2976417d6daa2651355eeb8a6aa17438b9db07e1065a2d010cc1a5502a52e8d6

Analysis

max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 06:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_2023cce6de6107dc8696d2479fc76120_elex_rhadamanthys_smoke-loader.exe
Size 687KB
Sample260701-gt4fsshv4y
SHA256 2976417d6daa2651355eeb8a6aa17438b9db07e1065a2d010cc1a5502a52e8d6
MD5 2023cce6de6107dc8696d2479fc76120
SHA1 d3fe9426af68db8632a2fdfa3f18fe06d8dfedc6
SHA512 917ece06b3004266e373589eff05fb9b9381b22265b118411ec159d7a71335514e1a58bb11a3d0679b14a207c8af1f951de874bafc364fd0dfbee0c9a0d029b0
SSDEEP 12288:3kIS6tX9rKNvOSxTmVu0h2d43EFev7+0N1R9Dgec:3rX9eNmV/hsYvaKR97c
TLSH
T145E4E01035D1C070E6A7063256AADE66487EFD724FA09ECBB7C82A1D5E707D1A730B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
812	BDAE.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_2023cce6de6107dc8696d2479fc76120_elex_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BDAE.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
812	BDAE.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 812	1860	2026-06-30_2023cce6de6107dc8696d2479fc76120_elex_rhadamanthys_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-06-30_2023cce6de6107dc8696d2479fc76120_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_2023cce6de6107dc8696d2479fc76120_elex_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Users\Admin\AppData\Local\Temp\BDAE.tmp
  "C:\Users\Admin\AppData\Local\Temp\BDAE.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-06-30_2023cce6de6107dc8696d2479fc76120_elex_rhadamanthys_smoke-loader.exe 49EEB43BFE358A4A3ABBF04BB77E0034E5030540B68F484767C00F981C24D202473EE9786713E05B59BF19F3334175F154FC7FBA5CC16C2E71474C90B3F475DE
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BDAE.tmp

Path C:\Users\Admin\AppData\Local\Temp\BDAE.tmp
Size 687KB
SHA256 f233a7e770d25601b55df369933cd629499cabe9587a949dbbe32cc03fd6c9ee
MD5 f562ac3f67470fc042f2e5439a4381d0
SHA1 e1417ea5ab958e273ac1906891c154eece295af4
SHA512 14c9af70d6f41439d724e565242968723a8879756f0e3d6728bd89360cfdb8562047801ff37c16523bd45555a3349a77883128137ebdeb89327c56fe7c0676ef
SSDEEP 12288:3kIS6tXJNtLOV6ERMWFev7+0N1R9Dgec:3rXJfm6ETYvaKR97c
TLSH
T1A5E4E02076C1C430E6A6463246AADF6258BEFD764F609ECB77C42A1D5E703D1A730B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/812-6-0x0000000000FA0000-0x000000000104C000-memory.dmp

Download

memory/1860-4-0x0000000000E00000-0x0000000000EAC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads