5d06522342d63cff0e03df1c0e96e6fab916d05359862c9a93e45219695147ea

Analysis

max time kernel
149s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/04/2026, 00:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-23_2af88a062ee69c9cd2664ecbdf9afc91_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Size 124KB
Sample260423-a8rbfsfs2v
SHA256 5d06522342d63cff0e03df1c0e96e6fab916d05359862c9a93e45219695147ea
MD5 2af88a062ee69c9cd2664ecbdf9afc91
SHA1 23d8cd0748854b99f0727e092fe56881ab848f47
SHA512 3e6ae397d2eb73efd3616823b36ee40641e5e7a6a9dc329c299e649d6f10ca250dd526673e6a11f67b6f1248082f6859009dd785f733685e6270dd19344d7f97
SSDEEP 1536:wLBYbzcsgkNn4jnstTfIGsXbJyBnZuZ27ogIlt7TeNJOSA5mEY7X05uHaW34k5RZ:GLjnstTf9ZuZ2MgGwQ/2auHaFq4UvJ
TLSH
T185C3AD503523C832D8F04DBC409FCF847B6FED432AB5561BFB9476596B71288B52AAB0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1924	1g6ga.exe
4752	1g6ga.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows\CurrentVersion\Run\dz9rkd = "C:\\Users\\Admin\\AppData\\Roaming\\1g6ga.exe"	2026-04-23_2af88a062ee69c9cd2664ecbdf9afc91_amadey_elex_rhadamanthys_smoke-loader_stop.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2392 set thread context of 1116	2392	2026-04-23_2af88a062ee69c9cd2664ecbdf9afc91_amadey_elex_rhadamanthys_smoke-loader_stop.exe	80
PID 1924 set thread context of 4752	1924	1g6ga.exe	84

Program crash 2 IoCs

pid	pid_target	Process	procid_target
796	2392	WerFault.exe	79
4272	1924	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-23_2af88a062ee69c9cd2664ecbdf9afc91_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-23_2af88a062ee69c9cd2664ecbdf9afc91_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1g6ga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1g6ga.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 1116	2392	2026-04-23_2af88a062ee69c9cd2664ecbdf9afc91_amadey_elex_rhadamanthys_smoke-loader_stop.exe	80
PID 2392 wrote to memory of 1116	2392	2026-04-23_2af88a062ee69c9cd2664ecbdf9afc91_amadey_elex_rhadamanthys_smoke-loader_stop.exe	80
PID 1116 wrote to memory of 1924	1116	2026-04-23_2af88a062ee69c9cd2664ecbdf9afc91_amadey_elex_rhadamanthys_smoke-loader_stop.exe	83
PID 1924 wrote to memory of 4752	1924	1g6ga.exe	84
PID 1924 wrote to memory of 4752	1924	1g6ga.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-04-23_2af88a062ee69c9cd2664ecbdf9afc91_amadey_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-23_2af88a062ee69c9cd2664ecbdf9afc91_amadey_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Users\Admin\AppData\Local\Temp\2026-04-23_2af88a062ee69c9cd2664ecbdf9afc91_amadey_elex_rhadamanthys_smoke-loader_stop.exe
  C:\Users\Admin\AppData\Local\Temp\2026-04-23_2af88a062ee69c9cd2664ecbdf9afc91_amadey_elex_rhadamanthys_smoke-loader_stop.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1116
- - C:\Users\Admin\AppData\Roaming\1g6ga.exe
    C:\Users\Admin\AppData\Roaming\1g6ga.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1924
  - - C:\Users\Admin\AppData\Roaming\1g6ga.exe
      C:\Users\Admin\AppData\Roaming\1g6ga.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4752
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1924 -s 316
      4⤵
      Program crash
      PID:4272
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 316
  2⤵
  - Program crash
  PID:796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2392 -ip 2392
1⤵
PID:2036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1924 -ip 1924
1⤵
PID:4284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1g6ga.exe

Path C:\Users\Admin\AppData\Roaming\1g6ga.exe
Size 124KB
SHA256 e7a834b07d99ce8ef605abae758268511f2d1fe79ee195edd20c433a36080f13
MD5 5121dcc0ba7358cc3e6723ee6d48c081
SHA1 0becb0a4cdef4318d37eac65de7c1bda3add7518
SHA512 ba9fd3e999513231c5195083dadc5fb95ba59fd55cff158fda524379f20cb7c884455c21b6df9a8b99038fa0fa8c8fc811d7fd6134a34c243b2ca917321212e3
SSDEEP 1536:JLBYbzcsgkNn4jnstTfIGsXbJyBnZuZ27ogIlt7TeNJOSA5mEY7X05uHaW34k5RZ:1LjnstTf9ZuZ2MgGwQ/2auHaFq4UvJ
TLSH
T196C3AD503523C832D8F04DBC409FCF847B6FED432AB5561BFB9476596B71288B52AAB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1116-0-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1116-1-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1116-2-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1116-4-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4752-10-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4752-11-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4752-12-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4752-14-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4752-16-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4752-18-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4752-20-0x0000000000400000-0x0000000000429000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads