File name:

2025-04-29_d1613c8add5513f3b4b3760771c126ff_amadey_elex_rhadamanthys_smoke-loader

Full analysis: https://app.any.run/tasks/6d215d87-d843-475c-bc54-8293773fd7dc
Verdict: Malicious activity
Analysis date: April 29, 2025, 18:49:44
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-reg
tofsee
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

D1613C8ADD5513F3B4B3760771C126FF

SHA1:

C6227DDFF82DE2B016066F0538FE8BD2992CE257

SHA256:

247586D65B654B672A97DF270C6B681E0CE5AA6D867BD1C18ECDACAFA0ACF31A

SSDEEP:

6144:6lL5sCz2OMzIk8O5AycpSLgX55xVrckyEaatE4:6lVz2OyIL5XtY4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • 2025-04-29_d1613c8add5513f3b4b3760771c126ff_amadey_elex_rhadamanthys_smoke-loader.exe (PID: 7520)

    • TOFSEE has been detected (YARA)

      • svchost.exe (PID: 8012)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 2025-04-29_d1613c8add5513f3b4b3760771c126ff_amadey_elex_rhadamanthys_smoke-loader.exe (PID: 7520)

    • Reads security settings of Internet Explorer

      • 2025-04-29_d1613c8add5513f3b4b3760771c126ff_amadey_elex_rhadamanthys_smoke-loader.exe (PID: 7520)

    • Executes application which crashes

      • 2025-04-29_d1613c8add5513f3b4b3760771c126ff_amadey_elex_rhadamanthys_smoke-loader.exe (PID: 7520)
      • wfzewvqm.exe (PID: 7700)
      • wfzewvqm.exe (PID: 7980)

    • Detected use of alternative data streams (AltDS)

      • svchost.exe (PID: 7772)
      • svchost.exe (PID: 8012)

    • Connects to SMTP port

      • svchost.exe (PID: 7772)
      • svchost.exe (PID: 8012)

  • INFO

    • Create files in a temporary directory

      • 2025-04-29_d1613c8add5513f3b4b3760771c126ff_amadey_elex_rhadamanthys_smoke-loader.exe (PID: 7520)

    • Checks supported languages

      • 2025-04-29_d1613c8add5513f3b4b3760771c126ff_amadey_elex_rhadamanthys_smoke-loader.exe (PID: 7520)
      • wfzewvqm.exe (PID: 7700)
      • wfzewvqm.exe (PID: 7980)

    • Reads the computer name

      • 2025-04-29_d1613c8add5513f3b4b3760771c126ff_amadey_elex_rhadamanthys_smoke-loader.exe (PID: 7520)
      • wfzewvqm.exe (PID: 7700)
      • wfzewvqm.exe (PID: 7980)

    • Process checks computer location settings

      • 2025-04-29_d1613c8add5513f3b4b3760771c126ff_amadey_elex_rhadamanthys_smoke-loader.exe (PID: 7520)

    • Auto-launch of the file from Registry key

      • 2025-04-29_d1613c8add5513f3b4b3760771c126ff_amadey_elex_rhadamanthys_smoke-loader.exe (PID: 7520)

    • Manual execution by a user

      • wfzewvqm.exe (PID: 7980)

    • Reads the software policy settings

      • slui.exe (PID: 5304)

    • Checks proxy server information

      • slui.exe (PID: 5304)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:03:15 00:03:44+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 143360
InitializedDataSize: 273920
UninitializedDataSize: -
EntryPoint: 0x2c00
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 28.0.0.0
ProductVersionNumber: 28.0.0.0
FileFlagsMask: 0x003f
FileFlags: Debug
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
140
Monitored processes
11
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start 2025-04-29_d1613c8add5513f3b4b3760771c126ff_amadey_elex_rhadamanthys_smoke-loader.exe wusa.exe no specs wusa.exe wfzewvqm.exe svchost.exe werfault.exe no specs werfault.exe no specs wfzewvqm.exe #TOFSEE svchost.exe werfault.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
5304C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7520"C:\Users\admin\Desktop\2025-04-29_d1613c8add5513f3b4b3760771c126ff_amadey_elex_rhadamanthys_smoke-loader.exe" C:\Users\admin\Desktop\2025-04-29_d1613c8add5513f3b4b3760771c126ff_amadey_elex_rhadamanthys_smoke-loader.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\desktop\2025-04-29_d1613c8add5513f3b4b3760771c126ff_amadey_elex_rhadamanthys_smoke-loader.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
7580"C:\Windows\System32\wusa.exe" C:\Windows\SysWOW64\wusa.exe—2025-04-29_d1613c8add5513f3b4b3760771c126ff_amadey_elex_rhadamanthys_smoke-loader.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Update Standalone Installer
Exit code:
3221226540
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\wusa.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
7676"C:\WINDOWS\SysWOW64\wusa.exe" C:\Windows\SysWOW64\wusa.exe
2025-04-29_d1613c8add5513f3b4b3760771c126ff_amadey_elex_rhadamanthys_smoke-loader.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Update Standalone Installer
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\wusa.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
7700"C:\Users\admin\wfzewvqm.exe" /d"C:\Users\admin\Desktop\2025-04-29_d1613c8add5513f3b4b3760771c126ff_amadey_elex_rhadamanthys_smoke-loader.exe" /e550302100000007FC:\Users\admin\wfzewvqm.exe
2025-04-29_d1613c8add5513f3b4b3760771c126ff_amadey_elex_rhadamanthys_smoke-loader.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\wfzewvqm.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
7772svchost.exeC:\Windows\SysWOW64\svchost.exe
wfzewvqm.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
7844C:\WINDOWS\SysWOW64\WerFault.exe -u -p 7520 -s 672C:\Windows\SysWOW64\WerFault.exe—2025-04-29_d1613c8add5513f3b4b3760771c126ff_amadey_elex_rhadamanthys_smoke-loader.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
7864C:\WINDOWS\SysWOW64\WerFault.exe -u -p 7700 -s 584C:\Windows\SysWOW64\WerFault.exe—wfzewvqm.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
7980"C:\Users\admin\wfzewvqm.exe"C:\Users\admin\wfzewvqm.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\wfzewvqm.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
8012svchost.exeC:\Windows\SysWOW64\svchost.exe
wfzewvqm.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ws2_32.dll
c:\windows\syswow64\rpcrt4.dll
Total events
5 315
Read events
5 312
Write events
2
Delete events
1

Modification events

(PID) Process:(7520) 2025-04-29_d1613c8add5513f3b4b3760771c126ff_amadey_elex_rhadamanthys_smoke-loader.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:stcbrdvm
Value:
"C:\Users\admin\wfzewvqm.exe"
(PID) Process:(7772) svchost.exeKey:HKEY_CURRENT_USER\Control Panel\Buses
Operation:writeName:Config0
Value:
008D093DDD321E3D24EDB47D450DD49D084297DCE82E72BAA4964CFDE422031DC311D5784ECD945D24EDB47D470DD49D024195DAF71261ADC06D04FDA6E22673BBC9154961CDA56B15D4834F763FE4AC644490BDB27A2DEE905A00CAFC8D3C74BBC4103D36F9AC6D1DDE8D4E760DB8F2054991CFDB2470DD976D
(PID) Process:(7772) svchost.exeKey:HKEY_CURRENT_USER\Control Panel\Buses
Operation:delete valueName:Config1
Value:
Executable files
2
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
75202025-04-29_d1613c8add5513f3b4b3760771c126ff_amadey_elex_rhadamanthys_smoke-loader.exeC:\Users\admin\AppData\Local\Temp\hkqkzkvb.exeexecutable
MD5:178141AC250D56C6C7CC2DF15DC417AC
SHA256:046FBEEE287591F7181EFE13537ABAB259DE5DE2F37D7884E713DA28718B7231
7772svchost.exeC:\Users\admin:.reposbinary
MD5:0C3BF134400CEDF7F7516C8903B8C643
SHA256:8C66AC25013B8115CFB5E65CDCDA69F59834B6D7F17AC1EFFEFFD03CEDB8388F
75202025-04-29_d1613c8add5513f3b4b3760771c126ff_amadey_elex_rhadamanthys_smoke-loader.exeC:\Users\admin\wfzewvqm.exeexecutable
MD5:CF9A6A639FCA8FDAA3C23AE03DF6FDD3
SHA256:70763DC244956D76AE830DC3BE5FA31955A38355CC164091518BBF6E08BE5084
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
24
TCP/UDP connections
53
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6724
RUXIMICS.exe
GET
200
2.19.11.105:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
304
172.202.163.200:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
6724
RUXIMICS.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
172.202.163.200:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
7196
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
—
—
GET
200
20.3.187.198:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
unknown
—
—
—
7196
SIHClient.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
7196
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7196
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
—
—
GET
200
172.202.163.200:443
https://slscr.update.microsoft.com/sls/ping
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
6724
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6724
RUXIMICS.exe
2.19.11.105:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
6724
RUXIMICS.exe
23.219.150.101:80
www.microsoft.com
AKAMAI-AS
CL
whitelisted
7772
svchost.exe
13.107.246.59:80
microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7772
svchost.exe
52.101.10.1:25
microsoft-com.mail.protection.outlook.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7772
svchost.exe
43.231.4.7:443
—
Gigabit Hosting Sdn Bhd
MY
unknown
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
google.com
  • 142.250.185.206
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
crl.microsoft.com
  • 2.19.11.105
  • 2.19.11.120
  • 23.53.40.176
  • 23.53.40.178
whitelisted
www.microsoft.com
  • 23.219.150.101
  • 23.52.120.96
whitelisted
microsoft.com
  • 13.107.246.59
whitelisted
microsoft-com.mail.protection.outlook.com
  • 52.101.10.1
  • 52.101.40.2
  • 52.101.41.3
  • 52.101.10.5
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-04-29_d1613c8add5513f3b4b3760771c126ff_amadey_elex_rhadamanthys_smoke-loader