8fe09074a2cb1d54da877b54bbbfd8c0fcb1003c110a13e3f882f3a5763e1f1e

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 06:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_c1b8bc26ed6e1b3fe8f36956237290fb_amadey_elex_loda_rhadamanthys_smoke-loader.exe
Size 2.0MB
Sample260714-gw4vcaft4p
SHA256 8fe09074a2cb1d54da877b54bbbfd8c0fcb1003c110a13e3f882f3a5763e1f1e
MD5 c1b8bc26ed6e1b3fe8f36956237290fb
SHA1 5eeab6fef61128e08b162e77698de85b4bed9ad3
SHA512 15e7c295ad44b7186078eb74c6c25b892715ed280da8e655d021c706a61ab7e567fe317271fe85fae5d29ebe94bcabd16f1ba5601e00a48becc776a2f0bbd59d
SSDEEP 49152:gtrGEQDdEqHDpLLRXbI6Ajsl4YlZfPWHiBBe:+aEAdEqHxZkYlZXcsB
TLSH
T1AC95E192F245A8E9E80321B55C3DCA2214577E7D0AB9564F35CF762989B338231B7E0F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2208	D93.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D93.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_c1b8bc26ed6e1b3fe8f36956237290fb_amadey_elex_loda_rhadamanthys_smoke-loader.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2208	D93.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3500 wrote to memory of 2208	3500	2026-07-14_c1b8bc26ed6e1b3fe8f36956237290fb_amadey_elex_loda_rhadamanthys_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-14_c1b8bc26ed6e1b3fe8f36956237290fb_amadey_elex_loda_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_c1b8bc26ed6e1b3fe8f36956237290fb_amadey_elex_loda_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3500
- C:\Users\Admin\AppData\Local\Temp\D93.tmp
  "C:\Users\Admin\AppData\Local\Temp\D93.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-14_c1b8bc26ed6e1b3fe8f36956237290fb_amadey_elex_loda_rhadamanthys_smoke-loader.exe C003F665AB3DE57DFD14B6023D4D5FC1E199E6FD5508DA79EFE38D644C702A6C1B946B12C02ABB4E2BEA8088DEC707F29A99FA2A6703165441F3EFC069E55487
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

D93.tmp

Path C:\Users\Admin\AppData\Local\Temp\D93.tmp
Size 2.0MB
SHA256 5abca96669775fa7a30424b3957751f4d2fb3e8d601ef1bd732e288c091c5a36
MD5 fafe92f479ed3fdf8b84198969e22f48
SHA1 451fd19b1ad553a5bc86ff490f1bae769a5d797e
SHA512 8ee3e931fbdd2d49fb4f7acd2ec1a9d620c5535f8353ce324fb1d4a9b8b133717b70e61222d2cec68e9daa13ffcc5e058fd0ec3abdda4101c94ccc81ebaa3b8c
SSDEEP 24576:gUarPXeDhqWbTJ7DOYd9Q/Jvy3H0t1H4g4CtzNfDuzmsItvG3cICVd6fPgemDqS:gtrGEQDdEqHo4MNfaReICV4n4e
TLSH
T1D095D091F245A8F9D80325B59C79CA2214077E7D4AB9564E35CF362A99B338330B7E0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads