f681ed4d5b8a4965ee8b38f2ff43828020b40c2d5345d7f9f0fe8ba03c1cc779

Analysis

max time kernel
148s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 10:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_3cade6b13b3f89db94b61f84f47e8d23_elex_rhadamanthys_smoke-loader.exe
Size 687KB
Sample260715-mble6ahw4l
SHA256 f681ed4d5b8a4965ee8b38f2ff43828020b40c2d5345d7f9f0fe8ba03c1cc779
MD5 3cade6b13b3f89db94b61f84f47e8d23
SHA1 0b85b4e8851b93ed552c25688234ff54310c5f63
SHA512 6f8b02d049dee8428eb1aaa4b87841610d5e4ffc5c759f6eeb9014feccbc7481cd56691f56973e2e51bda0515532cc4ef18bd1a48c6e0136f44d17e0807ea024
SSDEEP 12288:3kIS6tXFq/QYezlpevpeoS3KN2aTFev7+0N1R9Dgec:3rXmUzOxYKDYvaKR97c
TLSH
T19FE4E01032C1C070E6A7063656AADF5348BEFD364F60AECBB7C86A5D59702D1A734B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4808	206F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_3cade6b13b3f89db94b61f84f47e8d23_elex_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	206F.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4808	206F.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 4808	4864	2026-07-15_3cade6b13b3f89db94b61f84f47e8d23_elex_rhadamanthys_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-15_3cade6b13b3f89db94b61f84f47e8d23_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_3cade6b13b3f89db94b61f84f47e8d23_elex_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Users\Admin\AppData\Local\Temp\206F.tmp
  "C:\Users\Admin\AppData\Local\Temp\206F.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-15_3cade6b13b3f89db94b61f84f47e8d23_elex_rhadamanthys_smoke-loader.exe 4CE905A6241F916D878FFB779492539051FE218A12CE873715550F6C6DC3BCA8A3F41F96D37EB2F98DE2D19A0F99F4D7AB9776118E493F9F75FEDA5A94B58E32
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

206F.tmp

Path C:\Users\Admin\AppData\Local\Temp\206F.tmp
Size 687KB
SHA256 de5b329ba0abc6c956d0a8ce3427a167d6d9fa24dcd938efe06131a72bcd600c
MD5 abf7ea450db7826ccd9c6cbf403bb818
SHA1 3e9113591f96102b98980e63094abce8fafd8ad9
SHA512 a43b30aa2e3a273cdfb4c00f97e41d1e4f2144319f004babc379afef42536554614cc46ce662e2fab843bb1eb1cdea3784d92f49953b2d5463fd4e8361be9302
SSDEEP 12288:3kIS6tXeG8n5lF9FsvBpFev7+0N1R9Dgec:3rXon5DCpYvaKR97c
TLSH
T1ACE4E02072D1C030E5A7463246AADF66487EFD354F60AECBB7C82A5D1D746C1AB34B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4808-6-0x00000000003D0000-0x000000000047C000-memory.dmp

Download

memory/4864-5-0x00000000004D0000-0x000000000057C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads