File name:

2025-06-21_5be31c5da539ff748c82041dda860e74_amadey_elex_rhadamanthys_smoke-loader_stop

Full analysis: https://app.any.run/tasks/e7ed7807-855b-469a-9533-8407787f0dd9
Verdict: Malicious activity
Analysis date: June 21, 2025, 14:14:17
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

5BE31C5DA539FF748C82041DDA860E74

SHA1:

1B76579288E1FBEE030CDA70D0D87F2529A8E589

SHA256:

56E2F0CA3FDB34C9E8F36EFDF158D6309CD42FFD04EE6DCCFE039E473575F31D

SSDEEP:

6144:zJ1nGDwv1tjCtJQVXNY1gFrkcLezOOrTUrW6Ov03lWCjw0FSP1RDnRseya5Iv06f:CU74E9YGRj5OrTUrXWt00LmemdYsv

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Application launched itself

      • 2025-06-21_5be31c5da539ff748c82041dda860e74_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 6188)

    • Reads security settings of Internet Explorer

      • 2025-06-21_5be31c5da539ff748c82041dda860e74_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 6188)
      • 7ccd7274 (PID: 2780)
      • 2025-06-21_5be31c5da539ff748c82041dda860e74_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 6180)

    • Executable content was dropped or overwritten

      • 2025-06-21_5be31c5da539ff748c82041dda860e74_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 6180)

    • Executes as Windows Service

      • 7ccd7274 (PID: 2780)

    • Connects to the server without a host name

      • 2025-06-21_5be31c5da539ff748c82041dda860e74_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 6180)
      • 7ccd7274 (PID: 2780)

  • INFO

    • Reads the computer name

      • 2025-06-21_5be31c5da539ff748c82041dda860e74_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 6188)
      • 2025-06-21_5be31c5da539ff748c82041dda860e74_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 6180)
      • 7ccd7274 (PID: 2780)

    • Checks supported languages

      • 2025-06-21_5be31c5da539ff748c82041dda860e74_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 6188)
      • 2025-06-21_5be31c5da539ff748c82041dda860e74_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 6180)
      • 7ccd7274 (PID: 2780)

    • The sample compiled with chinese language support

      • 2025-06-21_5be31c5da539ff748c82041dda860e74_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 6188)
      • 2025-06-21_5be31c5da539ff748c82041dda860e74_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 6180)

    • Process checks computer location settings

      • 2025-06-21_5be31c5da539ff748c82041dda860e74_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 6188)

    • Reads the software policy settings

      • 7ccd7274 (PID: 2780)
      • slui.exe (PID: 4684)
      • 2025-06-21_5be31c5da539ff748c82041dda860e74_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 6180)

    • Checks proxy server information

      • slui.exe (PID: 4684)
      • 2025-06-21_5be31c5da539ff748c82041dda860e74_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 6180)

    • Reads the machine GUID from the registry

      • 7ccd7274 (PID: 2780)
      • 2025-06-21_5be31c5da539ff748c82041dda860e74_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 6180)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:05:03 03:57:26+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 145408
InitializedDataSize: 236544
UninitializedDataSize: -
EntryPoint: 0x1317f
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 23.9.20.1611
ProductVersionNumber: 23.9.20.1611
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Unicode
FileVersion: 23, 9, 20, 1611
ProductVersion: 23, 9, 20, 1611
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
4
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 2025-06-21_5be31c5da539ff748c82041dda860e74_amadey_elex_rhadamanthys_smoke-loader_stop.exe no specs 2025-06-21_5be31c5da539ff748c82041dda860e74_amadey_elex_rhadamanthys_smoke-loader_stop.exe 7ccd7274 slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
2780C:\Windows\Syswow64\7ccd7274C:\Windows\SysWOW64\7ccd7274
services.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Version:
23, 9, 20, 1611
Modules
Images
c:\windows\syswow64\7ccd7274
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
4684C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6180"C:\Users\admin\Desktop\2025-06-21_5be31c5da539ff748c82041dda860e74_amadey_elex_rhadamanthys_smoke-loader_stop.exe" C:\Users\admin\Desktop\2025-06-21_5be31c5da539ff748c82041dda860e74_amadey_elex_rhadamanthys_smoke-loader_stop.exe
2025-06-21_5be31c5da539ff748c82041dda860e74_amadey_elex_rhadamanthys_smoke-loader_stop.exe
User:
admin
Integrity Level:
HIGH
Version:
23, 9, 20, 1611
Modules
Images
c:\users\admin\desktop\2025-06-21_5be31c5da539ff748c82041dda860e74_amadey_elex_rhadamanthys_smoke-loader_stop.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6188"C:\Users\admin\Desktop\2025-06-21_5be31c5da539ff748c82041dda860e74_amadey_elex_rhadamanthys_smoke-loader_stop.exe" C:\Users\admin\Desktop\2025-06-21_5be31c5da539ff748c82041dda860e74_amadey_elex_rhadamanthys_smoke-loader_stop.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
23, 9, 20, 1611
Modules
Images
c:\users\admin\desktop\2025-06-21_5be31c5da539ff748c82041dda860e74_amadey_elex_rhadamanthys_smoke-loader_stop.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
11 885
Read events
11 882
Write events
3
Delete events
0

Modification events

(PID) Process:(6180) 2025-06-21_5be31c5da539ff748c82041dda860e74_amadey_elex_rhadamanthys_smoke-loader_stop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6180) 2025-06-21_5be31c5da539ff748c82041dda860e74_amadey_elex_rhadamanthys_smoke-loader_stop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6180) 2025-06-21_5be31c5da539ff748c82041dda860e74_amadey_elex_rhadamanthys_smoke-loader_stop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
1
Suspicious files
0
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
61802025-06-21_5be31c5da539ff748c82041dda860e74_amadey_elex_rhadamanthys_smoke-loader_stop.exeC:\Windows\SysWOW64\7ccd7274executable
MD5:2F3ACBDC4B93D7233705435963C7D35D
SHA256:8FE1785068A34DDC2B29B8FAA2213CA680574B464AF5AE4EC783296D96F9B7D8
61802025-06-21_5be31c5da539ff748c82041dda860e74_amadey_elex_rhadamanthys_smoke-loader_stop.exeC:\Windows\69cdc8text
MD5:54ADBF819C1538FA71C549D9960B154B
SHA256:EB5484D9EDC744AED2AE05C4BCD43ABE7BED6C4730ADF8D6DC477B14AA76D162
27807ccd7274C:\Windows\2f9838text
MD5:9C94731C0A8A363BE1F5BBADD25D5D28
SHA256:BD8852E3D102BD6841776CCDFB4A1C1CE465E7C3F300C79BFD74494D8CDF5678
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
187
TCP/UDP connections
260
DNS requests
45
Threats
62

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5944
MoUsoCoreWorker.exe
GET
200
23.55.104.172:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.55.104.172:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2320
RUXIMICS.exe
GET
200
23.55.104.172:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2320
RUXIMICS.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2780
7ccd7274
GET
200
223.5.5.5:80
http://223.5.5.5/resolve?name=down.nugong.asia&type=1
unknown
—
—
unknown
—
—
GET
200
223.6.6.6:443
https://dns.alidns.com/resolve?name=spi1.tyui54345.xyz&type=16
unknown
binary
254 b
whitelisted
—
—
GET
200
223.5.5.5:443
https://dns.alidns.com/resolve?name=down.nugong.asia&type=1
unknown
binary
257 b
whitelisted
2780
7ccd7274
GET
200
223.6.6.6:80
http://dns.alidns.com/resolve?name=spi1.tyui54345.xyz&type=16
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5944
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2320
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
23.55.104.172:80
crl.microsoft.com
Akamai International B.V.
US
whitelisted
5944
MoUsoCoreWorker.exe
23.55.104.172:80
crl.microsoft.com
Akamai International B.V.
US
whitelisted
2320
RUXIMICS.exe
23.55.104.172:80
crl.microsoft.com
Akamai International B.V.
US
whitelisted
1268
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5944
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
whitelisted
google.com
  • 172.217.16.206
whitelisted
crl.microsoft.com
  • 23.55.104.172
  • 23.55.104.190
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
down.nugong.asia
  • —
unknown
dns.alidns.com
  • 223.6.6.6
  • 223.5.5.5
whitelisted
down.xy58.top
  • —
unknown
31bd9b27a24e0be9.tyui54345.xyz
  • —
unknown
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
yzzcommon.tyui54345.xyz
  • —
unknown

Threats

PID
Process
Class
Message
2780
7ccd7274
Misc activity
ET INFO Observed DNS Over HTTPS Domain (dns .alidns .com in TLS SNI)
2780
7ccd7274
Misc activity
ET INFO Observed DNS Over HTTPS Domain (dns .alidns .com in TLS SNI)
2780
7ccd7274
Misc activity
ET INFO Observed DNS Over HTTPS Domain (dns .alidns .com in TLS SNI)
2780
7ccd7274
Misc activity
ET INFO Observed DNS Over HTTPS Domain (dns .alidns .com in TLS SNI)
2780
7ccd7274
Misc activity
ET INFO Observed DNS Over HTTPS Domain (dns .alidns .com in TLS SNI)
2780
7ccd7274
Misc activity
ET INFO Observed DNS Over HTTPS Domain (dns .alidns .com in TLS SNI)
2780
7ccd7274
Misc activity
ET INFO Observed DNS Over HTTPS Domain (dns .alidns .com in TLS SNI)
2780
7ccd7274
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
2780
7ccd7274
Misc activity
ET INFO Observed DNS Over HTTPS Domain (dns .alidns .com in TLS SNI)
2780
7ccd7274
Misc activity
ET INFO Observed DNS Over HTTPS Domain (dns .alidns .com in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-06-21_5be31c5da539ff748c82041dda860e74_amadey_elex_rhadamanthys_smoke-loader_stop