5855b311c849e5e707d9d2bc98e4dd2be4ed483482cd0e7083e6a4b569102db6

Analysis

max time kernel
149s
max time network
141s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 22:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_7e9ca6b3cdc6055f31dcc19e20fece3c_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Size 128KB
Sample260415-2a17jsdv9v
SHA256 5855b311c849e5e707d9d2bc98e4dd2be4ed483482cd0e7083e6a4b569102db6
MD5 7e9ca6b3cdc6055f31dcc19e20fece3c
SHA1 1702616363372594618019232284f9e2d12f958b
SHA512 4d49e860d7d3ca973f7d814b00ff722b0bbd0ea9d794500b60a190f665241218949c7786798443c83586d8eec1b3791f59b0afd6488201020858b4076421b175
SSDEEP 1536:tjX0s1IG9k50g0tHgzaZo50Se8ia7kPd4qIP731J+lx+fSQeWcHmlt3aJtjW79Aa:tTfg0txZ27kPdITzqx+ZAmw67qyRkSJ
TLSH
T175D3D0063893D072D40101B4046B8EF17B7FADE37ABD951FABBDF10E6EB12684966271
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
2440	1g6ga.exe
4576	1g6ga.exe
4360	k31x.exe
4040	k31x.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows\CurrentVersion\Run\dz9rkd = "C:\\Users\\Admin\\AppData\\Roaming\\1g6ga.exe"	2026-04-15_7e9ca6b3cdc6055f31dcc19e20fece3c_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows\CurrentVersion\Run\r63c = "C:\\Users\\Admin\\AppData\\Roaming\\k31x.exe"	1g6ga.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3028 set thread context of 4912	3028	2026-04-15_7e9ca6b3cdc6055f31dcc19e20fece3c_amadey_elex_rhadamanthys_smoke-loader_stop.exe	78
PID 2440 set thread context of 4576	2440	1g6ga.exe	83
PID 4360 set thread context of 4040	4360	k31x.exe	87

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4916	3028	WerFault.exe	77
1632	2440	WerFault.exe	80
3292	4360	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k31x.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_7e9ca6b3cdc6055f31dcc19e20fece3c_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_7e9ca6b3cdc6055f31dcc19e20fece3c_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1g6ga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1g6ga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k31x.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 4912	3028	2026-04-15_7e9ca6b3cdc6055f31dcc19e20fece3c_amadey_elex_rhadamanthys_smoke-loader_stop.exe	78
PID 3028 wrote to memory of 4912	3028	2026-04-15_7e9ca6b3cdc6055f31dcc19e20fece3c_amadey_elex_rhadamanthys_smoke-loader_stop.exe	78
PID 4912 wrote to memory of 2440	4912	2026-04-15_7e9ca6b3cdc6055f31dcc19e20fece3c_amadey_elex_rhadamanthys_smoke-loader_stop.exe	80
PID 2440 wrote to memory of 4576	2440	1g6ga.exe	83
PID 2440 wrote to memory of 4576	2440	1g6ga.exe	83
PID 4576 wrote to memory of 4360	4576	1g6ga.exe	84
PID 4360 wrote to memory of 4040	4360	k31x.exe	87
PID 4360 wrote to memory of 4040	4360	k31x.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-04-15_7e9ca6b3cdc6055f31dcc19e20fece3c_amadey_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_7e9ca6b3cdc6055f31dcc19e20fece3c_amadey_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Users\Admin\AppData\Local\Temp\2026-04-15_7e9ca6b3cdc6055f31dcc19e20fece3c_amadey_elex_rhadamanthys_smoke-loader_stop.exe
  C:\Users\Admin\AppData\Local\Temp\2026-04-15_7e9ca6b3cdc6055f31dcc19e20fece3c_amadey_elex_rhadamanthys_smoke-loader_stop.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4912
- - C:\Users\Admin\AppData\Roaming\1g6ga.exe
    C:\Users\Admin\AppData\Roaming\1g6ga.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2440
  - - C:\Users\Admin\AppData\Roaming\1g6ga.exe
      C:\Users\Admin\AppData\Roaming\1g6ga.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4576
    - - C:\Users\Admin\AppData\Roaming\k31x.exe
        
        C:\Users\Admin\AppData\Roaming\k31x.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4360
      - C:\Users\Admin\AppData\Roaming\k31x.exe
        
        C:\Users\Admin\AppData\Roaming\k31x.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4040
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4360 -s 384
        6⤵
        Program crash
        
        PID:3292
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 372
      4⤵
      Program crash
      PID:1632
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 372
  2⤵
  - Program crash
  PID:4916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 3028 -ip 3028
1⤵
PID:3816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2440 -ip 2440
1⤵
PID:4388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4360 -ip 4360
1⤵
PID:2448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1g6ga.exe

Path C:\Users\Admin\AppData\Roaming\1g6ga.exe
Size 128KB
SHA256 8577a66645917cd2530ce93cd4ea73d9b8873033657dcafa21cc4fa3beabe980
MD5 98d0fba28c0ac065b0bffe35256155d8
SHA1 960771d08e6bb46dfcf9ffb57f0f023c1b2567a3
SHA512 31a7c85f1aed530c80e6074db6df81159cd94bff9c2c1b60255f5235909189012d194b5e5d9e9e87c734e043a368b46f8f903c5060301856e7bff7e3b580191b
SSDEEP 1536:RjX0s1IG9k50g0tHgzaZo50Se8ia7kPd4qIP731J+lx+fSQeWcHmlt3aJtjW79Aa:RTfg0txZ27kPdITzqx+ZAmw67qyRkSJ
TLSH
T1FFD3D0063893D072D40101B4046B8EF17B7FADE37ABD951FABBDF10E6EB12684966271
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

k31x.exe

Path C:\Users\Admin\AppData\Roaming\k31x.exe
Size 128KB
SHA256 22e4e560a58402d6f8eb2b15f7df91e29e54235f7e21ddf3415e88ce4c6676aa
MD5 a4b5361b997d8e8f129e3ca6f74b84d3
SHA1 893ad54d07e3db893b1fab890d9ddab45103f375
SHA512 0eb8f30bfc9e944bb41e6baef3a473ab9c77e26318144cab965cb2f084307a7457b4a44ef7f6821449c00ade5a967a57510c815dba895a99075a885a0f301f47
SSDEEP 1536:pjX0s1IG9k50g0tHgzaZo50Se8ia7kPd4qIP731J+lx+fSQeWcHmlt3aJtjW79Aa:pTfg0txZ27kPdITzqx+ZAmw67qyRkSJ
TLSH
T117D3D0063893D072D40101B4046B8EF17B7FADE37ABD951FABBDF10E6EB12684966271
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4040-29-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4040-26-0x0000000002B40000-0x0000000002B47000-memory.dmp

Download

memory/4040-51-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4040-49-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4040-47-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4040-41-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4040-37-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4040-20-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4040-19-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4040-21-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4040-33-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4040-25-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4576-13-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4576-10-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4576-11-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4912-0-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4912-22-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4912-1-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4912-4-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4912-2-0x0000000000400000-0x0000000000429000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads