71eb79d78ad1e03dfef6e6ace44a094f298d31a17d473e1bcc7282af17c890a8

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 18:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_c0132ea83e5c5149c39f97d017f0f885_amadey_elex_rhadamanthys_smoke-loader.exe
Size 1.1MB
Sample260719-xdafsaby71
SHA256 71eb79d78ad1e03dfef6e6ace44a094f298d31a17d473e1bcc7282af17c890a8
MD5 c0132ea83e5c5149c39f97d017f0f885
SHA1 c8009703dccaf945c8dbec277966d0f39b055375
SHA512 1c8f0e38158d0a51013688fce783a822ccbaabc31dfac4c527fc6090864c8b30c08aab00cf003fc592b32dd62cb4f80e209d51188d7a9a1ef000071d702736e3
SSDEEP 24576:O1A45BWLpBoMYeC+Mx4+maaEbGXuiwomtTtp:O115UdBoMYe8x43EbAuiRG
TLSH
T152351250E18182F3D58510345A9EC7F72C793DB11762AEC333EA1AAD3E621C6AB36717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5416	984E.tmp

Executes dropped EXE 1 IoCs

pid	Process
5416	984E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_c0132ea83e5c5149c39f97d017f0f885_amadey_elex_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	984E.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5416	984E.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 5416	3452	2026-07-19_c0132ea83e5c5149c39f97d017f0f885_amadey_elex_rhadamanthys_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-19_c0132ea83e5c5149c39f97d017f0f885_amadey_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_c0132ea83e5c5149c39f97d017f0f885_amadey_elex_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Users\Admin\AppData\Local\Temp\984E.tmp
  "C:\Users\Admin\AppData\Local\Temp\984E.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-19_c0132ea83e5c5149c39f97d017f0f885_amadey_elex_rhadamanthys_smoke-loader.exe 0C21AB9D1B5260443B2B23DB20C3A63CA8834D5F2A2A334F29339A2E4659CA669878E8B1A159ED9B4C8C6E36A7DC5EBBBBA1970B6AFCE82AA9A164B7A220E01F
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

984E.tmp

Path C:\Users\Admin\AppData\Local\Temp\984E.tmp
Size 1.1MB
SHA256 6dbf5ea98014942632c79b1971b5e57763c23785d8e44badc62cfc9bea567762
MD5 2e67313ddd5051767d1b1d682308b349
SHA1 de17c3f5a5fee50e19bb44936992ad4d6eff06f7
SHA512 1f4781d18680c8ecee2bd4005cf80903e67d5b131efaefccdc3b9fae6a4d55d85a99e10dddced89c5e7499996761cdef75ea91c2c1172e845b6b4e7d9c331cb2
SSDEEP 24576:O1A45BWLpBoMYIt8m1KcXA9TZZmzdTm1/Y78E2ZYS:O115UdBoMYu8QXAltQ2L
TLSH
T164351264E590D2F3D44214705AAA8BF76D397DB11B628EC332E90B6E3D211C2BB36357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads