714090ac34f0ff841a9c18d9a8f8d83530371041aa62a113e97f9ec6a6a38bb2

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
31/03/2025, 07:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-03-31_67332a22df30dfa819b7640f9a5ce05b_amadey_karagany_rhadamanthys_smoke-loader.exe
Size

108KB
MD5

67332a22df30dfa819b7640f9a5ce05b
SHA1

2bf384c07a7ae946acc630fb2a89a2a7b3b9a02f
SHA256

714090ac34f0ff841a9c18d9a8f8d83530371041aa62a113e97f9ec6a6a38bb2
SHA512

244ccc028cc24782f01c78c9120024d1010ad9dbca93c5fdcb7ddf55f1c75ddcd4c2fe451fc0e04539d13d575bbef04a8e6411c72d99286b52195aa6c4f5f7e3
SSDEEP

1536:nwUHibBDAEGNDL+VepMa+WIy1fAqR9SfPmtvki3bTKkVlnPbah68XEPVCh5:w0i9D8pM9W91fAXev5jhah68XEPVCh5

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1312	768	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-03-31_67332a22df30dfa819b7640f9a5ce05b_amadey_karagany_rhadamanthys_smoke-loader.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 768 wrote to memory of 1312	768	2025-03-31_67332a22df30dfa819b7640f9a5ce05b_amadey_karagany_rhadamanthys_smoke-loader.exe	30
PID 768 wrote to memory of 1312	768	2025-03-31_67332a22df30dfa819b7640f9a5ce05b_amadey_karagany_rhadamanthys_smoke-loader.exe	30
PID 768 wrote to memory of 1312	768	2025-03-31_67332a22df30dfa819b7640f9a5ce05b_amadey_karagany_rhadamanthys_smoke-loader.exe	30
PID 768 wrote to memory of 1312	768	2025-03-31_67332a22df30dfa819b7640f9a5ce05b_amadey_karagany_rhadamanthys_smoke-loader.exe	30

C:\Users\Admin\AppData\Local\Temp\2025-03-31_67332a22df30dfa819b7640f9a5ce05b_amadey_karagany_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2025-03-31_67332a22df30dfa819b7640f9a5ce05b_amadey_karagany_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 768 -s 96
  2⤵
  - Program crash
  PID:1312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads