01a4dd2297340ffd1e095a9a657a7cb6eee2fad565003cd7be7ef462cb71d4c3

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_d9186204da4abe1ab649eb556e142103_elex_rhadamanthys_smoke-loader.exe
Size 687KB
Sample260711-pg6dmaat3n
SHA256 01a4dd2297340ffd1e095a9a657a7cb6eee2fad565003cd7be7ef462cb71d4c3
MD5 d9186204da4abe1ab649eb556e142103
SHA1 0f7ee0f0564fea8ebaeea6566ac06a4da5626793
SHA512 4529038e2d17479245742a50c49a2c5718ffc6e552f8df6161a68325894798c2a18029233a9c083604d3dbba2bbc17ba47c4bc21bf62bce764a7a071a2d07dc8
SSDEEP 12288:3kIS6tX3wlQUqVIOWE2xCCLayFev7+0N1R9Dgec:3rX3mgWXxpLayYvaKR97c
TLSH
T118E4E01036C1C070E5A706354AA6EF6244BEFD724F60AECBB7C86A1D4E746D1A734B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4324	7B7.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-11_d9186204da4abe1ab649eb556e142103_elex_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7B7.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4324	7B7.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3612 wrote to memory of 4324	3612	2026-07-11_d9186204da4abe1ab649eb556e142103_elex_rhadamanthys_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-11_d9186204da4abe1ab649eb556e142103_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_d9186204da4abe1ab649eb556e142103_elex_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3612
- C:\Users\Admin\AppData\Local\Temp\7B7.tmp
  "C:\Users\Admin\AppData\Local\Temp\7B7.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-11_d9186204da4abe1ab649eb556e142103_elex_rhadamanthys_smoke-loader.exe 33BD2E000B924BB6131043A42B2A4077A6A74C8BC6F61A6446FF495E59D3DF985B43750AE900F68DA52469CC8FAA1772B9C05677AF24382F42415C71DD834210
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7B7.tmp

Path C:\Users\Admin\AppData\Local\Temp\7B7.tmp
Size 687KB
SHA256 77bf1d237d66eb80a603052b2bc219cecfd8584b2353d173e30cc853f67371dc
MD5 dcd6dc65834264b07e64356e248745e0
SHA1 0317cce15ff1985f6e3dbe97fecd5a9a3a812225
SHA512 2746582e04ab82447c73fdac954644337a89278b344c6f710725b37dc6458e8259d8d83e07e20004bcb94a25a6931e104acfbda13e0ef7177be28472211e5ea8
SSDEEP 12288:3kIS6tXRGUpewiIlqbEAHbEAOFev7+0N1R9Dgec:3rXEvtI2zHglYvaKR97c
TLSH
T1A6E4E02076C1C470E5A7063646AADE62447EFD364FA09ECBB7C82A5D1E702D1B734B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3612-4-0x0000000000900000-0x00000000009AC000-memory.dmp

Download

memory/4324-6-0x0000000000320000-0x00000000003CC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads