c1ddfc6e7f52d327c2f44e7a0c7aed73b5326681ec2c6a69227367f5362e89ad

Analysis

max time kernel
149s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 15:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-29_90552615e7f1689b8ef9bda9f62bb51b_amadey_cloudeye_elex_rhadamanthys_smoke-loader_stop.exe
Size 2.1MB
Sample260529-sptxcaew71
SHA256 c1ddfc6e7f52d327c2f44e7a0c7aed73b5326681ec2c6a69227367f5362e89ad
MD5 90552615e7f1689b8ef9bda9f62bb51b
SHA1 9467bdc3637b3591ecdf2069d5498c6a9321e57a
SHA512 2c80b2aa6fed9e531050f0bb195a1b12d01b96749ed46b86502823fccea7cdf8f76ceaa9bc4cd38d1936ee62e7f0a277c74f3e06def4377a3e6978a3a1c68791
SSDEEP 24576:3jQMFHDUT22CLZe0p4Ek4niOkl/A04szE87JKTvmxQDeJ+5jcAkSYqyEkh5QX4F4:UMVsoeW4SkZP4sz9Mb6aeJUpYqg5QX4q
TLSH
T196A52915F6B88372D0B3C079C9D6AB9AFA323C455B308ACB1245B36C2E376D69935335
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-29_90552615e7f1689b8ef9bda9f62bb51b_amadey_cloudeye_elex_rhadamanthys_smoke-loader_stop.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
6036	2026-05-29_90552615e7f1689b8ef9bda9f62bb51b_amadey_cloudeye_elex_rhadamanthys_smoke-loader_stop.exe
6036	2026-05-29_90552615e7f1689b8ef9bda9f62bb51b_amadey_cloudeye_elex_rhadamanthys_smoke-loader_stop.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-29_90552615e7f1689b8ef9bda9f62bb51b_amadey_cloudeye_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-29_90552615e7f1689b8ef9bda9f62bb51b_amadey_cloudeye_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads