ab728b6f2d1c580dd824f6a64e40e233c424df527fb84364531a7cba277d095e

Analysis

max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 16:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_fec61e3395e633be2ad370a95339f159_elex_rhadamanthys_smoke-loader.exe
Size 687KB
Sample260702-tfshlahs8w
SHA256 ab728b6f2d1c580dd824f6a64e40e233c424df527fb84364531a7cba277d095e
MD5 fec61e3395e633be2ad370a95339f159
SHA1 5b03293c4b4ef5d96162374d15d2d67d21970c56
SHA512 12661f56f27f6dc5fdebc04bd40cf86b2d8d6ec1847997343b4c6d83560c2c82305946cfcde60a574b74a13661c6508669a522270c153cd3fd3ebfad13f97110
SSDEEP 12288:3kIS6tXLPMHYggXErdZyycMFev7+0N1R9Dgec:3rXYHYggXEpDcMYvaKR97c
TLSH
T129E4E01436C1C030E5E606355AAADE6254BEFD724FA49ECBB7C86A1D1E702D1A730B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2692	1AA2.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_fec61e3395e633be2ad370a95339f159_elex_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1AA2.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2692	1AA2.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3984 wrote to memory of 2692	3984	2026-07-02_fec61e3395e633be2ad370a95339f159_elex_rhadamanthys_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-02_fec61e3395e633be2ad370a95339f159_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_fec61e3395e633be2ad370a95339f159_elex_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3984
- C:\Users\Admin\AppData\Local\Temp\1AA2.tmp
  "C:\Users\Admin\AppData\Local\Temp\1AA2.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-02_fec61e3395e633be2ad370a95339f159_elex_rhadamanthys_smoke-loader.exe AEE78D731FA7428EA803C5AB65AE06AA0FE8416F6A332459CA60D130C47DD6064DB93991F109FFCB0A48A300F4CFBC0E1C1B901DB19C4FD55F4664075372DDF9
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1AA2.tmp

Path C:\Users\Admin\AppData\Local\Temp\1AA2.tmp
Size 687KB
SHA256 d5e48f6ce565f0bf43f61ceb016ce53435c62c21bd0b61154db376bf7cf2b2c1
MD5 e256a96ddc7a34a08e6d8c803ec54e3b
SHA1 a37e4d547f3ac91405d75d17b74a15f9dcbfbb38
SHA512 10a2df71c8f5fcf7f951137044752651d3e2071bfc3eaf7bd7e9f783d8e71cb6f89a9c52470c0e92b882a19534e8b39b1b3618b0c2db877cc856b6e47d4ba0e1
SSDEEP 12288:3kIS6tX5Gzc6DJ+ohnhlAW8Fev7+0N1R9Dgec:3rXEJ+ohiW8YvaKR97c
TLSH
T16FE4E02176C1C430E5A7063256AAEE63547EFD324F60AECBB7C42A1D1A702D1A735B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2692-6-0x0000000000C20000-0x0000000000CCC000-memory.dmp

Download

memory/3984-4-0x0000000000C50000-0x0000000000CFC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads