18162a082053ac548e47a976d220750ba98f8ab9443d8a478daa05f22850d677

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 00:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_fdbb04f9cba157a2ca4adee02c43da20_amadey_elex_karagany_rhadamanthys_smoke-loader.exe
Size 5.5MB
Sample260629-bbcbpsaz5l
SHA256 18162a082053ac548e47a976d220750ba98f8ab9443d8a478daa05f22850d677
MD5 fdbb04f9cba157a2ca4adee02c43da20
SHA1 e6edd8857fe5178bac913067c682f45fba79cdb3
SHA512 d21a2036f02b36c4a283a7a385644f87d3d65b9e6cfadf505e35036fc3c0ac84ca0bf5a38c26cf6b8a3ac5035c4f4fe5edc635538fd06b8255758c70533b999f
SSDEEP 98304:A+oMFvzZp6+Wvl3D1tBpzOUV3m+hVGiqhx0RHbNvR5D1toKOQ5MpIcRnVKN1f:AuLclppiUFm+X1v7lD1tZOBFVK3f
TLSH
T1EF4633EA70E08825D85A5AB0DB7A03B350ED5D60871DED7AD8E888C52FC11F1AF7C974
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
6860	602C.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_fdbb04f9cba157a2ca4adee02c43da20_amadey_elex_karagany_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	602C.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5156 wrote to memory of 6860	5156	2026-06-27_fdbb04f9cba157a2ca4adee02c43da20_amadey_elex_karagany_rhadamanthys_smoke-loader.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-06-27_fdbb04f9cba157a2ca4adee02c43da20_amadey_elex_karagany_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_fdbb04f9cba157a2ca4adee02c43da20_amadey_elex_karagany_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5156
- C:\Users\Admin\AppData\Local\Temp\602C.tmp
  "C:\Users\Admin\AppData\Local\Temp\602C.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

602C.tmp

Path C:\Users\Admin\AppData\Local\Temp\602C.tmp
Size 5.5MB
SHA256 c94a5f71909440f60bb00e8cce683b239dfc693381e5aeb14e4517b51aa99502
MD5 0c05f890348fc051df7e63b9c9fefa30
SHA1 c3dd2667fc028173473ad1a8e368f143902e0be0
SHA512 b3777d1f6269078d9f91aad67c6f03e8e9212f9126f9c98c5a0402772254a89b3924b24a4dc226eaad1d5e04934c60040308c60995dc51ad8b679388ec97c925
SSDEEP 98304:yVkJZZp6+Wvl3D1tBpzOUV3m+hVGiqhx0RHbNvR5D1toKOQ5MpIcRnVKN1f:00LclppiUFm+X1v7lD1tZOBFVK3f
TLSH
T1AF4633A9B0D08C25DCA65AB0D73E43E390E99D284B1ADD7DE4E844D13FC11A2BF785B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download