551c5f3975094373af56317820729ae6efb46461ca4a72b4915bf8c8c4e34f96

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/04/2026, 07:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-16_ed347aa105243c28ee3c6cfcd9f0df19_amadey_elex_karagany_rhadamanthys_smoke-loader.exe
Size 5.5MB
Sample260416-jt2cjsd121
SHA256 551c5f3975094373af56317820729ae6efb46461ca4a72b4915bf8c8c4e34f96
MD5 ed347aa105243c28ee3c6cfcd9f0df19
SHA1 4e4ae797e64c70bbbcdfc89e5c1f5f555ea9d2bf
SHA512 e4c9c5e9667a3fb8dd09429df3532a819d03142704da367672e095ee290304f4b3418a563263e0ba0bb91b3b78bb87323e4ed0c0b388d3d1bcb6a0b403790a2d
SSDEEP 98304:EHPeEOpDZp6+Wvl3D1tBpzOUV3m+hVGiqhx0RHbNvR5D1toKOQ5MpIcRnVKN1f:EHPylLclppiUFm+X1v7lD1tZOBFVK3f
TLSH
T11C4633AE70E08C15DC5A1AB0D33E03F741ED5D248B1AE969D8E888D42FD15A1BF3C6B5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5024	3ED9.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-16_ed347aa105243c28ee3c6cfcd9f0df19_amadey_elex_karagany_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3ED9.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 616 wrote to memory of 5024	616	2026-04-16_ed347aa105243c28ee3c6cfcd9f0df19_amadey_elex_karagany_rhadamanthys_smoke-loader.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-04-16_ed347aa105243c28ee3c6cfcd9f0df19_amadey_elex_karagany_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-16_ed347aa105243c28ee3c6cfcd9f0df19_amadey_elex_karagany_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:616
- C:\Users\Admin\AppData\Local\Temp\3ED9.tmp
  "C:\Users\Admin\AppData\Local\Temp\3ED9.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3ED9.tmp

Path C:\Users\Admin\AppData\Local\Temp\3ED9.tmp
Size 5.5MB
SHA256 b28625cb4bd5784359e87cff4ad81a7437fe5805da87aa824dceaa3e346e8b63
MD5 1e65c86ecc9690accaa8c64691478dc3
SHA1 1356ec19bbe50cba8c0b46e882ef67561679a732
SHA512 3e9e9f923ef7735954319b37578f4deace6439d1cfbaeb8680ed8c49e71e2542efd5e8382a9e8e2b8d7c2de04524cbbed6f81e64d161af30fcc98386beadfd3a
SSDEEP 98304:JQfADtQJZp6+Wvl3D1tBpzOUV3m+hVGiqhx0RHbNvR5D1toKOQ5MpIcRnVKN1f:JHpQLclppiUFm+X1v7lD1tZOBFVK3f
TLSH
T1E14633AEB1E08815DC5A1EB0C73E43F740E86D604B2DD97AE4E888E53FD51B1AE38574
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download