File name:

2025-08-01_d27f356fe720dea8a22a84c0f89ddbb1_amadey_elex_rhadamanthys_smoke-loader_stop.exe

Full analysis: https://app.any.run/tasks/b5db46cb-748a-4492-8a73-65db8699a49d
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: August 01, 2025, 02:57:21
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
sality
sainbox
rat
auto-reg
upx
bifrost
loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

D27F356FE720DEA8A22A84C0F89DDBB1

SHA1:

4AD037931173B9F150520610B06015B746D5A3F0

SHA256:

6BE629318764EDC94A3E65166BDB238EE4EE0BD634656A603AF5BF91045D8A8A

SSDEEP:

6144:nW6A11IZmhZmkskCgqWfYYyvXmYF2HzCFZsOiT9tz:nW6A11IZmhNsk/HYYmXTKzJTHz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • SALITY mutex has been found

      • 2025-08-01_d27f356fe720dea8a22a84c0f89ddbb1_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 1560)
      • CacheMgr.exe (PID: 1324)
      • CacheMgr.exe (PID: 5456)
    • Changes appearance of the Explorer extensions

      • 2025-08-01_d27f356fe720dea8a22a84c0f89ddbb1_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 1560)
    • SAINBOX has been detected

      • 2025-08-01_d27f356fe720dea8a22a84c0f89ddbb1_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 1560)
    • Changes the autorun value in the registry

      • 2025-08-01_d27f356fe720dea8a22a84c0f89ddbb1_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 1560)
    • BIFROST mutex has been found

      • CacheMgr.exe (PID: 1324)
  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • 2025-08-01_d27f356fe720dea8a22a84c0f89ddbb1_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 1560)
    • Executable content was dropped or overwritten

      • cmd.exe (PID: 7052)
      • CacheMgr.exe (PID: 1324)
    • Process requests binary or script from the Internet

      • CacheMgr.exe (PID: 1324)
    • Reads security settings of Internet Explorer

      • CacheMgr.exe (PID: 1324)
    • Starts itself from another location

      • 2025-08-01_d27f356fe720dea8a22a84c0f89ddbb1_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 1560)
    • Process drops legitimate windows executable

      • CacheMgr.exe (PID: 1324)
    • Creates file in the systems drive root

      • CacheMgr.exe (PID: 1324)
  • INFO

    • Creates files in the program directory

      • cmd.exe (PID: 7052)
      • CacheMgr.exe (PID: 1324)
    • Checks supported languages

      • 2025-08-01_d27f356fe720dea8a22a84c0f89ddbb1_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 1560)
      • CacheMgr.exe (PID: 1324)
      • CacheMgr.exe (PID: 5456)
    • Reads the computer name

      • 2025-08-01_d27f356fe720dea8a22a84c0f89ddbb1_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 1560)
      • CacheMgr.exe (PID: 1324)
    • Launching a file from a Registry key

      • 2025-08-01_d27f356fe720dea8a22a84c0f89ddbb1_amadey_elex_rhadamanthys_smoke-loader_stop.exe (PID: 1560)
    • Manual execution by a user

      • CacheMgr.exe (PID: 5456)
    • UPX packer has been detected

      • CacheMgr.exe (PID: 1324)
    • Create files in a temporary directory

      • CacheMgr.exe (PID: 1324)
    • Checks proxy server information

      • CacheMgr.exe (PID: 1324)
      • slui.exe (PID: 3852)
    • Reads the software policy settings

      • slui.exe (PID: 3852)
    • The sample compiled with english language support

      • CacheMgr.exe (PID: 1324)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 97280
InitializedDataSize: 25088
UninitializedDataSize: -
EntryPoint: 0x12ecc
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
6
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #SALITY 2025-08-01_d27f356fe720dea8a22a84c0f89ddbb1_amadey_elex_rhadamanthys_smoke-loader_stop.exe cmd.exe conhost.exe no specs #SALITY cachemgr.exe #SALITY cachemgr.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
1324"C:\ProgramData\CacheMgr.exe" -asC:\ProgramData\CacheMgr.exe
2025-08-01_d27f356fe720dea8a22a84c0f89ddbb1_amadey_elex_rhadamanthys_smoke-loader_stop.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\programdata\cachemgr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
1560"C:\Users\admin\Desktop\2025-08-01_d27f356fe720dea8a22a84c0f89ddbb1_amadey_elex_rhadamanthys_smoke-loader_stop.exe" C:\Users\admin\Desktop\2025-08-01_d27f356fe720dea8a22a84c0f89ddbb1_amadey_elex_rhadamanthys_smoke-loader_stop.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\2025-08-01_d27f356fe720dea8a22a84c0f89ddbb1_amadey_elex_rhadamanthys_smoke-loader_stop.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
3852C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5456"C:\ProgramData\CacheMgr.exe" -asC:\ProgramData\CacheMgr.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\programdata\cachemgr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ws2_32.dll
c:\windows\syswow64\rpcrt4.dll
5904\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7052"C:\WINDOWS\system32\cmd.exe" /c copy "C:\Users\admin\Desktop\2025-08-01_d27f356fe720dea8a22a84c0f89ddbb1_amadey_elex_rhadamanthys_smoke-loader_stop.exe" "C:\ProgramData\CacheMgr.exe"C:\Windows\SysWOW64\cmd.exe
2025-08-01_d27f356fe720dea8a22a84c0f89ddbb1_amadey_elex_rhadamanthys_smoke-loader_stop.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
4 334
Read events
4 309
Write events
25
Delete events
0

Modification events

(PID) Process:(1560) 2025-08-01_d27f356fe720dea8a22a84c0f89ddbb1_amadey_elex_rhadamanthys_smoke-loader_stop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Operation:writeName:Hidden
Value:
2
(PID) Process:(1560) 2025-08-01_d27f356fe720dea8a22a84c0f89ddbb1_amadey_elex_rhadamanthys_smoke-loader_stop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:GlobalUserOffline
Value:
0
(PID) Process:(1560) 2025-08-01_d27f356fe720dea8a22a84c0f89ddbb1_amadey_elex_rhadamanthys_smoke-loader_stop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Aaspp\-227342143
Operation:writeName:1768776801
Value:
136
(PID) Process:(1560) 2025-08-01_d27f356fe720dea8a22a84c0f89ddbb1_amadey_elex_rhadamanthys_smoke-loader_stop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Aaspp\-227342143
Operation:writeName:-757413694
Value:
0
(PID) Process:(1560) 2025-08-01_d27f356fe720dea8a22a84c0f89ddbb1_amadey_elex_rhadamanthys_smoke-loader_stop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Aaspp\-227342143
Operation:writeName:1011363107
Value:
0
(PID) Process:(1560) 2025-08-01_d27f356fe720dea8a22a84c0f89ddbb1_amadey_elex_rhadamanthys_smoke-loader_stop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Aaspp\-227342143
Operation:writeName:-1514827388
Value:
35
(PID) Process:(1560) 2025-08-01_d27f356fe720dea8a22a84c0f89ddbb1_amadey_elex_rhadamanthys_smoke-loader_stop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Aaspp\-227342143
Operation:writeName:253949413
Value:
267
(PID) Process:(1560) 2025-08-01_d27f356fe720dea8a22a84c0f89ddbb1_amadey_elex_rhadamanthys_smoke-loader_stop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Aaspp\-227342143
Operation:writeName:2022726214
Value:
0800687474703A2F2F616C7468617772792E6F72672F696D616765732F78732E6A706700687474703A2F2F7777772E6361726565726465736B2E6F72672F696D616765732F78732E6A706700687474703A2F2F6172746875722E6E697269612E62697A2F78732E6A706700687474703A2F2F616D73616D65782E636F6D2F78732E6A706700687474703A2F2F6170706C652D7069652E696E2F696D616765732F78732E6A706700687474703A2F2F61686D65646979652E6E65742F78732E6A706700687474703A2F2F67322E6172726F776869746563682E636F6D2F78732E6A706700687474703A2F2F616D7079617A696C696D2E636F6D2E74722F696D616765732F7873322E6A7067
(PID) Process:(1560) 2025-08-01_d27f356fe720dea8a22a84c0f89ddbb1_amadey_elex_rhadamanthys_smoke-loader_stop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Aaspp\-227342143
Operation:writeName:-503464281
Value:
23E4F7F25F8A545EF07859773043475EDD1D103E2D9C27F1F3A268ED09F30DE884DB9D92FD831B72EEF599E8C233EB23FBE7145BFA46281679ED385593CEE8869548167F08C5681A4B967232DBC5E0E01EC06026FCE8B24FCB589B28C073413E3C9C326851C4731397E851C96D85B6EDDDAA4E25FA227776D385991927AE94FC
(PID) Process:(1560) 2025-08-01_d27f356fe720dea8a22a84c0f89ddbb1_amadey_elex_rhadamanthys_smoke-loader_stop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Aaspp
Operation:writeName:a1_0
Value:
Executable files
3
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
7052cmd.exeC:\ProgramData\CacheMgr.exeexecutable
MD5:D27F356FE720DEA8A22A84C0F89DDBB1
SHA256:6BE629318764EDC94A3E65166BDB238EE4EE0BD634656A603AF5BF91045D8A8A
1324CacheMgr.exeC:\Users\admin\AppData\Local\Temp\winrwwiu.exeexecutable
MD5:25AA9BB549ECC7BB6100F8D179452508
SHA256:DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C
1324CacheMgr.exeC:\Users\admin\AppData\Local\Microsoft\OneDrive\OneDrive.exeexecutable
MD5:CF1A1B2A6F227D5B06AB0B3C8B88618B
SHA256:1FD250A499B2912B1ACEC31A03CAA32F1B328F2861E1383E94F23386F724FB36
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
45
TCP/UDP connections
54
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5944
MoUsoCoreWorker.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
1268
svchost.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
6292
RUXIMICS.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
1268
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
6292
RUXIMICS.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
POST
200
20.190.160.67:443
https://login.live.com/RST2.srf
unknown
xml
1.24 Kb
whitelisted
POST
400
20.190.160.66:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
POST
400
40.126.32.138:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
POST
400
20.190.160.3:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
203 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
whitelisted
1268
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6292
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
whitelisted
5944
MoUsoCoreWorker.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6292
RUXIMICS.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5944
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
1268
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
whitelisted
google.com
  • 172.217.18.14
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
login.live.com
  • 20.190.160.65
  • 20.190.160.67
  • 20.190.160.131
  • 40.126.32.138
  • 40.126.32.74
  • 40.126.32.68
  • 40.126.32.133
  • 20.190.160.17
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
fionades.com
  • 3.229.117.57
malicious
self.events.data.microsoft.com
  • 20.42.65.84
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info