de1678ee85558102f206d5ac94c42505de53e247b90834e72859434f7cf94fe4

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 03:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_b72ee63b2cb05716a2d8cbd11c69d13e_amadey_elex_karagany_rhadamanthys_smoke-loader.exe
Size 5.5MB
Sample260629-d526bsdv6j
SHA256 de1678ee85558102f206d5ac94c42505de53e247b90834e72859434f7cf94fe4
MD5 b72ee63b2cb05716a2d8cbd11c69d13e
SHA1 7e7a269c9f20a440ff9246119c8aa135eb68ded0
SHA512 e84be0e0e3ffffc15f5e91c23bf466511f708eff4c06d42371201b9e9a2e6081798ed64cd671285be1e0629ca4ad96aa862c67ea72ed38e66cd74e539610d897
SSDEEP 98304:BkZaIZp6+Wvl3D1tBpzOUV3m+hVGiqhx0RHbNvR5D1toKOQ5MpIcRnVKN1f:BSLclppiUFm+X1v7lD1tZOBFVK3f
TLSH
T16E4633AAB0E04C35CC5A2AF1C73E43F391ED59508B2ED96AD4E488D42FD01A1BF78675
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
6904	7DA7.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_b72ee63b2cb05716a2d8cbd11c69d13e_amadey_elex_karagany_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7DA7.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5976 wrote to memory of 6904	5976	2026-06-27_b72ee63b2cb05716a2d8cbd11c69d13e_amadey_elex_karagany_rhadamanthys_smoke-loader.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-06-27_b72ee63b2cb05716a2d8cbd11c69d13e_amadey_elex_karagany_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_b72ee63b2cb05716a2d8cbd11c69d13e_amadey_elex_karagany_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5976
- C:\Users\Admin\AppData\Local\Temp\7DA7.tmp
  "C:\Users\Admin\AppData\Local\Temp\7DA7.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7DA7.tmp

Path C:\Users\Admin\AppData\Local\Temp\7DA7.tmp
Size 5.5MB
SHA256 bf75353037e4a98ed4120c04f2b23f790a0aa68a89cab0081299bc062b296d31
MD5 59acec2914c9350648c567ab762355c4
SHA1 da74ef3a8943a78aaffb6cad6d8657cef1047daa
SHA512 dd4d61c4016b4b62247a4bc07534aca8ba0c36d88e62736bbd3f6ec11c82bff81055e18ff1f3b36aa062c3ba71b76e10ed9d24b45b74de61c831aebc6c7727dd
SSDEEP 98304:mZB5Zp6+Wvl3D1tBpzOUV3m+hVGiqhx0RHbNvR5D1toKOQ5MpIcRnVKN1f:4LclppiUFm+X1v7lD1tZOBFVK3f
TLSH
T13B46339EB0D04C24D8691FB0D73E03F351EE5D248B1AD97AE4A888D52FC15B1AF786B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download