e39eaed828bfa8c44b04f240a36655e90c6b859b4ae07df0b4d8bdcd6d08caa2

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/05/2026, 02:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-23_555be7810b6e9a50b797b74b8c398727_amadey_elex_karagany_rhadamanthys_smoke-loader.exe
Size 5.5MB
Sample260523-cys4eady3v
SHA256 e39eaed828bfa8c44b04f240a36655e90c6b859b4ae07df0b4d8bdcd6d08caa2
MD5 555be7810b6e9a50b797b74b8c398727
SHA1 d8316d8a93a0756b3ef0b098592452ef7287be5f
SHA512 33a303df0262a725b56f9606fa8dc2051257fe045e3b91b0b3985c19aec8a63f6618d60b7c4413b9f17a2657687bc04321f2cd1fd33b8518ad66f85773e95d7d
SSDEEP 98304:mqM3UDZp6+Wvl3D1tBpzOUV3m+hVGiqhx0RHbNvR5D1toKOQ5MpIcRnVKN1f:mP3UlLclppiUFm+X1v7lD1tZOBFVK3f
TLSH
T1FE4633ADB0D04C25DC5A5AB0D33A43F341ED5D244B2EC86AE8E889E42FD15A0BF7C5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
736	F08A.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-23_555be7810b6e9a50b797b74b8c398727_amadey_elex_karagany_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F08A.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 736	2424	2026-05-23_555be7810b6e9a50b797b74b8c398727_amadey_elex_karagany_rhadamanthys_smoke-loader.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-05-23_555be7810b6e9a50b797b74b8c398727_amadey_elex_karagany_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-23_555be7810b6e9a50b797b74b8c398727_amadey_elex_karagany_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Users\Admin\AppData\Local\Temp\F08A.tmp
  "C:\Users\Admin\AppData\Local\Temp\F08A.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F08A.tmp

Path C:\Users\Admin\AppData\Local\Temp\F08A.tmp
Size 5.5MB
SHA256 e2f783433fa8f5dfd394dc0d1ff409532775c9babd2e303f27903ed51a91c69d
MD5 883960ffc8eae2202c29f49bfef37541
SHA1 c8101833f989abd66fde9efb1c68c6ce4b0b9dc2
SHA512 3ed43fab685ef49befaee484880350aea7f4fa85ffa2055484cb3df9ed8968921dec20e63d852bd2aaa1a1d66c475f8a519ddd1cf2e9955c11f4aaaa1a843e90
SSDEEP 98304:ygiL8zKMZp6+Wvl3D1tBpzOUV3m+hVGiqhx0RHbNvR5D1toKOQ5MpIcRnVKN1f:KgeaLclppiUFm+X1v7lD1tZOBFVK3f
TLSH
T1404633AE70E08C30DC5A5AB0D77D43E354F95D604B2AD9BAE0A488E52FC11B2BF78574
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download