dcb571b151ce681c8c0ea6dc1b636aeb668c4ae9e6ddbb08bb771e73574610b8

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 02:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_c8bef83091b9c337164f7a77e3fb7537_amadey_elex_loda_rhadamanthys_smoke-loader.exe
Size 2.3MB
Sample260701-dbtl4ac13q
SHA256 dcb571b151ce681c8c0ea6dc1b636aeb668c4ae9e6ddbb08bb771e73574610b8
MD5 c8bef83091b9c337164f7a77e3fb7537
SHA1 e74ae78e9da41843656f4a389320556c5b338192
SHA512 8836872fadbf5abd8945903a58fdde0d2a6540496732ea710d1878eb07ea8b5774682d9e7d7b295ad621afbd124f0098bd45663424da507e0db12da0b47d5769
SSDEEP 49152:BtrqOMudxX6Z6gP4Tcx6OON/2ben4Y16O1z5ypNRfIKhG:DWOBdxX6AnZ/2bc163pNtIs
TLSH
T135B5AF92F245ACE9E80325B59C7DCE2124077E7D4AB9560E358F762995B338230B7E0F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
6032	83A2.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_c8bef83091b9c337164f7a77e3fb7537_amadey_elex_loda_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	83A2.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
6032	83A2.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5740 wrote to memory of 6032	5740	2026-06-30_c8bef83091b9c337164f7a77e3fb7537_amadey_elex_loda_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-06-30_c8bef83091b9c337164f7a77e3fb7537_amadey_elex_loda_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_c8bef83091b9c337164f7a77e3fb7537_amadey_elex_loda_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5740
- C:\Users\Admin\AppData\Local\Temp\83A2.tmp
  "C:\Users\Admin\AppData\Local\Temp\83A2.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-06-30_c8bef83091b9c337164f7a77e3fb7537_amadey_elex_loda_rhadamanthys_smoke-loader.exe 41921FFCE0860A645E20D27A21F4E5E40F112A4639F0DF4923BB23138CC2AB36C532447AF68E9F9A729DF76B4130330525E64423C8E60F7D0DF6BF509F019D70
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:6032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

83A2.tmp

Path C:\Users\Admin\AppData\Local\Temp\83A2.tmp
Size 2.3MB
SHA256 c94cba39809b41c88e4dc3f6f2970f2813dcda83a3691dd2c0322d41cd0a0312
MD5 63f2f89715d0c1c789be4dd7bddcdb2e
SHA1 a2aa512bb5c8ee26f9f648606b651a727df3976a
SHA512 4e2287dd039547db4f0b7c7912ec9c3b3b4bf15cf09865a15ea810be53e12f8fe6fc0c6a6fde6466a87d90562af3cf50f91a53b571133ef50a8748ae4058889d
SSDEEP 49152:BtrqOMudxX6dg18gXyzoEbiRNikrhiuvLbajXbZFJ1KhG:DWOBdxX6dg1RO8NLQOiTHJ1s
TLSH
T1EFB5AF92F245ACE9E80325B59C7DCA2124477E7D4AB9560E358F762985B338330B7E0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads