File name:

2025-07-05_37474834424a1b636134b8ced0b51bcd_amadey_elex_rhadamanthys_smoke-loader_stop

Full analysis: https://app.any.run/tasks/db9a81b8-e1cc-4763-979f-f21caa0b8f30
Verdict: Malicious activity
Analysis date: July 05, 2025, 23:50:13
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

37474834424A1B636134B8CED0B51BCD

SHA1:

83DD7F169940622A7319C352B22BD0C30E23EDCD

SHA256:

2B1B35B609A124786D88FFF78E976263C3A8D308BEDE8FAED14258B7713CD3BD

SSDEEP:

6144:EJ1nGDwv1tjCtJQVXNY1gFrkcLezOOrTUrW6Ov03lWCjw0FSP1RDnRseya5Iv06f:RU74E9YGRj5OrTUrXWt00LmemdYsv

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to the CnC server

      • svchost.exe (PID: 2200)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • 2025-07-05_37474834424a1b636134b8ced0b51bcd_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 6668)
      • a07a50e0 (PID: 2716)
      • 2025-07-05_37474834424a1b636134b8ced0b51bcd_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 4232)

    • Application launched itself

      • 2025-07-05_37474834424a1b636134b8ced0b51bcd_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 6668)

    • Executable content was dropped or overwritten

      • 2025-07-05_37474834424a1b636134b8ced0b51bcd_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 4232)

    • Executes as Windows Service

      • a07a50e0 (PID: 2716)

    • Connects to the server without a host name

      • a07a50e0 (PID: 2716)
      • 2025-07-05_37474834424a1b636134b8ced0b51bcd_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 4232)

    • Contacting a server suspected of hosting an CnC

      • svchost.exe (PID: 2200)

  • INFO

    • Reads the computer name

      • 2025-07-05_37474834424a1b636134b8ced0b51bcd_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 6668)
      • 2025-07-05_37474834424a1b636134b8ced0b51bcd_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 4232)
      • a07a50e0 (PID: 2716)

    • The sample compiled with chinese language support

      • 2025-07-05_37474834424a1b636134b8ced0b51bcd_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 6668)
      • 2025-07-05_37474834424a1b636134b8ced0b51bcd_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 4232)

    • Checks supported languages

      • 2025-07-05_37474834424a1b636134b8ced0b51bcd_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 6668)
      • 2025-07-05_37474834424a1b636134b8ced0b51bcd_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 4232)
      • a07a50e0 (PID: 2716)

    • Process checks computer location settings

      • 2025-07-05_37474834424a1b636134b8ced0b51bcd_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 6668)

    • Reads the machine GUID from the registry

      • a07a50e0 (PID: 2716)
      • 2025-07-05_37474834424a1b636134b8ced0b51bcd_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 4232)

    • Reads the software policy settings

      • a07a50e0 (PID: 2716)
      • 2025-07-05_37474834424a1b636134b8ced0b51bcd_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 4232)
      • slui.exe (PID: 2388)

    • Checks proxy server information

      • 2025-07-05_37474834424a1b636134b8ced0b51bcd_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 4232)
      • slui.exe (PID: 2388)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:04:27 11:39:38+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 145408
InitializedDataSize: 236544
UninitializedDataSize: -
EntryPoint: 0x1317f
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 23.9.20.1611
ProductVersionNumber: 23.9.20.1611
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Unicode
FileVersion: 23, 9, 20, 1611
ProductVersion: 23, 9, 20, 1611
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
5
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start 2025-07-05_37474834424a1b636134b8ced0b51bcd_amadey_elex_rhadamanthys_smoke-loader_stop.exe no specs 2025-07-05_37474834424a1b636134b8ced0b51bcd_amadey_elex_rhadamanthys_smoke-loader_stop.exe a07a50e0 slui.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
2200C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2388C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2716C:\Windows\Syswow64\a07a50e0C:\Windows\SysWOW64\a07a50e0
services.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Version:
23, 9, 20, 1611
Modules
Images
c:\windows\syswow64\a07a50e0
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
4232"C:\Users\admin\Desktop\2025-07-05_37474834424a1b636134b8ced0b51bcd_amadey_elex_rhadamanthys_smoke-loader_stop.exe" C:\Users\admin\Desktop\2025-07-05_37474834424a1b636134b8ced0b51bcd_amadey_elex_rhadamanthys_smoke-loader_stop.exe
2025-07-05_37474834424a1b636134b8ced0b51bcd_amadey_elex_rhadamanthys_smoke-loader_stop.exe
User:
admin
Integrity Level:
HIGH
Version:
23, 9, 20, 1611
Modules
Images
c:\users\admin\desktop\2025-07-05_37474834424a1b636134b8ced0b51bcd_amadey_elex_rhadamanthys_smoke-loader_stop.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6668"C:\Users\admin\Desktop\2025-07-05_37474834424a1b636134b8ced0b51bcd_amadey_elex_rhadamanthys_smoke-loader_stop.exe" C:\Users\admin\Desktop\2025-07-05_37474834424a1b636134b8ced0b51bcd_amadey_elex_rhadamanthys_smoke-loader_stop.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
23, 9, 20, 1611
Modules
Images
c:\users\admin\desktop\2025-07-05_37474834424a1b636134b8ced0b51bcd_amadey_elex_rhadamanthys_smoke-loader_stop.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
11 916
Read events
11 913
Write events
3
Delete events
0

Modification events

(PID) Process:(4232) 2025-07-05_37474834424a1b636134b8ced0b51bcd_amadey_elex_rhadamanthys_smoke-loader_stop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4232) 2025-07-05_37474834424a1b636134b8ced0b51bcd_amadey_elex_rhadamanthys_smoke-loader_stop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4232) 2025-07-05_37474834424a1b636134b8ced0b51bcd_amadey_elex_rhadamanthys_smoke-loader_stop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
1
Suspicious files
0
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
42322025-07-05_37474834424a1b636134b8ced0b51bcd_amadey_elex_rhadamanthys_smoke-loader_stop.exeC:\Windows\487410text
MD5:87997B975CADC7F3184A1A75831F731D
SHA256:CDF405EDCF99B443B3F87911EBDF854E67E1F956284DDAB78F692CAE15BC4E09
42322025-07-05_37474834424a1b636134b8ced0b51bcd_amadey_elex_rhadamanthys_smoke-loader_stop.exeC:\Windows\SysWOW64\a07a50e0executable
MD5:D51D59B9EB46BD851BFD7FC0555EF2FB
SHA256:BAF344A695C2E0FE8AF33113B3269B0C1C8B8C99177CBD9821355B611946A7EE
2716a07a50e0C:\Windows\2e7fb8text
MD5:4DACE91365984B710D975A38E2A44C97
SHA256:84B9ADCC12DE3BCDC2F269699E08EDAAD551E6AD5096EF074A65E29AACDBEA50
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
180
TCP/UDP connections
251
DNS requests
41
Threats
67

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
23.55.104.172:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7132
RUXIMICS.exe
GET
200
23.55.104.172:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
23.55.104.172:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7132
RUXIMICS.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2716
a07a50e0
GET
200
223.5.5.5:80
http://dns.alidns.com/resolve?name=down.nugong.asia&type=1
unknown
—
—
whitelisted
—
—
GET
200
223.6.6.6:443
https://dns.alidns.com/resolve?name=down.nugong.asia&type=1
unknown
binary
257 b
whitelisted
—
—
GET
200
223.5.5.5:443
https://dns.alidns.com/resolve?name=spi1.tyui54345.xyz&type=16
unknown
binary
255 b
whitelisted
2716
a07a50e0
GET
200
223.5.5.5:80
http://dns.alidns.com/resolve?name=spi1.tyui54345.xyz&type=16
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5944
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7132
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
23.55.104.172:80
crl.microsoft.com
Akamai International B.V.
US
whitelisted
5944
MoUsoCoreWorker.exe
23.55.104.172:80
crl.microsoft.com
Akamai International B.V.
US
whitelisted
7132
RUXIMICS.exe
23.55.104.172:80
crl.microsoft.com
Akamai International B.V.
US
whitelisted
1268
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5944
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
google.com
  • 172.217.18.14
whitelisted
down.nugong.asia
  • —
unknown
crl.microsoft.com
  • 23.55.104.172
  • 23.55.104.190
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
dns.alidns.com
  • 223.5.5.5
  • 223.6.6.6
whitelisted
down.xy58.top
  • 54.156.158.84
unknown
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
31bd9b27a24e0be9.tyui54345.xyz
  • —
unknown
yzzcommon.tyui54345.xyz
  • —
unknown

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO Observed DNS Over HTTPS Domain (dns .alidns .com in TLS SNI)
—
—
Misc activity
ET INFO Observed DNS Over HTTPS Domain (dns .alidns .com in TLS SNI)
—
—
Misc activity
ET INFO Observed DNS Over HTTPS Domain (dns .alidns .com in TLS SNI)
—
—
Misc activity
ET INFO Observed DNS Over HTTPS Domain (dns .alidns .com in TLS SNI)
—
—
Misc activity
ET INFO Observed DNS Over HTTPS Domain (dns .alidns .com in TLS SNI)
—
—
Misc activity
ET INFO Observed DNS Over HTTPS Domain (dns .alidns .com in TLS SNI)
—
—
Misc activity
ET INFO Observed DNS Over HTTPS Domain (dns .alidns .com in TLS SNI)
—
—
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
—
—
Misc activity
ET INFO Observed DNS Over HTTPS Domain (dns .alidns .com in TLS SNI)
—
—
Potentially Bad Traffic
ET INFO HTTP Request to a *.top domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-07-05_37474834424a1b636134b8ced0b51bcd_amadey_elex_rhadamanthys_smoke-loader_stop