32f0a317a56abe78cc711ffe9d97b1a00bdc6158cc88a924fad0d680ad6970c8

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 03:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_a4f4bf57154f442ba39ab83d00156775_amadey_elex_karagany_rhadamanthys_smoke-loader.exe
Size 5.5MB
Sample260701-d2hmhsfv2w
SHA256 32f0a317a56abe78cc711ffe9d97b1a00bdc6158cc88a924fad0d680ad6970c8
MD5 a4f4bf57154f442ba39ab83d00156775
SHA1 c4d1b1d8e06d848e9f7e074b6195c5f384788acb
SHA512 449f39f1abf1413deadc7f6ac4a417a23adc7a321465537d1e203879a2ccdbadd36d95592e27333d7ff654d9aef109cfa13844d720446d04dda4fe517f6c91a9
SSDEEP 98304:m+S99Zp6+Wvl3D1tBpzOUV3m+hVGiqhx0RHbNvR5D1toKOQ5MpIcRnVKN1f:m+SVLclppiUFm+X1v7lD1tZOBFVK3f
TLSH
T16C46339EB0E08C25DC5A56B0D73E43E341ED6D68872AD8BEE8B484D12FC51A1BF78570
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
6120	6CCE.tmp

Executes dropped EXE 1 IoCs

pid	Process
6120	6CCE.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_a4f4bf57154f442ba39ab83d00156775_amadey_elex_karagany_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6CCE.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 6120	3116	2026-06-30_a4f4bf57154f442ba39ab83d00156775_amadey_elex_karagany_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-06-30_a4f4bf57154f442ba39ab83d00156775_amadey_elex_karagany_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_a4f4bf57154f442ba39ab83d00156775_amadey_elex_karagany_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Users\Admin\AppData\Local\Temp\6CCE.tmp
  "C:\Users\Admin\AppData\Local\Temp\6CCE.tmp"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6CCE.tmp

Path C:\Users\Admin\AppData\Local\Temp\6CCE.tmp
Size 5.5MB
SHA256 854f74c4475c33c6e9216ee812880e4159d75659c3bf2f779f0b3495cf87ad17
MD5 0dcac350dd58f3feb68dec647de1a00a
SHA1 61f49836613d00e7472f09b43a6f5697909abb64
SHA512 fa69f6d1bb0c8afa4bf52ffc62b06f46db27a08b197c97b1f056b0eb3e21e435dce2ac640837db8229d427d93b8cd8050296a1e21210772a4b2e968b574dc203
SSDEEP 98304:3WVTlZp6+Wvl3D1tBpzOUV3m+hVGiqhx0RHbNvR5D1toKOQ5MpIcRnVKN1f:3WdTLclppiUFm+X1v7lD1tZOBFVK3f
TLSH
T16146339E70D04C31DC5A6AB0D73A03F795ED8D64472AD83EE8E888E16FC01A1AF78575
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download