32f0a317a56abe78cc711ffe9d97b1a00bdc6158cc88a924fad0d680ad6970c8

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/07/2026, 03:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_a4f4bf57154f442ba39ab83d00156775_amadey_elex_karagany_rhadamanthys_smoke-loader.exe
Size 5.5MB
Sample260701-d2hmhsfv2w
SHA256 32f0a317a56abe78cc711ffe9d97b1a00bdc6158cc88a924fad0d680ad6970c8
MD5 a4f4bf57154f442ba39ab83d00156775
SHA1 c4d1b1d8e06d848e9f7e074b6195c5f384788acb
SHA512 449f39f1abf1413deadc7f6ac4a417a23adc7a321465537d1e203879a2ccdbadd36d95592e27333d7ff654d9aef109cfa13844d720446d04dda4fe517f6c91a9
SSDEEP 98304:m+S99Zp6+Wvl3D1tBpzOUV3m+hVGiqhx0RHbNvR5D1toKOQ5MpIcRnVKN1f:m+SVLclppiUFm+X1v7lD1tZOBFVK3f
TLSH
T16C46339EB0E08C25DC5A56B0D73E43E341ED6D68872AD8BEE8B484D12FC51A1BF78570
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2800	8400.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_a4f4bf57154f442ba39ab83d00156775_amadey_elex_karagany_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8400.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 2800	4588	2026-06-30_a4f4bf57154f442ba39ab83d00156775_amadey_elex_karagany_rhadamanthys_smoke-loader.exe	82

C:\Users\Admin\AppData\Local\Temp\2026-06-30_a4f4bf57154f442ba39ab83d00156775_amadey_elex_karagany_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_a4f4bf57154f442ba39ab83d00156775_amadey_elex_karagany_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Users\Admin\AppData\Local\Temp\8400.tmp
  "C:\Users\Admin\AppData\Local\Temp\8400.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8400.tmp

Path C:\Users\Admin\AppData\Local\Temp\8400.tmp
Size 5.5MB
SHA256 a93d6fb9b73cbbdd0a7f6a68293e3dd705f67ff7d19a80948f5b00f30569bc7f
MD5 3a6dc39cc808d7d052c6badf73ae3665
SHA1 a1e745cf560a6c95515fc8cc96237e2bf1f70182
SHA512 aca38e0c4c1b55d413948666f32378ee781f7f3a01452aa7e4f1c0048a267a452167252155451d40180e0291754b076519f36ae3138880378eb7d3948dfb34aa
SSDEEP 98304:0Ug1BodeZp6+Wvl3D1tBpzOUV3m+hVGiqhx0RHbNvR5D1toKOQ5MpIcRnVKN1f:5+KILclppiUFm+X1v7lD1tZOBFVK3f
TLSH
T1834633AAB0D08C25DCA65BB0E73A03F350ED9D64471ACC2EE4E848D62FD15A1AF3C575
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download