b13050e0735cffcaebe1c6778580b2bfb0d90bdba4a39fa26f33b06e64fc5fa9

Analysis

max time kernel
149s
max time network
142s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/05/2026, 13:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-03_0cc87339126a89e826e1cda4eafc4aab_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Size 128KB
Sample260503-qdr79shy7x
SHA256 b13050e0735cffcaebe1c6778580b2bfb0d90bdba4a39fa26f33b06e64fc5fa9
MD5 0cc87339126a89e826e1cda4eafc4aab
SHA1 9b0c2f75664ccf2031792142bce3ce001059b068
SHA512 60f1dacd5256875aa2c40d6d821b10b5f8dfede79b742d6ac602c13aba20a3eba27574eadffd4eb81933dc46ca839142c948fc92adebeb5d4e593e95e5452bdd
SSDEEP 1536:CjX0s1IG9k50g0tHgzaZo50Se8ia7kPd4qIP731J+lx+fSQeWcHmlt3aJtjW79Aa:CTfg0txZ27kPdITzqx+ZAmw67qyRkSJ
TLSH
T1E0D3D0063893D072D40101B4046B8EF17B7FADE37ABD951FABBDF10E6EB12684966271
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
1732	1g6ga.exe
1880	1g6ga.exe
4256	wxk0e.exe
3436	wxk0e.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows\CurrentVersion\Run\dz9rkd = "C:\\Users\\Admin\\AppData\\Roaming\\1g6ga.exe"	2026-05-03_0cc87339126a89e826e1cda4eafc4aab_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows\CurrentVersion\Run\vvx1hy = "C:\\Users\\Admin\\AppData\\Roaming\\wxk0e.exe"	1g6ga.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1788 set thread context of 1324	1788	2026-05-03_0cc87339126a89e826e1cda4eafc4aab_amadey_elex_rhadamanthys_smoke-loader_stop.exe	80
PID 1732 set thread context of 1880	1732	1g6ga.exe	85
PID 4256 set thread context of 3436	4256	wxk0e.exe	89

Program crash 3 IoCs

pid	pid_target	Process	procid_target
3008	1732	WerFault.exe	82
2832	1788	WerFault.exe	79
3532	4256	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1g6ga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wxk0e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wxk0e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-03_0cc87339126a89e826e1cda4eafc4aab_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-03_0cc87339126a89e826e1cda4eafc4aab_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1g6ga.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 1324	1788	2026-05-03_0cc87339126a89e826e1cda4eafc4aab_amadey_elex_rhadamanthys_smoke-loader_stop.exe	80
PID 1788 wrote to memory of 1324	1788	2026-05-03_0cc87339126a89e826e1cda4eafc4aab_amadey_elex_rhadamanthys_smoke-loader_stop.exe	80
PID 1324 wrote to memory of 1732	1324	2026-05-03_0cc87339126a89e826e1cda4eafc4aab_amadey_elex_rhadamanthys_smoke-loader_stop.exe	82
PID 1732 wrote to memory of 1880	1732	1g6ga.exe	85
PID 1732 wrote to memory of 1880	1732	1g6ga.exe	85
PID 1880 wrote to memory of 4256	1880	1g6ga.exe	87
PID 4256 wrote to memory of 3436	4256	wxk0e.exe	89
PID 4256 wrote to memory of 3436	4256	wxk0e.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-05-03_0cc87339126a89e826e1cda4eafc4aab_amadey_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-03_0cc87339126a89e826e1cda4eafc4aab_amadey_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Users\Admin\AppData\Local\Temp\2026-05-03_0cc87339126a89e826e1cda4eafc4aab_amadey_elex_rhadamanthys_smoke-loader_stop.exe
  C:\Users\Admin\AppData\Local\Temp\2026-05-03_0cc87339126a89e826e1cda4eafc4aab_amadey_elex_rhadamanthys_smoke-loader_stop.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1324
- - C:\Users\Admin\AppData\Roaming\1g6ga.exe
    C:\Users\Admin\AppData\Roaming\1g6ga.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1732
  - - C:\Users\Admin\AppData\Roaming\1g6ga.exe
      C:\Users\Admin\AppData\Roaming\1g6ga.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1880
    - - C:\Users\Admin\AppData\Roaming\wxk0e.exe
        
        C:\Users\Admin\AppData\Roaming\wxk0e.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4256
      - C:\Users\Admin\AppData\Roaming\wxk0e.exe
        
        C:\Users\Admin\AppData\Roaming\wxk0e.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3436
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4256 -s 372
        6⤵
        Program crash
        
        PID:3532
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 372
      4⤵
      Program crash
      PID:3008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 372
  2⤵
  - Program crash
  PID:2832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1788 -ip 1788
1⤵
PID:4380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1732 -ip 1732
1⤵
PID:3756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4256 -ip 4256
1⤵
PID:3956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1g6ga.exe

Path C:\Users\Admin\AppData\Roaming\1g6ga.exe
Size 128KB
SHA256 2ca1fac0087876aa671a04668d1c9c748ed36a814b4f8d84b47c5011781ff54a
MD5 8ac3c5219b734cab394da3609e28a3ec
SHA1 51c4643f79dea958d48175b1d0d52a32a5186d61
SHA512 bc41625a485dce9b829df3760130809c1b45f3fb2050ff689f81a0ecd47a40eb65393a976bdbdb60201501da211e40fb15cfbf0302806c2b4a0eaebcf2be5647
SSDEEP 1536:IjX0s1IG9k50g0tHgzaZo50Se8ia7kPd4qIP731J+lx+fSQeWcHmlt3aJtjW79Aa:ITfg0txZ27kPdITzqx+ZAmw67qyRkSJ
TLSH
T1DAD3D0063893D072D40101B4046B8EF17B7FADE37ABD951FABBDF10E6EB12684966271
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wxk0e.exe

Path C:\Users\Admin\AppData\Roaming\wxk0e.exe
Size 128KB
SHA256 4c407c5920c91de656c258b9751ce2082832f276f7e07468f399ac9a4bbf29bb
MD5 d99540d90aee6eb3c0730f1a5fc18221
SHA1 5765bdc0475ebb1f4b4b87c0ae8a4432e4f52dcb
SHA512 ee5c6f1caf15b643223adee98c5c7dd5148d9c54353e6ee68db551b81be5bd91cdbca005b2746f0d1b6df8e0cb84bffd7a0624800d865c6b89c210e58e2e680e
SSDEEP 1536:7jX0s1IG9k50g0tHgzaZo50Se8ia7kPd4qIP731J+lx+fSQeWcHmlt3aJtjW79Aa:7Tfg0txZ27kPdITzqx+ZAmw67qyRkSJ
TLSH
T138D3D0063893D072D40101B4046B8EF17B7FADE37ABD951FABBDF10E6EB12684966271
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1324-0-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1324-2-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1324-4-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1324-23-0x0000000000AF0000-0x0000000000BAB000-memory.dmp

Download

memory/1324-1-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1880-25-0x00000000009A0000-0x0000000000A5B000-memory.dmp

Download

memory/1880-11-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1880-13-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1880-10-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3436-27-0x0000000000860000-0x000000000091B000-memory.dmp

Download

memory/3436-41-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3436-21-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3436-29-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3436-28-0x0000000002C00000-0x0000000002C07000-memory.dmp

Download

memory/3436-20-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3436-34-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3436-19-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3436-42-0x0000000000860000-0x000000000091B000-memory.dmp

Download

memory/3436-48-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3436-55-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3436-64-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3436-65-0x0000000000860000-0x000000000091B000-memory.dmp

Download

memory/3436-67-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3436-70-0x0000000000400000-0x0000000000429000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads