dd43b169c48605c83a3e8fa2f68efec33b7ccbac40a85b166e46ebea96816295

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 22:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_636168ffd33d73613b50985b74d69942_amadey_elex_loda_rhadamanthys_smoke-loader.exe
Size 2.0MB
Sample260628-1279hae17x
SHA256 dd43b169c48605c83a3e8fa2f68efec33b7ccbac40a85b166e46ebea96816295
MD5 636168ffd33d73613b50985b74d69942
SHA1 ac440540bf1a8d9a3a26e1fc230e8d1757f967a4
SHA512 6fd9d287bec24d4f4413af96a6ed64414fe38e8c484144905d4fa6f19346c30dc2a6c108fc49625bd6de0aad560539dcf01cb36d7342697465d2aba96f72624e
SSDEEP 49152:gtrGEQDdEqHqLd8SQMeVU1B9TT/wjDZk7Xe:+aEAdEqHYprKU1B9vwxk7X
TLSH
T1C795E091F245A8E9E80325B55C7DCA2214077E7D06B9564E36CE772A89B338231B7E0F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1340	EF3D.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_636168ffd33d73613b50985b74d69942_amadey_elex_loda_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EF3D.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1340	EF3D.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 1340	2680	2026-06-28_636168ffd33d73613b50985b74d69942_amadey_elex_loda_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-06-28_636168ffd33d73613b50985b74d69942_amadey_elex_loda_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_636168ffd33d73613b50985b74d69942_amadey_elex_loda_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Users\Admin\AppData\Local\Temp\EF3D.tmp
  "C:\Users\Admin\AppData\Local\Temp\EF3D.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-06-28_636168ffd33d73613b50985b74d69942_amadey_elex_loda_rhadamanthys_smoke-loader.exe B29105733B661BB41FF4A2C72432AF7B01F560225A226166BA1587DAA6D2A9AB0D4E8E80521B7E5BEAE550436FCF52089A4FC961366EBB368478679194ABF96C
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EF3D.tmp

Path C:\Users\Admin\AppData\Local\Temp\EF3D.tmp
Size 2.0MB
SHA256 f78c68c14bb381f3c3c7c6d16b257198260608d6422e7385a2360adee2718047
MD5 f44c87f187a997599bb9b966a57a5218
SHA1 3b2eb754c1358be77d999a6a278ad897c589545d
SHA512 536cea8e8c458df019ed0fbfd14d8b1ab034beae97b685d51c6d9956268302ac3328a4293b1c02b4533c6fe1aa17ba6d7f41a34bca5023d6e1b1f73d7608e251
SSDEEP 49152:gtrGEQDdEqHL74zcXiV+espB9lE9dCgrWLiQe:+aEAdEqHLsEiVtUE1WLiQ
TLSH
T1B795E192F245A9E9E80321B59C3DCA2214177E7D06B9554E36CF772999B338230B7E0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads