afb6aa4a874b6daf3c9fc65781fd74ebd4af66c0e4e8252ff353b326e54a2ba4

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_688aff44d76f9b7b8d7b820c8857ebd6_elex_rhadamanthys_smoke-loader.exe
Size 687KB
Sample260730-2dpypaycmb
SHA256 afb6aa4a874b6daf3c9fc65781fd74ebd4af66c0e4e8252ff353b326e54a2ba4
MD5 688aff44d76f9b7b8d7b820c8857ebd6
SHA1 ceaf66d91a5a9dc14c1f2d3a59c3a438015b471f
SHA512 41638a30464596ffc922aab12049c7b6d6dc1c9d34198ca7851eae5af234c22adc2885b62ca980c1622dcd486cd2edda50e2d252668a81a4c2665ab8eaf4547e
SSDEEP 12288:3kIS6tXO9t+X6V0yRiQ+0Fev7+0N1R9Dgec:3rXO9tw6V3iQzYvaKR97c
TLSH
T163E4E02076C1C430E5A746325AAADF22487EFD718F609ACB77C86A1D1E712D1B734B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1696	3EE.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_688aff44d76f9b7b8d7b820c8857ebd6_elex_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3EE.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1696	3EE.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 1696	4512	2026-07-30_688aff44d76f9b7b8d7b820c8857ebd6_elex_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-30_688aff44d76f9b7b8d7b820c8857ebd6_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_688aff44d76f9b7b8d7b820c8857ebd6_elex_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Users\Admin\AppData\Local\Temp\3EE.tmp
  "C:\Users\Admin\AppData\Local\Temp\3EE.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-30_688aff44d76f9b7b8d7b820c8857ebd6_elex_rhadamanthys_smoke-loader.exe EB25D443D75D60AC9E131C943F79DB007C70AABE99907AEA14FB3889229E7E09D377B0976E70CDBC751CC04A2562747D9D8D03356E7621A00E84610555816A3E
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3EE.tmp

Path C:\Users\Admin\AppData\Local\Temp\3EE.tmp
Size 687KB
SHA256 364beaf0322e61c5cf89b767f57bd69fd08306390abcd7ae2045481066223ca1
MD5 73ea6573b360044e0a0ee781559eebc8
SHA1 97405c862d6908ca29d5aec4dce538edf376bf9a
SHA512 3230e3f9ec60501b7a0fadf14a362810a6f73198d5e52fed0460b19b6d56019b4434eb270317e64b81c2ba1868fa5d05ed093bd49051214fae1f0d99074fa857
SSDEEP 12288:3kIS6tXVhG0fva2FrTUJMPjw6MFev7+0N1R9Dgec:3rXLHJTUJMPjw6MYvaKR97c
TLSH
T10EE4E01035C1C070E5A6063656AADF63047EFD724FA0EECBBBC86A1D5A702D1A735B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1696-6-0x0000000000630000-0x00000000006DC000-memory.dmp

Download

memory/4512-5-0x0000000000510000-0x00000000005BC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads