efd749d7e8c47dd6b170420389288762889ef6db214555817127a4daa1426089

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_142e4e9ad9b2dd4c49851cfad5cae7e6_elex_rhadamanthys_smoke-loader.exe
Size 687KB
Sample260714-sdzcpafs8l
SHA256 efd749d7e8c47dd6b170420389288762889ef6db214555817127a4daa1426089
MD5 142e4e9ad9b2dd4c49851cfad5cae7e6
SHA1 be83475e8f5f63bcaf9a87bd96eeb05e6cb71ed5
SHA512 1a138293a46e1d6588ec42f4350e0dd420169baf742cba5d33c0f4b1623cbe6fae0a98c0ada4bdfceaf815e41a0ec490050f370e14dcc7879741b98fdac0b2d1
SSDEEP 12288:3kIS6tX/B1pEbVVr263Wp3yADT+YqGFev7+0N1R9Dgec:3rX/BPMz26U3hybGYvaKR97c
TLSH
T198E4E01076C1C070E5A7063256AADF66547EFC324FA09ECBB7C82A1E5A743D1A734B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4988	F9CC.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_142e4e9ad9b2dd4c49851cfad5cae7e6_elex_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F9CC.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4988	F9CC.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 4988	2628	2026-07-14_142e4e9ad9b2dd4c49851cfad5cae7e6_elex_rhadamanthys_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-14_142e4e9ad9b2dd4c49851cfad5cae7e6_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_142e4e9ad9b2dd4c49851cfad5cae7e6_elex_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Users\Admin\AppData\Local\Temp\F9CC.tmp
  "C:\Users\Admin\AppData\Local\Temp\F9CC.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-14_142e4e9ad9b2dd4c49851cfad5cae7e6_elex_rhadamanthys_smoke-loader.exe 6A9E2C66157FDE4BCC6D416A5B03BA2299453BB94F3C5B01C7BDFBCF80AE9573666546671E9EC0220C0721DDCD0B8939218AB15E6DC0BA3AA021D831E0790F50
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F9CC.tmp

Path C:\Users\Admin\AppData\Local\Temp\F9CC.tmp
Size 687KB
SHA256 a1bf47851a592acb684b8e08d461270e3e4ab052b6f34a7430972b9e3c51a9d1
MD5 b20e1254631c96306e17abb98544b7c9
SHA1 aec1c0a18cbaa40ecb59d6ea1a6b16dbee1f7887
SHA512 bed5a4defa7238c8b433f001801794c3f9c8e929ea8f3b13f242ff18a4272a1b68b9700d58903921a13f40607a1f4d981c069869e3397b0b35339d4fc9c1c892
SSDEEP 12288:3kIS6tXcgFrE+7PibdzjSNKNzqDFev7+0N1R9Dgec:3rXbFoRbdzjSdDYvaKR97c
TLSH
T11FE4E01036C1C430E6A706328AAADF62447EFD314FA09ECBB7C46B1D5E746D1A735A63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2628-4-0x0000000000E00000-0x0000000000EAC000-memory.dmp

Download

memory/4988-6-0x0000000000C20000-0x0000000000CCC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads