b51d8f64d668c42da312d09acc67503e18ed1340c5e1b3ab7952c17fb3bbddc0

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 04:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_3df045b445fa887d5789574f5d15efc8_elex_rhadamanthys_smoke-loader.exe
Size 687KB
Sample260718-er2hbabs2s
SHA256 b51d8f64d668c42da312d09acc67503e18ed1340c5e1b3ab7952c17fb3bbddc0
MD5 3df045b445fa887d5789574f5d15efc8
SHA1 0d30b77f8f86764098d85bf7ca1f87ea81e2bf08
SHA512 b2a0b14175a4b4da7873ad30da3b90bf814452e84ab7b42f8577e353e0094c15d536b195b81af2b226efe62a4972abb01d88ba00d84284df33cacb4dd2e6d87b
SSDEEP 12288:3kIS6tXkQ0pAwtaLbPIYEV6MjcFev7+0N1R9Dgec:3rXohanQYtMjcYvaKR97c
TLSH
T1F9E4D02036C1C070E5A7063256AADF62487EFD714FA4AECBB7C82A5D1D706D0A735B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2608	9011.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_3df045b445fa887d5789574f5d15efc8_elex_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9011.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2608	9011.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 2608	4644	2026-07-17_3df045b445fa887d5789574f5d15efc8_elex_rhadamanthys_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-17_3df045b445fa887d5789574f5d15efc8_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_3df045b445fa887d5789574f5d15efc8_elex_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Users\Admin\AppData\Local\Temp\9011.tmp
  "C:\Users\Admin\AppData\Local\Temp\9011.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-17_3df045b445fa887d5789574f5d15efc8_elex_rhadamanthys_smoke-loader.exe 2E22F464694276C6B6C08B1690A47CFA3CC2A0DFE63033FDDEC09011A5CA17FD374727F7438AF9431F13ABAED6BA45E0F01BF219AA8A6FDFC7F5BFE6A1E251CA
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9011.tmp

Path C:\Users\Admin\AppData\Local\Temp\9011.tmp
Size 687KB
SHA256 56d4a4f9c967aea374e502ae945d26ca68ad3acbd11edf7f26309e2598302db4
MD5 aa04eeca917d830a30f7bcf8e3384256
SHA1 78fd74a1314676f99d7fdf4a13d80aa6202575c3
SHA512 5fbf23c0a4239f9e37fb5f20484ffcf2fda9cfbd159efc25c99c4b3f6c0e10af168a9bcf45363f7b117d87d65e543044110fbcc8b25cc030a7b487fcbcf3b012
SSDEEP 12288:3kIS6tXIEne3ZW1+A/zEpXFTqmdqJSuFev7+0N1R9Dgec:3rX/e3AkGzGXFTqmdqJSuYvaKR97c
TLSH
T1DFE4E11076C1C030E5A7063256AAEE62547EFD724FA0AECBB7C81A1D5A746C1B731B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2608-6-0x00000000004C0000-0x000000000056C000-memory.dmp

Download

memory/4644-4-0x0000000000D40000-0x0000000000DEC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads