a9e2cfd6bcdf7144d59f2349eaf167490b93dddbe9665a65529bc9b107c4b2fa

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 00:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_06baebd103571b581f209afe88d85a2c_amadey_elex_rhadamanthys_smoke-loader.exe
Size 69KB
Sample260711-ab7beags2k
SHA256 a9e2cfd6bcdf7144d59f2349eaf167490b93dddbe9665a65529bc9b107c4b2fa
MD5 06baebd103571b581f209afe88d85a2c
SHA1 f020452eca1c3f8557cdd4397be32e9936ab915a
SHA512 647905360a6a8a2a0b0edff493ce3942b8d85848b63eb3610fbb5e08212862400110609184995a0a31ab5d01b2e214590e46cecbd3ddc412dd74791a8f3bf721
SSDEEP 1536:FjHZ2rfOTrOUkrhe9drWVoLmcYXV/O16nvaHW+:XOOT39drW6LmcYXVlnvkr
TLSH
T126636B13B3D0C8B6F473527408B9D6215A5BBC15A2F4818F378C666E6EB23814DFA317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4960	antifahib.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	icanhazip.com

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_06baebd103571b581f209afe88d85a2c_amadey_elex_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	antifahib.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 4960	3056	2026-07-10_06baebd103571b581f209afe88d85a2c_amadey_elex_rhadamanthys_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-10_06baebd103571b581f209afe88d85a2c_amadey_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_06baebd103571b581f209afe88d85a2c_amadey_elex_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Users\Admin\AppData\Local\Temp\antifahib.exe
  C:\Users\Admin\AppData\Local\Temp\antifahib.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

antifahib.exe

Path C:\Users\Admin\AppData\Local\Temp\antifahib.exe
Size 69KB
SHA256 0e63a3bdee001d60d9632b63db9cec05c9f2839000be2aaf9e35073a80ea028e
MD5 bf858fb4ce0bf1af6ae452ded21c863f
SHA1 64fd90dc1ec3e5d64be3ea7d6e0a67ea8f1ffff4
SHA512 aba68823a3386e19936a1d1563454e9d1879620a6b843f2ef81fe031c90cab7620e27fb92681b77d97dddbf42aa147b144fe2d57fb61c17397a3998f99bba4ec
SSDEEP 1536:FjHZ2rfOTrOUkrhe9drWVoLmcYXV/O16nvaHWI:XOOT39drW6LmcYXVlnvkB
TLSH
T1C1636B13B3D0C8B6F073527408B9D6215A5BBC15A2F4918F378C666E6EB23824DFA317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download