.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4384 2026-11-09_0bffdc58a79f0e0915c2edf4a36aed04_elex_rhadamanthys_smoke-loader.exe 2896 avp.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4384 wrote to memory of 944 4384 2026-11-09_0bffdc58a79f0e0915c2edf4a36aed04_elex_rhadamanthys_smoke-loader.exe 89 PID 944 wrote to memory of 3416 944 cmd.exe 91 PID 944 wrote to memory of 2896 944 cmd.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-09_0bffdc58a79f0e0915c2edf4a36aed04_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-09_0bffdc58a79f0e0915c2edf4a36aed04_elex_rhadamanthys_smoke-loader.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\2026-11-09_0bffdc58a79f0e0915c2edf4a36aed04_elex_rhadamanthys_smoke-loaderkill.bat2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\2026-11-09_0bffdc58a79f0e0915c2edf4a36aed04_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-09_0bffdc58a79f0e0915c2edf4a36aed04_elex_rhadamanthys_smoke-loader.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3416
-
-
C:\Windows\avp.exe"C:\Windows\avp.exe"3⤵
- Executes dropped EXE
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2896
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.0MB
- SHA256 13d66e00379c691afdfcc33c6be31faa1dd0f57bc09f4e6111f5d34dd0d7d403
- MD5 65af0cb3dc53f33375823f2fae4566f0
- SHA1 6b796ad272b3729c93df324f3ff4cd7fc1763cbf
- SHA512 7f28b35d5f1776c656a643bde6ab14959874083232f9aa7cd615f5c9718e94f65eb2fbc9e9b12ebbeab685aad9432959aafdc1df63c85790b6342b4a25ac823b
- SSDEEP 24576:/cVOjcea7/ezSC6vUyD/aqgrvWx6q8wyu:/cVYcZ/ezSC6vUzPvMHjy
- TLSH T1F035F915F5788333D0B2D0BAC5D6AA9EFE3230464B3189CB0246D76C3E676E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2026-11-09_0bffdc58a79f0e0915c2edf4a36aed04_elex_rhadamanthys_smoke-loader.exe.exe
- Size 144KB
- SHA256 beed5b7478f92c9fb1bbb62ffceb5321a5c12a7c1aa9b20151bf22064589cd46
- MD5 eb4b5c8ab9da5585ccc975cd3d072115
- SHA1 05b95b6a3c6d85a55c43d9fce816d8df179da9ab
- SHA512 26f7289c39b9bcbf196d4f82e328e1fb24a60cac2c40842f6c208e9f1f1a71b026534882112f6e948367214babc63630eec7bf5f7092f31bb91d90c1c07a3095
- SSDEEP 3072:ACCh5LlowIiq2OndK/FFFVTl7JCUv5biMdpV:8N0AF77JPbiMTV
- TLSH T1CDE38D0276E49071D4B302354A686B615E7DFE758F71CF0B73E8898D4AB45C0BA3A7A3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2026-11-09_0bffdc58a79f0e0915c2edf4a36aed04_elex_rhadamanthys_smoke-loaderkill.bat
- Size 759B
- SHA256 021730ad8ae2b5e09c3bd451bc5841c4d3ca63918318f8868937b685ef65dda0
- MD5 9d456054d02bac89f1c07b9c4775e882
- SHA1 3abdc002c523086b1c35f1e83f4e22b549dff46e
- SHA512 36bcb4144f660cb1883e3b2e093704f874642f751008127d4e7737cfff219a17434f3e95130a49af4b8a5adc729effba27684235ffed42f16acd5ed8f7496739
- TLSH T1C501DD05511F8D9D0706D01B02A474CCC5813F6323AF3BB5F661C95D05D75DBA77A351
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\avp.exe
- Size 104KB
- SHA256 e3830f59182c010aa17dbbcbf8b17051293104c98e78cdc5df1408ed9f00f533
- MD5 d99c058ddefedfa9cf3d814a14965ec6
- SHA1 785f7b0a387d66e7eb86d4b8d8cee00d3f2184c7
- SHA512 67112b83ef5d57a2bcbdc30e48a49d05f135694923633aa283fa81d18628e7010f9b6f0caf8dad7915c92c813268994eca0e9eb6e2712fb8e54ca1e7c41b436a
- SSDEEP 1536://pkGKk1kGWG3gdkncnbOCwmhlVa4866QcmZEToDBLAncn2gdx1kGW:5kGHJWGq2cnAAOaOcnrxJW
- TLSH T1C3A35B13A940907AE21885F0791A85EE29197C35C1876DA732D68FEE3BF189374F173B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\autorun.inf
- Size 29B
- SHA256 5a55c4d8a2046edd408714e9e1f7fcb3d4b96b49a1b9c709bb53392f02db9cac
- MD5 9d45d9aabca604b890b0cbfac7a62db7
- SHA1 256ab9f644964d584015c84226f1dcc1ae4f7621
- SHA512 540c2b27312dc4417f913a40f1b5b4406abb7f7d1b80ff70cf458ad0a2282b05b70db15e2b9e4b5a61656dffdfe80a4c01fa29d5dff433d4fdb3e7d8a772f445
- MD5 SHA1 SHA512