bc88eade9de0765a10f8f37301efcf8114ac67d322ed7c8a3c69dae714e0826b

Analysis

max time kernel
150s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_70da126426958412eaf42c5b24c2fcf6_amadey_elex_loda_rhadamanthys_smoke-loader.exe
Size 2.3MB
Sample260723-p5dcraxtfs
SHA256 bc88eade9de0765a10f8f37301efcf8114ac67d322ed7c8a3c69dae714e0826b
MD5 70da126426958412eaf42c5b24c2fcf6
SHA1 0dc3f769d72a3cbedf2f479cee65c78ac35a8974
SHA512 6527bb5cb31e48894609bd8a0960689c784ba7603dfe5b560e466f15486bab0ec63fc4531f041133df326e2b577f17da9ee4fa82e64b9463de6656d6e9fe1705
SSDEEP 49152:BtrqOMudxX6zliyDlblfCTL9xfb9YiCKhG:DWOBdxX6sIbl6/9xxYiCs
TLSH
T1E4B5AFA2F245ACE9E80325B59C7DCA2114477E7D4AB9560E358F722995B338330B7E0F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5872	9BAA.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_70da126426958412eaf42c5b24c2fcf6_amadey_elex_loda_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9BAA.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5872	9BAA.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 5872	3980	2026-07-23_70da126426958412eaf42c5b24c2fcf6_amadey_elex_loda_rhadamanthys_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-23_70da126426958412eaf42c5b24c2fcf6_amadey_elex_loda_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_70da126426958412eaf42c5b24c2fcf6_amadey_elex_loda_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Users\Admin\AppData\Local\Temp\9BAA.tmp
  "C:\Users\Admin\AppData\Local\Temp\9BAA.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-23_70da126426958412eaf42c5b24c2fcf6_amadey_elex_loda_rhadamanthys_smoke-loader.exe D76D28963E2B34DEF9B8B4F49D79ED18E62029836CDB96001D8901F34E313336FB08E20F5B534C5AE62F0B9C0A81577D5048B53F02901811882AE9133CA74A75
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9BAA.tmp

Path C:\Users\Admin\AppData\Local\Temp\9BAA.tmp
Size 2.3MB
SHA256 9af1a66f726853076e498b0544347b5f9c6b095a13d691a14be907c9992e7233
MD5 46928222e310ea936868cfd679427fed
SHA1 568c0d6d86d43ba84553281f85e2e4c9166b59f0
SHA512 064a4d728ceb614e1dc5e02dfd88d7c5ffc7e7a7e701033270f1882d69d31aae7cd704e0f4eef21165e2f24c9ac02756365bf5adc3118f546fac88d1288f46db
SSDEEP 49152:BtrqOMudxX6n8Iw5SCJtSWNR+AyNYePerKhG:DWOBdxX6n8uJWiACYoers
TLSH
T12AB5AF92F245ACE9E80725B59C7DCA2124077E7D4AB9560E358F762985B338330B7E0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads