2096f8cdc65147a8e2bb90d3e6f7cd265d9b178d84c187ff741819f1236ccb49

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 17:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_b40b638be42899726a2da2e203895cad_elex_rhadamanthys_smoke-loader.exe
Size 687KB
Sample260731-vkeyqswhle
SHA256 2096f8cdc65147a8e2bb90d3e6f7cd265d9b178d84c187ff741819f1236ccb49
MD5 b40b638be42899726a2da2e203895cad
SHA1 5bb0e916b4aa866911828cb3cd98b1ef313ee452
SHA512 4e61ece35c26586982baefb7028a38f06b2b0f2096bdfa0eba937c57e2b939e8f107f884861eb58a3972970e33f53daf5611c6f157baa1bb939391b9fb712e24
SSDEEP 12288:3kIS6tXNWsc0c0FyZkn5F+RcU4Fev7+0N1R9Dgec:3rXNWeWkn5F+RcU4YvaKR97c
TLSH
T102E4E06036C1C070E5E7063256A6DF66547EFD324FA09ACBB7C82A1D1E706D1AB34B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
120	5F4D.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_b40b638be42899726a2da2e203895cad_elex_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5F4D.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
120	5F4D.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3872 wrote to memory of 120	3872	2026-07-31_b40b638be42899726a2da2e203895cad_elex_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-31_b40b638be42899726a2da2e203895cad_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_b40b638be42899726a2da2e203895cad_elex_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Users\Admin\AppData\Local\Temp\5F4D.tmp
  "C:\Users\Admin\AppData\Local\Temp\5F4D.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-31_b40b638be42899726a2da2e203895cad_elex_rhadamanthys_smoke-loader.exe 8940D402320D40E57F9FB701A599EE4545B0E9A4FFA80F937CAE0E0B595D0FFF14984266120AE21E528E59BD7EDD762AF66A503D145C9E722DC16B1EB742A4F4
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5F4D.tmp

Path C:\Users\Admin\AppData\Local\Temp\5F4D.tmp
Size 687KB
SHA256 37351344011aa3ef5e783d0dec5d0d7735ed6f7eca109d7f6a0a16eb07ee1492
MD5 8cafeb151f914def6d884acdaf212683
SHA1 c666891a5fdfab24c5f1bd30b6115a83156a3fca
SHA512 943d814e36c5b4e35c4c8474056629263a5c52f790f7f40e79978114dfa6eaff9614f7961da55a8905d19ea7eac232779a8ab97906ddd8a781f691b84720b140
SSDEEP 12288:3kIS6tXl8A6rdYhNsjC9dUznZR7m/Fev7+0N1R9Dgec:3rXlF6r8mRm/YvaKR97c
TLSH
T1A2E4D02176C2C430E5A7463246A5EF63447EFD324F609ACBBBC82A1D5E702D1A771B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/120-6-0x0000000000710000-0x00000000007BC000-memory.dmp

Download

memory/3872-4-0x0000000000A20000-0x0000000000ACC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads