cd0e824e2daeb5811872faf3d1ddaffb02e04eaadb294f0e6c333d0fda34dbd6

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 01:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_f93063621f0d11201fdb39ef6c543670_elex_rhadamanthys_smoke-loader.exe
Size 687KB
Sample260718-bsp9wsbx7m
SHA256 cd0e824e2daeb5811872faf3d1ddaffb02e04eaadb294f0e6c333d0fda34dbd6
MD5 f93063621f0d11201fdb39ef6c543670
SHA1 977d78afa8f76e92cf6facc97ea8725ff9805b29
SHA512 a3c47d15e85ac4ecb984d3ca55b155ccfe39555c795c1532f9d3d0afcbaae503bf22f71c035dfabc82885c68955182fa59ee4d38fe9824dce7ce1f28582ec23d
SSDEEP 12288:3kIS6tX6+wlvMmXTyvv2OHmwGIpruFev7+0N1R9Dgec:3rX67XMvpb4YvaKR97c
TLSH
T1E2E4E11076C1C030E5A7063256AADF22587EFD764FA0AACBB7C42A1D4E702D1A735B73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
752	DDB9.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_f93063621f0d11201fdb39ef6c543670_elex_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DDB9.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
752	DDB9.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3576 wrote to memory of 752	3576	2026-07-17_f93063621f0d11201fdb39ef6c543670_elex_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-17_f93063621f0d11201fdb39ef6c543670_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_f93063621f0d11201fdb39ef6c543670_elex_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3576
- C:\Users\Admin\AppData\Local\Temp\DDB9.tmp
  "C:\Users\Admin\AppData\Local\Temp\DDB9.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-17_f93063621f0d11201fdb39ef6c543670_elex_rhadamanthys_smoke-loader.exe 7D3619C734DE7F9C4E0A4E25745D017B02370D01DA2E78EF86F4B48FEA1466304CD6C0CC938C76A0E7F099836343008D8EECB015ED37601529304F18D3937EE6
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DDB9.tmp

Path C:\Users\Admin\AppData\Local\Temp\DDB9.tmp
Size 687KB
SHA256 e12e94ebb9847a6f8f9c3591148134bb11372bd79e3fee7066de96ad53f7ff62
MD5 e137a8e11b5906037aa23ebbbd847d53
SHA1 f5586fe49af691055e823f005357e15a77d9c112
SHA512 f53d844a018d6bc89724fd41eecfb76a877fa6bad62b8e9b88a60406f0da5a2fb8362588c559662edc3fba66f49673396f61fe0baf5a20abbc82af486b9c5702
SSDEEP 12288:3kIS6tX0i829bZ0WudPFev7+0N1R9Dgec:3rX0iVT0NPYvaKR97c
TLSH
T1F2E4E01036C2C030E5A6063259AADF62547EFD364F60AACFB7C86B5D1A707D1A734B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/752-6-0x0000000000DC0000-0x0000000000E6C000-memory.dmp

Download

memory/3576-4-0x0000000000210000-0x00000000002BC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads