9fc1fbdbc24a3fff8151e9646ad1db89ade984d89ef2fc7ba779d2ef50020ced

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 16:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_e39cc4cb59f1423cef299032e5bbb9fa_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Size 149KB
Sample260731-tvgpmsdc68
SHA256 9fc1fbdbc24a3fff8151e9646ad1db89ade984d89ef2fc7ba779d2ef50020ced
MD5 e39cc4cb59f1423cef299032e5bbb9fa
SHA1 16096a3c760412c569b8e0743bfc0658f54ed78e
SHA512 aa99715cde033c75a302ef6048429860e65328f5c62b49a6238ccfaf61c59893bdaf9f2e984b0d69a82c23c1f0705239effadb5cf611d9299c19f284804848cb
SSDEEP 3072:vbuMGq4hOSOV+jsvHFJTQRgFLkUcltXvQCmbpkggJ+dHI8AKhJa4S1z:TGq4sHVi6JQykvltXvkpkgg+RRaP9
TLSH
T1D2E3F12679A1C476D0A7267058A196F3792BB521137C42C7B7D81F7E6F306C25E3832B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2156	MKIi2.exe
1440	2026-07-31_e39cc4cb59f1423cef299032e5bbb9fa_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
5792	2026-07-31_e39cc4cb59f1423cef299032e5bbb9fa_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1440 set thread context of 5792	1440	2026-07-31_e39cc4cb59f1423cef299032e5bbb9fa_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	92

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_e39cc4cb59f1423cef299032e5bbb9fa_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MKIi2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_e39cc4cb59f1423cef299032e5bbb9fa_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2156	2300	2026-07-31_e39cc4cb59f1423cef299032e5bbb9fa_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	90
PID 2156 wrote to memory of 1440	2156	MKIi2.exe	91
PID 1440 wrote to memory of 5792	1440	2026-07-31_e39cc4cb59f1423cef299032e5bbb9fa_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	92
PID 1440 wrote to memory of 5792	1440	2026-07-31_e39cc4cb59f1423cef299032e5bbb9fa_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	92
PID 1440 wrote to memory of 5792	1440	2026-07-31_e39cc4cb59f1423cef299032e5bbb9fa_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	92
PID 1440 wrote to memory of 5792	1440	2026-07-31_e39cc4cb59f1423cef299032e5bbb9fa_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	92
PID 1440 wrote to memory of 5792	1440	2026-07-31_e39cc4cb59f1423cef299032e5bbb9fa_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-07-31_e39cc4cb59f1423cef299032e5bbb9fa_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_e39cc4cb59f1423cef299032e5bbb9fa_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Users\Admin\AppData\Local\Temp\MKIi2.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-31_e39cc4cb59f1423cef299032e5bbb9fa_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe" kPyTaTfA
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2156
- - C:\Users\Admin\AppData\Local\Temp\2026-07-31_e39cc4cb59f1423cef299032e5bbb9fa_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\MKIi2.exe" NzThKW8S
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1440
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-31_e39cc4cb59f1423cef299032e5bbb9fa_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
      dpD2yUGx
      4⤵
      Executes dropped EXE
      PID:5792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MKIi2.exe

Path C:\Users\Admin\AppData\Local\Temp\MKIi2.exe
Size 149KB
SHA256 2442d070894eb3c7b3be7741a21a061160ab545147d8d944119396a435cfbe68
MD5 557647da00a120d2707e492ec8cad751
SHA1 652c695c63ee46ad11a2a377ccc45c65ad5f3faf
SHA512 86840dfeeeed3267188fbc7917746a8012871941f661093c53c720ad8f39f039eff8c31687aec08623b25aa018b25390eca6172dbab80a0f0822a5ef0a562c0e
SSDEEP 3072:vbuMGq4hOSOVwjsvq3/v0WCjfkZoVJzZEQ2AdF74:TGq4sHVwd/v0rke/+qJ4
TLSH
T152E3D026BAA0D432D45326709CB4C5B7AA2E79612B7402CBB7991FBD5F702C05E3931F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5792-40-0x0000000000400000-0x000000000049D000-memory.dmp

Download