File name:

2025-04-29_05ca13c64265bc4f4ccfee69bb73ec33_elex_rhadamanthys_smoke-loader_stealc

Full analysis: https://app.any.run/tasks/c2a54da7-196f-4778-83ce-a6131877e0d9
Verdict: Malicious activity
Analysis date: April 29, 2025, 00:38:07
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-reg
tofsee
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

05CA13C64265BC4F4CCFEE69BB73EC33

SHA1:

143EDA0688CE8382F4884B394F91E3232BCBE566

SHA256:

BEF2A8C20AB3076F9EFC25B57A030ED7399B6CA4FCD39145C6B60DFD576DF191

SSDEEP:

12288:pvXiM8EBQo8ccvXa9SBwUbHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHn:ViMiDXa9SWU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • TOFSEE has been detected (YARA)

      • svchost.exe (PID: 8180)

    • Changes the autorun value in the registry

      • 2025-04-29_05ca13c64265bc4f4ccfee69bb73ec33_elex_rhadamanthys_smoke-loader_stealc.exe (PID: 7748)

  • SUSPICIOUS

    • Detected use of alternative data streams (AltDS)

      • svchost.exe (PID: 8180)
      • svchost.exe (PID: 8048)

    • Executable content was dropped or overwritten

      • 2025-04-29_05ca13c64265bc4f4ccfee69bb73ec33_elex_rhadamanthys_smoke-loader_stealc.exe (PID: 7748)

    • Reads security settings of Internet Explorer

      • 2025-04-29_05ca13c64265bc4f4ccfee69bb73ec33_elex_rhadamanthys_smoke-loader_stealc.exe (PID: 7748)

    • Executes application which crashes

      • 2025-04-29_05ca13c64265bc4f4ccfee69bb73ec33_elex_rhadamanthys_smoke-loader_stealc.exe (PID: 7748)
      • kxjgzmrb.exe (PID: 8156)
      • kxjgzmrb.exe (PID: 7936)

    • Connects to SMTP port

      • svchost.exe (PID: 8180)
      • svchost.exe (PID: 8048)

  • INFO

    • The sample compiled with english language support

      • 2025-04-29_05ca13c64265bc4f4ccfee69bb73ec33_elex_rhadamanthys_smoke-loader_stealc.exe (PID: 7748)

    • Create files in a temporary directory

      • 2025-04-29_05ca13c64265bc4f4ccfee69bb73ec33_elex_rhadamanthys_smoke-loader_stealc.exe (PID: 7748)

    • Reads the computer name

      • 2025-04-29_05ca13c64265bc4f4ccfee69bb73ec33_elex_rhadamanthys_smoke-loader_stealc.exe (PID: 7748)
      • kxjgzmrb.exe (PID: 7936)
      • kxjgzmrb.exe (PID: 8156)

    • Checks supported languages

      • 2025-04-29_05ca13c64265bc4f4ccfee69bb73ec33_elex_rhadamanthys_smoke-loader_stealc.exe (PID: 7748)
      • kxjgzmrb.exe (PID: 7936)
      • kxjgzmrb.exe (PID: 8156)

    • Manual execution by a user

      • kxjgzmrb.exe (PID: 8156)

    • Process checks computer location settings

      • 2025-04-29_05ca13c64265bc4f4ccfee69bb73ec33_elex_rhadamanthys_smoke-loader_stealc.exe (PID: 7748)

    • Auto-launch of the file from Registry key

      • 2025-04-29_05ca13c64265bc4f4ccfee69bb73ec33_elex_rhadamanthys_smoke-loader_stealc.exe (PID: 7748)

    • Checks proxy server information

      • slui.exe (PID: 7148)

    • Reads the software policy settings

      • slui.exe (PID: 7148)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:06:06 01:58:44+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 153088
InitializedDataSize: 32161280
UninitializedDataSize: -
EntryPoint: 0x1668
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 67.0.0.0
ProductVersionNumber: 67.0.0.0
FileFlagsMask: 0x003f
FileFlags: Debug, Pre-release, Patched, Private build, Special build
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
FileVersion: 67.0.0.55
ProductVersion: 67.0.0.55
LegalCopyright: Wseg
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
11
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start 2025-04-29_05ca13c64265bc4f4ccfee69bb73ec33_elex_rhadamanthys_smoke-loader_stealc.exe wusa.exe no specs wusa.exe kxjgzmrb.exe werfault.exe no specs svchost.exe werfault.exe no specs kxjgzmrb.exe #TOFSEE svchost.exe werfault.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
2384C:\WINDOWS\SysWOW64\WerFault.exe -u -p 8156 -s 524C:\Windows\SysWOW64\WerFault.exe—kxjgzmrb.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
7148C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7748"C:\Users\admin\Desktop\2025-04-29_05ca13c64265bc4f4ccfee69bb73ec33_elex_rhadamanthys_smoke-loader_stealc.exe" C:\Users\admin\Desktop\2025-04-29_05ca13c64265bc4f4ccfee69bb73ec33_elex_rhadamanthys_smoke-loader_stealc.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\desktop\2025-04-29_05ca13c64265bc4f4ccfee69bb73ec33_elex_rhadamanthys_smoke-loader_stealc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7808"C:\Windows\System32\wusa.exe" C:\Windows\SysWOW64\wusa.exe—2025-04-29_05ca13c64265bc4f4ccfee69bb73ec33_elex_rhadamanthys_smoke-loader_stealc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Update Standalone Installer
Exit code:
3221226540
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\wusa.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
7912"C:\WINDOWS\SysWOW64\wusa.exe" C:\Windows\SysWOW64\wusa.exe
2025-04-29_05ca13c64265bc4f4ccfee69bb73ec33_elex_rhadamanthys_smoke-loader_stealc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Update Standalone Installer
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\wusa.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
7936"C:\Users\admin\kxjgzmrb.exe" /d"C:\Users\admin\Desktop\2025-04-29_05ca13c64265bc4f4ccfee69bb73ec33_elex_rhadamanthys_smoke-loader_stealc.exe" /e550302100000007FC:\Users\admin\kxjgzmrb.exe
2025-04-29_05ca13c64265bc4f4ccfee69bb73ec33_elex_rhadamanthys_smoke-loader_stealc.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\kxjgzmrb.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
8016C:\WINDOWS\SysWOW64\WerFault.exe -u -p 7748 -s 1032C:\Windows\SysWOW64\WerFault.exe—2025-04-29_05ca13c64265bc4f4ccfee69bb73ec33_elex_rhadamanthys_smoke-loader_stealc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
8048svchost.exeC:\Windows\SysWOW64\svchost.exe
kxjgzmrb.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
8100C:\WINDOWS\SysWOW64\WerFault.exe -u -p 7936 -s 556C:\Windows\SysWOW64\WerFault.exe—kxjgzmrb.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
8156"C:\Users\admin\kxjgzmrb.exe"C:\Users\admin\kxjgzmrb.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\kxjgzmrb.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
Total events
5 319
Read events
5 316
Write events
2
Delete events
1

Modification events

(PID) Process:(7748) 2025-04-29_05ca13c64265bc4f4ccfee69bb73ec33_elex_rhadamanthys_smoke-loader_stealc.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:qrazpbtk
Value:
"C:\Users\admin\kxjgzmrb.exe"
(PID) Process:(8048) svchost.exeKey:HKEY_CURRENT_USER\Control Panel\Buses
Operation:writeName:Config0
Value:
008DBF3FFB321D3D24EDB47D450DD49D084297DCE82E72BAA493FDFFE422031D2DF40F9A48CD945D24EDB47D470DD49D024195DAF71261ADC06D04FDA6E22673BBC9154961CDA56B15D48248723AE4AE644490BDB57C25EF9C5C02CBF3BC54758DF21D5904E0A06810D5804F7D3DE39D084295D9E13F4BB4C06D07FD
(PID) Process:(8048) svchost.exeKey:HKEY_CURRENT_USER\Control Panel\Buses
Operation:delete valueName:Config1
Value:
Executable files
2
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
8048svchost.exeC:\Users\admin:.reposbinary
MD5:6A035D42B86EB2F323ED4105D800F322
SHA256:2EFD7D6970EB3EDE286AAA1CBD901AF4FE1854A8DBED0D25F07348A0ED069EB8
77482025-04-29_05ca13c64265bc4f4ccfee69bb73ec33_elex_rhadamanthys_smoke-loader_stealc.exeC:\Users\admin\kxjgzmrb.exeexecutable
MD5:A047090E2B6516E7D2C1EDB6FDE36511
SHA256:B03FEA41E95625EC5B0B8890C4DFA79757A2120AED1F20BE25AC8C098BDBD7B5
77482025-04-29_05ca13c64265bc4f4ccfee69bb73ec33_elex_rhadamanthys_smoke-loader_stealc.exeC:\Users\admin\AppData\Local\Temp\qztyqpkg.exeexecutable
MD5:248283CD4104425CB583141A55B6CE29
SHA256:965B3BA3A8D7362871823181A1461D1BC884E5AE3AEA61BB6C6E05FC3A5568A8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
23
TCP/UDP connections
47
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6516
SIHClient.exe
GET
200
23.32.238.107:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
304
20.109.210.53:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
6516
SIHClient.exe
GET
200
23.38.73.129:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
6516
SIHClient.exe
GET
200
23.32.238.107:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
—
—
GET
200
20.109.210.53:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
6516
SIHClient.exe
GET
200
23.32.238.107:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
6516
SIHClient.exe
GET
200
23.38.73.129:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
6516
SIHClient.exe
GET
200
23.38.73.129:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
—
—
GET
200
13.95.31.18:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
unknown
—
—
—
—
—
GET
200
20.109.210.53:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
8048
svchost.exe
13.107.246.59:80
microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
8048
svchost.exe
52.101.8.42:25
microsoft-com.mail.protection.outlook.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
8048
svchost.exe
43.231.4.7:443
—
Gigabit Hosting Sdn Bhd
MY
unknown
8180
svchost.exe
13.107.246.59:80
microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
8180
svchost.exe
52.101.40.6:25
microsoft-com.mail.protection.outlook.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
8180
svchost.exe
43.231.4.7:443
—
Gigabit Hosting Sdn Bhd
MY
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
google.com
  • 142.250.186.46
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
microsoft.com
  • 13.107.246.59
whitelisted
microsoft-com.mail.protection.outlook.com
  • 52.101.8.42
  • 52.101.194.19
  • 52.101.10.2
  • 52.101.10.8
  • 52.101.40.6
  • 52.101.41.4
  • 52.101.194.4
  • 52.101.41.22
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
crl.microsoft.com
  • 23.32.238.107
whitelisted
www.microsoft.com
  • 23.38.73.129
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
  • 20.83.72.98
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-04-29_05ca13c64265bc4f4ccfee69bb73ec33_elex_rhadamanthys_smoke-loader_stealc