28c288b69fdeabfd9f9e571b64b7c88105f596809b2fd74e05430a97e09df0ef

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-26_cb4ec1f0ac13f4447f93376d45ea5e5e_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Size 149KB
Sample260629-pf4teaex5r
SHA256 28c288b69fdeabfd9f9e571b64b7c88105f596809b2fd74e05430a97e09df0ef
MD5 cb4ec1f0ac13f4447f93376d45ea5e5e
SHA1 5dc2df831266a77c69909ce827b5e5afdc081898
SHA512 508ca447cfcaf3fc1c2a8a2cbfa54bea545b67e46ae2a735280075312c2a56ebcf0bd4f8b93f0f14f67b3a18a6f6e7e739ef6fbca3d9355ddaedfde3b3191b31
SSDEEP 3072:vbuMGq4hOSOVaRjsvEo957T/vuyLQFGiOt3+MWE5Q+oUMgD:TGq4sHVAWP//BMFGnXBQ+oM
TLSH
T132E3E026B990C971D46325710DB1C2B3B66B756117B902CBB7982FBE5E70AC04E3836F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
6908	7f167.exe
5752	2026-06-26_cb4ec1f0ac13f4447f93376d45ea5e5e_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
6360	2026-06-26_cb4ec1f0ac13f4447f93376d45ea5e5e_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5752 set thread context of 6360	5752	2026-06-26_cb4ec1f0ac13f4447f93376d45ea5e5e_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	92

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-26_cb4ec1f0ac13f4447f93376d45ea5e5e_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7f167.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-26_cb4ec1f0ac13f4447f93376d45ea5e5e_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6728 wrote to memory of 6908	6728	2026-06-26_cb4ec1f0ac13f4447f93376d45ea5e5e_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	90
PID 6908 wrote to memory of 5752	6908	7f167.exe	91
PID 5752 wrote to memory of 6360	5752	2026-06-26_cb4ec1f0ac13f4447f93376d45ea5e5e_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	92
PID 5752 wrote to memory of 6360	5752	2026-06-26_cb4ec1f0ac13f4447f93376d45ea5e5e_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	92
PID 5752 wrote to memory of 6360	5752	2026-06-26_cb4ec1f0ac13f4447f93376d45ea5e5e_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	92
PID 5752 wrote to memory of 6360	5752	2026-06-26_cb4ec1f0ac13f4447f93376d45ea5e5e_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	92
PID 5752 wrote to memory of 6360	5752	2026-06-26_cb4ec1f0ac13f4447f93376d45ea5e5e_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-06-26_cb4ec1f0ac13f4447f93376d45ea5e5e_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-26_cb4ec1f0ac13f4447f93376d45ea5e5e_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6728
- C:\Users\Admin\AppData\Local\Temp\7f167.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-06-26_cb4ec1f0ac13f4447f93376d45ea5e5e_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe" rXTehZqP
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6908
- - C:\Users\Admin\AppData\Local\Temp\2026-06-26_cb4ec1f0ac13f4447f93376d45ea5e5e_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\7f167.exe" AT6m0FQ1
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5752
  - - C:\Users\Admin\AppData\Local\Temp\2026-06-26_cb4ec1f0ac13f4447f93376d45ea5e5e_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
      bMsY0lgv
      4⤵
      Executes dropped EXE
      PID:6360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7f167.exe

Path C:\Users\Admin\AppData\Local\Temp\7f167.exe
Size 149KB
SHA256 47c93028475c5165e93bc9351f58e42277863420ebe8b0fb4a55bf0e7e65cf47
MD5 b0b3599efe0d663aefde04d080407c8b
SHA1 d950ca1ed4c2075a5c1863043257bb7d70d4b345
SHA512 3c85a4522b320c8f67d1f341a85b1f9bdfbc1849c02efd0d5815e58efbefd3252aeb92af7367274c2d6737f90685b1f7a5a4da84cef35955341fe5ac27602b6f
SSDEEP 3072:vbuMGq4hOSOVOjsvQ3T2PW9miwWQJAgLngJF1r0aM:TGq4sHVyX3UYmiwWhgbgv1r0
TLSH
T19CE3E01279459477E19326708CB29272A62F7471277C52CBB7D81FBE9E603D28E3432B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6360-40-0x0000000000400000-0x000000000049D000-memory.dmp

Download