4fbfd8fc24eca1b96bf52d63e0cc743093d30a4d6743295aa147f912fd3a0651

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 01:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_633cf11bbda3788181a292af97d20c98_amadey_elex_karagany_rhadamanthys_smoke-loader.exe
Size 5.5MB
Sample260720-btgddabv4p
SHA256 4fbfd8fc24eca1b96bf52d63e0cc743093d30a4d6743295aa147f912fd3a0651
MD5 633cf11bbda3788181a292af97d20c98
SHA1 c7277a2a04e29a570bc4ce10afdf3bba3df7c357
SHA512 4ab50b56066987c857c861c85df5db0569d779c546a9caab723b489e6532bfa27ee8889f4d776daa8b6945620576e46ac05488434352ddcd098f0b6d10bb00e1
SSDEEP 98304:AZp6+Wvl3D1tBpzOUV3m+hVGiqhx0RHbNvR5D1toKOQ5MpIcRnVKN1f:+LclppiUFm+X1v7lD1tZOBFVK3f
TLSH
T1114633AEB0E04C24DCA62FB0D73A43F740E95D648B2AD96AE4E448D42FC05E1AF7C575
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5764	25AF.tmp

Executes dropped EXE 1 IoCs

pid	Process
5764	25AF.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_633cf11bbda3788181a292af97d20c98_amadey_elex_karagany_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	25AF.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3184 wrote to memory of 5764	3184	2026-07-19_633cf11bbda3788181a292af97d20c98_amadey_elex_karagany_rhadamanthys_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-19_633cf11bbda3788181a292af97d20c98_amadey_elex_karagany_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_633cf11bbda3788181a292af97d20c98_amadey_elex_karagany_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Users\Admin\AppData\Local\Temp\25AF.tmp
  "C:\Users\Admin\AppData\Local\Temp\25AF.tmp"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

25AF.tmp

Path C:\Users\Admin\AppData\Local\Temp\25AF.tmp
Size 5.5MB
SHA256 bcd8badd0f02e0a20f20933a6ac68966ac5014f980030fd76f9c4d79c8f043ee
MD5 443a3a41100e99c23a01916ead8db081
SHA1 85270228111d29c591581815a2e14f6443544335
SHA512 2a06257a0c53d03d2fcda9df294ad0ecc05b703892791487cd68d7eba6b41bf159e0022196c955865766d8d7f6a3e9335cc113954d8578bfb7f82cddd96f2665
SSDEEP 98304:wjrkZp6+Wvl3D1tBpzOUV3m+hVGiqhx0RHbNvR5D1toKOQ5MpIcRnVKN1f:vLclppiUFm+X1v7lD1tZOBFVK3f
TLSH
T13146339EB0D08835DC691EF0E33A43F345ED9965872ADD6AE4E444D02FD01A1AF7CAB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download