7e48737813037b336ef0b3acbf5a86a073fd7b6bf6e3ca54a63b18e292dc7054

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 17:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_f41cedd19af2ebd3f536e3688ac30aad_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Size 149KB
Sample260628-wj2lsaa18j
SHA256 7e48737813037b336ef0b3acbf5a86a073fd7b6bf6e3ca54a63b18e292dc7054
MD5 f41cedd19af2ebd3f536e3688ac30aad
SHA1 f9b5059fa5fa36d384fa1e98214e7f3392ed34b0
SHA512 36eb2f1a97a4e29a3b61df85ae810cb0691b1d71e99b204e755d4d8501534f1dd3683b0ee63be83a6905119afd44e5f28108c3b4663a9bc95022d6cc33532ccb
SSDEEP 3072:vbuMGq4hOSOVOjsvRyp4fo4VYESePOmg+sMCkeoKFaORrzE9hJ:TGq4sHVy2dhJSePOmgtt1DFHRs3J
TLSH
T156E3D0207AA18832D16236705D79D2B2D76B75611BB840CBB7D81FBE5E706C29E3C31E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
6660	obbcr.exe
1828	2026-06-28_f41cedd19af2ebd3f536e3688ac30aad_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
4256	2026-06-28_f41cedd19af2ebd3f536e3688ac30aad_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1828 set thread context of 4256	1828	2026-06-28_f41cedd19af2ebd3f536e3688ac30aad_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	92

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_f41cedd19af2ebd3f536e3688ac30aad_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_f41cedd19af2ebd3f536e3688ac30aad_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	obbcr.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6312 wrote to memory of 6660	6312	2026-06-28_f41cedd19af2ebd3f536e3688ac30aad_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	90
PID 6660 wrote to memory of 1828	6660	obbcr.exe	91
PID 1828 wrote to memory of 4256	1828	2026-06-28_f41cedd19af2ebd3f536e3688ac30aad_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	92
PID 1828 wrote to memory of 4256	1828	2026-06-28_f41cedd19af2ebd3f536e3688ac30aad_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	92
PID 1828 wrote to memory of 4256	1828	2026-06-28_f41cedd19af2ebd3f536e3688ac30aad_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	92
PID 1828 wrote to memory of 4256	1828	2026-06-28_f41cedd19af2ebd3f536e3688ac30aad_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	92
PID 1828 wrote to memory of 4256	1828	2026-06-28_f41cedd19af2ebd3f536e3688ac30aad_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-06-28_f41cedd19af2ebd3f536e3688ac30aad_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_f41cedd19af2ebd3f536e3688ac30aad_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6312
- C:\Users\Admin\AppData\Local\Temp\obbcr.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-06-28_f41cedd19af2ebd3f536e3688ac30aad_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe" jXaqcE9P
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6660
- - C:\Users\Admin\AppData\Local\Temp\2026-06-28_f41cedd19af2ebd3f536e3688ac30aad_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\obbcr.exe" ik6Q48t2
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1828
  - - C:\Users\Admin\AppData\Local\Temp\2026-06-28_f41cedd19af2ebd3f536e3688ac30aad_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
      cO6n6ptN
      4⤵
      Executes dropped EXE
      PID:4256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

obbcr.exe

Path C:\Users\Admin\AppData\Local\Temp\obbcr.exe
Size 149KB
SHA256 7306551c2e9bca10ceb37713bc5b49f91b155e7bf83598d6338bea41af9a4d8a
MD5 de3bab33a0fc9514b818c24d1403c4bd
SHA1 46b8cfa88f5db50247b3ae959b8c6afbe22e5670
SHA512 00c891dca1550a8763e4a2602cbbccf03823e293fcfbb4145785d731b3e40fcd82828f074d0efeec785474a7f6647128f0022166d5739370a7e1851e7fe37c30
SSDEEP 3072:vbuMGq4hOSOVTjsvqO8ufxFJOvrWda8VlUBaodWD:TGq4sHVH1OjfEv9Ba9
TLSH
T104E3E0267A50D472D11226705DB8E2B2A26AB56117B801CBB79C0FFE9F707D18E3436F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4256-40-0x0000000000400000-0x000000000049D000-memory.dmp

Download