551c5f3975094373af56317820729ae6efb46461ca4a72b4915bf8c8c4e34f96

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/04/2026, 07:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-16_ed347aa105243c28ee3c6cfcd9f0df19_amadey_elex_karagany_rhadamanthys_smoke-loader.exe
Size 5.5MB
Sample260416-jt2cjsd121
SHA256 551c5f3975094373af56317820729ae6efb46461ca4a72b4915bf8c8c4e34f96
MD5 ed347aa105243c28ee3c6cfcd9f0df19
SHA1 4e4ae797e64c70bbbcdfc89e5c1f5f555ea9d2bf
SHA512 e4c9c5e9667a3fb8dd09429df3532a819d03142704da367672e095ee290304f4b3418a563263e0ba0bb91b3b78bb87323e4ed0c0b388d3d1bcb6a0b403790a2d
SSDEEP 98304:EHPeEOpDZp6+Wvl3D1tBpzOUV3m+hVGiqhx0RHbNvR5D1toKOQ5MpIcRnVKN1f:EHPylLclppiUFm+X1v7lD1tZOBFVK3f
TLSH
T11C4633AE70E08C15DC5A1AB0D33E03F741ED5D248B1AE969D8E888D42FD15A1BF3C6B5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1228	1131.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-16_ed347aa105243c28ee3c6cfcd9f0df19_amadey_elex_karagany_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1131.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 1228	2660	2026-04-16_ed347aa105243c28ee3c6cfcd9f0df19_amadey_elex_karagany_rhadamanthys_smoke-loader.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-04-16_ed347aa105243c28ee3c6cfcd9f0df19_amadey_elex_karagany_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-16_ed347aa105243c28ee3c6cfcd9f0df19_amadey_elex_karagany_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Users\Admin\AppData\Local\Temp\1131.tmp
  "C:\Users\Admin\AppData\Local\Temp\1131.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1131.tmp

Path C:\Users\Admin\AppData\Local\Temp\1131.tmp
Size 5.5MB
SHA256 090cf2e53bd49ac9a0f530d8b1603c5feff5c805caa6eb4fb3059f479a269a73
MD5 8291a2e6a9e1d13b3780100cad7703d5
SHA1 4995edbae0a27b409a32f401f04441c8c02a4267
SHA512 30b80b9f3172c16b6e4989bac7be08ce916935b6f056e0700913e96f8cfc4c67fb812a3f11ff5f9b5f3b38346b24c4028802b9849ff29b0795b492c49b040434
SSDEEP 98304:kOzlAGuZp6+Wvl3D1tBpzOUV3m+hVGiqhx0RHbNvR5D1toKOQ5MpIcRnVKN1f:5WLclppiUFm+X1v7lD1tZOBFVK3f
TLSH
T1324633AD70D04C21DC995E71D73E43B340E99E644B1EDA6ED8E488E42FC16A0BF786B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download