47fb5fa20cc46a658a330cd2deb9ef8d5b4b287fd6877776d12ef60943746d25

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/05/2026, 02:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-16_ad63cf4845b56e9fa5cbd71316e42008_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Size 527KB
Sample260516-c8dfpsat5w
SHA256 47fb5fa20cc46a658a330cd2deb9ef8d5b4b287fd6877776d12ef60943746d25
MD5 ad63cf4845b56e9fa5cbd71316e42008
SHA1 bc0284e25dd4b749f3962869298ed4ee21093d78
SHA512 a2f01a466b692f17185e97891c84b8345082c7ef8cdf622eeb2b96859824b86d3592f928e5fc83431fa00c5025c43a1493f5f847e48f03d1af5ea8e74287dc80
SSDEEP 3072:jZtmGAsvMtgdEar1X8jI+ll3RLsQ7WCeEgEVLBHpgA5FrKEvm:dtmGrSIE8X8c+LRLsmTgEVL3rpv
TLSH
T188B4382162408035E3A907704557E6F44A796E3A53A4A5CFF3B87E356E712E36B3328F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1468	2476	WerFault.exe	79

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-16_ad63cf4845b56e9fa5cbd71316e42008_amadey_elex_rhadamanthys_smoke-loader_stop.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-16_ad63cf4845b56e9fa5cbd71316e42008_amadey_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-16_ad63cf4845b56e9fa5cbd71316e42008_amadey_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2476
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2476 -s 228
  2⤵
  - Program crash
  PID:1468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2476 -ip 2476
1⤵
PID:3452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2476-0-0x0000000000640000-0x00000000006C8000-memory.dmp

Download