30bc0cf7a1de1e29d3ecb16649a9adafa910b253eee19120ff60a5d06dbf153b

Analysis

max time kernel
148s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 00:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-24_2e52d98e25ab8b58027abf032e764bfb_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Size 48KB
Sample260724-bcbrkael4v
SHA256 30bc0cf7a1de1e29d3ecb16649a9adafa910b253eee19120ff60a5d06dbf153b
MD5 2e52d98e25ab8b58027abf032e764bfb
SHA1 bfc6b2819649d2f6a99a6d519e1ca3d3f7c2a854
SHA512 7ab2f4f24cd9aa3c96072ea016b152920c8e59f155fb109beb39b948b920406f7570b99a7af6280a1adae3363f8f095c0e2a332b8b1cd821af8106fab21bd3d7
SSDEEP 768:JXSc+goHbPt+77wfWcrfYvc9c5x/z4yPnT7nmo+s9hEQz:JXX4b167k2bPnT74zQz
TLSH
T1F2238D1A78D6C072CC0981750539C742A77BA9026FBAC1637FA9078D8EF62D05E3F365
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-24_2e52d98e25ab8b58027abf032e764bfb_amadey_elex_rhadamanthys_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5596 wrote to memory of 1500	5596	2026-07-24_2e52d98e25ab8b58027abf032e764bfb_amadey_elex_rhadamanthys_smoke-loader_stop.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-24_2e52d98e25ab8b58027abf032e764bfb_amadey_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-24_2e52d98e25ab8b58027abf032e764bfb_amadey_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5596
- C:\Users\Admin\AppData\Local\Temp\2026-07-24_2e52d98e25ab8b58027abf032e764bfb_amadey_elex_rhadamanthys_smoke-loader_stop.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-24_2e52d98e25ab8b58027abf032e764bfb_amadey_elex_rhadamanthys_smoke-loader_stop.exe" -monitor
  2⤵
  PID:1500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads