cdf9473ea1a8219e31051f5f18afda45c63cd65d35a144056c9b5a8bb5109914

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_d8ec67f3d20af71700cf4b140737156c_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Size 149KB
Sample260711-pg7axsat3q
SHA256 cdf9473ea1a8219e31051f5f18afda45c63cd65d35a144056c9b5a8bb5109914
MD5 d8ec67f3d20af71700cf4b140737156c
SHA1 7211d7c2e0dee1d66c00f1399d38ea62069f3d76
SHA512 265e2a5a8fee682b1f1997b3ee78aa4f1ffdbb0e3e8e774d774082213c5acf5f5613d9ec8173d14d2c86c2c5d963fe0232ca3d2c191876cfcea728492d6d4358
SSDEEP 3072:vbuMGq4hOSOVOjsvVXw9w6/JaS8FkTQyFYUPGB1npzn4YdG+Z6Ay7r:TGq4sHVyoF6h6FkTfnPkLL45+Z6AyP
TLSH
T1EEE3E0257A909433E1623630587495B3A66FB82517BC41CBBB881FBD5FB02D16F3836B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
5128	yjCro.exe
3036	2026-07-11_d8ec67f3d20af71700cf4b140737156c_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
5836	2026-07-11_d8ec67f3d20af71700cf4b140737156c_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3036 set thread context of 5836	3036	2026-07-11_d8ec67f3d20af71700cf4b140737156c_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	89

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yjCro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-11_d8ec67f3d20af71700cf4b140737156c_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-11_d8ec67f3d20af71700cf4b140737156c_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 5128	624	2026-07-11_d8ec67f3d20af71700cf4b140737156c_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	87
PID 5128 wrote to memory of 3036	5128	yjCro.exe	88
PID 3036 wrote to memory of 5836	3036	2026-07-11_d8ec67f3d20af71700cf4b140737156c_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	89
PID 3036 wrote to memory of 5836	3036	2026-07-11_d8ec67f3d20af71700cf4b140737156c_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	89
PID 3036 wrote to memory of 5836	3036	2026-07-11_d8ec67f3d20af71700cf4b140737156c_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	89
PID 3036 wrote to memory of 5836	3036	2026-07-11_d8ec67f3d20af71700cf4b140737156c_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	89
PID 3036 wrote to memory of 5836	3036	2026-07-11_d8ec67f3d20af71700cf4b140737156c_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-11_d8ec67f3d20af71700cf4b140737156c_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_d8ec67f3d20af71700cf4b140737156c_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:624
- C:\Users\Admin\AppData\Local\Temp\yjCro.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-11_d8ec67f3d20af71700cf4b140737156c_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe" ihHanpR7
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5128
- - C:\Users\Admin\AppData\Local\Temp\2026-07-11_d8ec67f3d20af71700cf4b140737156c_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\yjCro.exe" NUMqIsxy
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3036
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-11_d8ec67f3d20af71700cf4b140737156c_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
      ExIibDxW
      4⤵
      Executes dropped EXE
      PID:5836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

yjCro.exe

Path C:\Users\Admin\AppData\Local\Temp\yjCro.exe
Size 149KB
SHA256 9c3750544b8009f239730ddac8263576f3bcdab31e24c67aa22d252362716d47
MD5 f2e0ce9be3354ff6cea0044d8938d1e3
SHA1 2d05aca06f4445db0f37c58112a378be967ac7c1
SHA512 4b7f69a69357ee7e6844b578315919443012d2c110ce4ad660ffe0a83294ce422a93ca66ef92934576fbc82cbd2ad712b88b70cdad99f3e4967350abc71c3923
SSDEEP 3072:vbuMGq4hOSOVIjsvSvxj3705P1eMGDt0ZBpHKQaO/XskGfV4wx5eOO:TGq4sHVord0t1Rqt0TpHKffkGfVxx0
TLSH
T19DE3E0357A90C932D1A326701DB5D5B7B92B7962077802CFB7981FB96F306C05A3836E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5836-40-0x0000000000400000-0x000000000049D000-memory.dmp

Download