22aecaf74c2a03cbc4857384119695395fd5e557dfd555a1547ea7772414465c

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 20:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_94fd281a079e010500fdf05d58c64a0e_elex_rhadamanthys_smoke-loader.exe
Size 687KB
Sample260728-y36e7avekh
SHA256 22aecaf74c2a03cbc4857384119695395fd5e557dfd555a1547ea7772414465c
MD5 94fd281a079e010500fdf05d58c64a0e
SHA1 ba3be3bd4a5dc3069f009b66cdfc6dba2badf1df
SHA512 3be4bb8e95790a1f19f6dc147eab9a0cfae469db224f1098ef271087ba5568eef9773cd410cae854b7b2e83c7dd660c8ce9a57d0847fc607d8b190b061427f8d
SSDEEP 12288:3kIS6tXG1n4BORo/ag+fDwK5Fv/3z/15tFev7+0N1R9Dgec:3rXGNPoNARPYvaKR97c
TLSH
T13AE4E01036C1C030E6A6063256A6DF62547EFD764FA09ECFB7C86A1D5E702D0AB35B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2432	5EB0.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_94fd281a079e010500fdf05d58c64a0e_elex_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5EB0.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2432	5EB0.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 2432	4888	2026-07-28_94fd281a079e010500fdf05d58c64a0e_elex_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-28_94fd281a079e010500fdf05d58c64a0e_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_94fd281a079e010500fdf05d58c64a0e_elex_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Users\Admin\AppData\Local\Temp\5EB0.tmp
  "C:\Users\Admin\AppData\Local\Temp\5EB0.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-28_94fd281a079e010500fdf05d58c64a0e_elex_rhadamanthys_smoke-loader.exe 6D07C1646101881C178222CF371230E4922148A4430E460577A3ED0551F1160A82EEDB40A169BE13F236FA6366E1BE3706E1DACEDF9828987D4A382C7C40303C
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5EB0.tmp

Path C:\Users\Admin\AppData\Local\Temp\5EB0.tmp
Size 687KB
SHA256 16dd34fe331b81dc3fcf943dd960c1e4a17d41702138895d1df0a8407f592e79
MD5 1043dca6f15c217f8e5c0fb7599bd070
SHA1 65ea901e18f3cd355f0b462116bca985bf9d4eda
SHA512 093149761297fdcd12ff082d6ae5c7e92e4777bfa639fe9a897f678d39b63bf23d9309a0a99a0ec8bbd5fa4e45c1a84f1872325a1de1679cf7903d52046f1d7f
SSDEEP 12288:3kIS6tXmZ8uFECAu0+Zi9LUWdv5g1/Fev7+0N1R9Dgec:3rXY8f8rGUQ5YYvaKR97c
TLSH
T11DE4E01076C1C030E5B606329AA6EF62447EFD764FA09ECBB7C46B1D59702D1AB34B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2432-6-0x00000000002B0000-0x000000000035C000-memory.dmp

Download

memory/4888-4-0x00000000003C0000-0x000000000046C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads