f89c22b043b5a37d13dc77dabe1e29caca4d6070786ec80186db59a7d27b4dbc

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 13:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_55f2484989c77c4d8f7a69493b46086e_amadey_elex_rhadamanthys_smoke-loader.exe
Size 1.1MB
Sample260720-qfaq1adv2s
SHA256 f89c22b043b5a37d13dc77dabe1e29caca4d6070786ec80186db59a7d27b4dbc
MD5 55f2484989c77c4d8f7a69493b46086e
SHA1 82ecf4c4242ac634430fa4284afc3b921a2164f2
SHA512 125c1dc37925555bf465f4004bbb923561aba3a20f675ae90e9ccd389cb4f103e97e3828fce33db705bf9d8cac3a9f13e9752bb0808456f32e0dda63f502969d
SSDEEP 24576:O1A45BWLpBoMYxyag4f+HEKtx44fAhHh9Yywq4NuuX:O115UdBoMYxyUEdfAHLoqE/
TLSH
T1743512A4E291C3F3D54604706A498BE76C393DB50B669EC733DD0A6C3D622C2AA33757
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4464	8C48.tmp

Executes dropped EXE 1 IoCs

pid	Process
4464	8C48.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_55f2484989c77c4d8f7a69493b46086e_amadey_elex_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8C48.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4464	8C48.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 4464	4972	2026-07-20_55f2484989c77c4d8f7a69493b46086e_amadey_elex_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-20_55f2484989c77c4d8f7a69493b46086e_amadey_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_55f2484989c77c4d8f7a69493b46086e_amadey_elex_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Users\Admin\AppData\Local\Temp\8C48.tmp
  "C:\Users\Admin\AppData\Local\Temp\8C48.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-20_55f2484989c77c4d8f7a69493b46086e_amadey_elex_rhadamanthys_smoke-loader.exe F25505B5DB4F355261C5B4AD36D24BE2A39F3B0E39BE2C1E155C035D9A23B88C0F6006FDC514EED999A028A5ACCE1627D41D6193445088B6A71D46D8DD044D0C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8C48.tmp

Path C:\Users\Admin\AppData\Local\Temp\8C48.tmp
Size 1.1MB
SHA256 29367ada7d16c4f5dce8d5a97ddd9415aa34f4548398e11aca29362a8353114a
MD5 b2eb3cf73fcdc72179598c055d615922
SHA1 531304d6cb8bbf9131c923e4dc887c6435c42afa
SHA512 a35ce1453897c3fdc239e46487b425cda80da7989ae34b6b703866b05419d3231b50ed3e1e44cdad9b2c4d8673818d2d323e6ee9ec184a9074af80c262e49ba0
SSDEEP 24576:O1A45BWLpBoMYB9En7XrQu1DtRxAa3NwIBGdzctINOBSV:O115UdBoMYB9Ex1DTxN3uRzcAO
TLSH
T157351274E5A193F2C60644341A6ACBF77C39397457769EC332EA1A793C602C2EB76213
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads