Overview

overview

10

Static

static

10

2025-04-03...er.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/04/2025, 17:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-04-03_ab12f41e2e7b4faf5936da3ebcf4243a_amadey_karagany_rhadamanthys_smoke-loader.exe

  • Size

    108KB

  • MD5

    ab12f41e2e7b4faf5936da3ebcf4243a

  • SHA1

    274f20e845d5ea3dc53621f9b674dc62e271efb8

  • SHA256

    f29e35c4c6bb6b273822a2754e8eb6755cd4a3dee014ecccbbc97ca2a500dcbc

  • SHA512

    a33c0e9f2d701dda65b179f28d4806886fe12bfc8c1e9220a9f6c20e1c127b4c3a7a24feb83f10a905607df9756e52f6cefd1314167d5a1ba65c35ab065f7ab1

  • SSDEEP

    3072:w0i9D8pM9W91fAXev5jhW9h68XEPSCK5:w0iapM6fAXePZ1ax

Score
6/10
discovery

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-04-03_ab12f41e2e7b4faf5936da3ebcf4243a_amadey_karagany_rhadamanthys_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-04-03_ab12f41e2e7b4faf5936da3ebcf4243a_amadey_karagany_rhadamanthys_smoke-loader.exe"
    1⤵
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5484

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/5484-0-0x00000000036F0000-0x0000000003722000-memory.dmp

    Filesize

    200KB

    Download

  • memory/5484-1-0x0000000003870000-0x00000000038A8000-memory.dmp

    Filesize

    224KB

    Download

  • memory/5484-2-0x0000000003870000-0x00000000038A8000-memory.dmp

    Filesize

    224KB

    Download

  • memory/5484-3-0x0000000003870000-0x00000000038A8000-memory.dmp

    Filesize

    224KB

    Download

  • memory/5484-4-0x0000000003870000-0x00000000038A8000-memory.dmp

    Filesize

    224KB

    Download

  • memory/5484-5-0x0000000003870000-0x00000000038A8000-memory.dmp

    Filesize

    224KB

    Download

  • memory/5484-6-0x0000000003870000-0x00000000038A8000-memory.dmp

    Filesize

    224KB

    Download