b5ea27912e498482069fb278f8f4b890908fc211d06d796401957fbb88f4d1d4

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 19:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_fb744fb77528886680ab28296a740437_elex_rhadamanthys_smoke-loader.exe
Size 687KB
Sample260729-xqa8vaej5x
SHA256 b5ea27912e498482069fb278f8f4b890908fc211d06d796401957fbb88f4d1d4
MD5 fb744fb77528886680ab28296a740437
SHA1 d507a27f62b5e2941f5e8fb0e8adc7e804846ba4
SHA512 d77745ab6fc7f731d8a2dce04f88c845ec77503b51f73d2720212baa6c2893e934281ceeefca2d2a6b4173813601f70a2d01d0b59b12997d2df8ed4dc62fb066
SSDEEP 12288:3kIS6tX32rNVeVjJBDK+QHLXG5YTcAgyrWKqSFev7+0N1R9Dgec:3rX3ckFGjrXaY4SbYvaKR97c
TLSH
T1B1E4E02176C2C470E5A702324AA6EF62587EFD714F609ECBB7C46A1D5E742C1A731B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4304	3A5F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_fb744fb77528886680ab28296a740437_elex_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3A5F.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4304	3A5F.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 4304	4144	2026-07-29_fb744fb77528886680ab28296a740437_elex_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-29_fb744fb77528886680ab28296a740437_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_fb744fb77528886680ab28296a740437_elex_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Users\Admin\AppData\Local\Temp\3A5F.tmp
  "C:\Users\Admin\AppData\Local\Temp\3A5F.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-29_fb744fb77528886680ab28296a740437_elex_rhadamanthys_smoke-loader.exe 2F82C27FD24519B7E4D4B965C2B9775C83E2DEC9D18155395FAE7E26C4CBCA74902DADD0A3EC88EAF95595829F32ABFB23BF64C0573BFC6FD60F42A43F6E1CEE
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3A5F.tmp

Path C:\Users\Admin\AppData\Local\Temp\3A5F.tmp
Size 687KB
SHA256 1849a683495d8b890aff66f47c53bc7b2e0ae95b2609402e1fefc3faafa22816
MD5 adf2a11ab222b8acbab821c816639586
SHA1 6f729aa08a88d8c1fb8f3f91debf639c1e948ffd
SHA512 073131a07df168bef5c55aef2aaa57fbda41b3b8748fdf86386acd53ed13018141762ffc1fed4791bad030a9b531c379ef4630897f42e78bdb63b141128a0eb6
SSDEEP 12288:3kIS6tXrI+D57Vpe9+8Fev7+0N1R9Dgec:3rXc84Y8YvaKR97c
TLSH
T176E4E01036D1C030E5A7063256AADE62447EFD714FA0AECBB7D86A5D4E703D1AB31B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4144-4-0x00000000000A0000-0x000000000014C000-memory.dmp

Download

memory/4304-6-0x0000000000550000-0x00000000005FC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads