9ee3cf8a28dfe1e9ce334676bbc2aab5b8eb0e106f3f704091b793f9e4862056

Analysis

max time kernel
148s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 13:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_7d0b7639843314b310a66e3d3921acc3_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Size 149KB
Sample260711-qa9cdabs9n
SHA256 9ee3cf8a28dfe1e9ce334676bbc2aab5b8eb0e106f3f704091b793f9e4862056
MD5 7d0b7639843314b310a66e3d3921acc3
SHA1 dcb713d002b4fcbf214e13963e2c5333538debf2
SHA512 f4b1c688368272746f37cc20a8f770796efe90671ec89e467e8f15f0719a86ebc975780f270d3ac46c2f81adc656b4a9f91d756d0bf89c6c1f6ecfe91647d912
SSDEEP 3072:vbuMGq4hOSOVkjsvztWmYzcnqijnL2XSM+lo6OGo:TGq4sHVchcnvJMh6OP
TLSH
T16DE3D022BAA1D871D06222705975C6B3A62F796163B801CB77CC1BBE5FB05C15F3C36A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3504	43B2F.exe
2904	2026-07-11_7d0b7639843314b310a66e3d3921acc3_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
4472	2026-07-11_7d0b7639843314b310a66e3d3921acc3_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2904 set thread context of 4472	2904	2026-07-11_7d0b7639843314b310a66e3d3921acc3_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	89

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	43B2F.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-11_7d0b7639843314b310a66e3d3921acc3_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-11_7d0b7639843314b310a66e3d3921acc3_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3720 wrote to memory of 3504	3720	2026-07-11_7d0b7639843314b310a66e3d3921acc3_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	87
PID 3504 wrote to memory of 2904	3504	43B2F.exe	88
PID 2904 wrote to memory of 4472	2904	2026-07-11_7d0b7639843314b310a66e3d3921acc3_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	89
PID 2904 wrote to memory of 4472	2904	2026-07-11_7d0b7639843314b310a66e3d3921acc3_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	89
PID 2904 wrote to memory of 4472	2904	2026-07-11_7d0b7639843314b310a66e3d3921acc3_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	89
PID 2904 wrote to memory of 4472	2904	2026-07-11_7d0b7639843314b310a66e3d3921acc3_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	89
PID 2904 wrote to memory of 4472	2904	2026-07-11_7d0b7639843314b310a66e3d3921acc3_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-11_7d0b7639843314b310a66e3d3921acc3_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_7d0b7639843314b310a66e3d3921acc3_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Users\Admin\AppData\Local\Temp\43B2F.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-11_7d0b7639843314b310a66e3d3921acc3_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe" iWnbX541
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3504
- - C:\Users\Admin\AppData\Local\Temp\2026-07-11_7d0b7639843314b310a66e3d3921acc3_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\43B2F.exe" cXePPikp
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2904
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-11_7d0b7639843314b310a66e3d3921acc3_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
      ioYPMLfs
      4⤵
      Executes dropped EXE
      PID:4472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

43B2F.exe

Path C:\Users\Admin\AppData\Local\Temp\43B2F.exe
Size 149KB
SHA256 96e2cb2c6f2367e582bf0ced5ba48506bffe1520bea7094c81712d2182363b84
MD5 f97fdae30981482095f82a009917dace
SHA1 14fad85bb6587faf947ab46d686bfa305bbbbc3d
SHA512 00e361a138b719242cc3db712c1b2e6efc4b3fd6c15980c10f798a88829480d1d4d23464497d49e27536289c44dadc10c627b192594369d56fd068237bf8c5fe
SSDEEP 3072:vbuMGq4hOSOVqjsvFgowKjAQpMquCXRor/dMqYTliS/:TGq4sHVWO80ZMig/YT0S/
TLSH
T12CE3E0257A508436E192327068B4D2F7B92B756217B881CF77581FBE2FB06C05E3972B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4472-40-0x0000000000400000-0x000000000049D000-memory.dmp

Download