28dc4c2a19329d819ee9c3f59fd43ac2ddfe01ac0dd21b8fb15fbf3cc0aa07bd

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 22:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_11530b09ba0e13331baf4d6fb6da26d5_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Size 149KB
Sample260801-18aa2shf92
SHA256 28dc4c2a19329d819ee9c3f59fd43ac2ddfe01ac0dd21b8fb15fbf3cc0aa07bd
MD5 11530b09ba0e13331baf4d6fb6da26d5
SHA1 e46fa2a895d4b06980fb57329f7fef0e03d07fd6
SHA512 2fe8bab04c28903a138a9fa84e3651c1dc7d6c2c27c9a582c707fda56d170bb55dfffa1ca6b9c2f1720fd498a80a4c649883fc1aa71b24e7a3849397b36c43c6
SSDEEP 3072:vbuMGq4hOSOVMjsvt9RBuU9gRjYmS+b98YBdBZnW2oZ+k92kKWS:TGq4sHVk+9vF9MYd28YBZnj223N
TLSH
T13FE3D025BAA1D472D16226305871D3B3A26BB562137845CBB79C2FBE5F706C05E3832F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2168	C8zEM.exe
4668	2026-08-01_11530b09ba0e13331baf4d6fb6da26d5_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
3840	2026-08-01_11530b09ba0e13331baf4d6fb6da26d5_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4668 set thread context of 3840	4668	2026-08-01_11530b09ba0e13331baf4d6fb6da26d5_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_11530b09ba0e13331baf4d6fb6da26d5_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_11530b09ba0e13331baf4d6fb6da26d5_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C8zEM.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 2168	1180	2026-08-01_11530b09ba0e13331baf4d6fb6da26d5_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	89
PID 2168 wrote to memory of 4668	2168	C8zEM.exe	90
PID 4668 wrote to memory of 3840	4668	2026-08-01_11530b09ba0e13331baf4d6fb6da26d5_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 4668 wrote to memory of 3840	4668	2026-08-01_11530b09ba0e13331baf4d6fb6da26d5_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 4668 wrote to memory of 3840	4668	2026-08-01_11530b09ba0e13331baf4d6fb6da26d5_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 4668 wrote to memory of 3840	4668	2026-08-01_11530b09ba0e13331baf4d6fb6da26d5_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 4668 wrote to memory of 3840	4668	2026-08-01_11530b09ba0e13331baf4d6fb6da26d5_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-01_11530b09ba0e13331baf4d6fb6da26d5_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_11530b09ba0e13331baf4d6fb6da26d5_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Users\Admin\AppData\Local\Temp\C8zEM.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-01_11530b09ba0e13331baf4d6fb6da26d5_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe" e3RWjKyn
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Users\Admin\AppData\Local\Temp\2026-08-01_11530b09ba0e13331baf4d6fb6da26d5_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\C8zEM.exe" rS1eUmxw
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4668
  - - C:\Users\Admin\AppData\Local\Temp\2026-08-01_11530b09ba0e13331baf4d6fb6da26d5_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
      Y9E5f391
      4⤵
      Executes dropped EXE
      PID:3840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C8zEM.exe

Path C:\Users\Admin\AppData\Local\Temp\C8zEM.exe
Size 149KB
SHA256 5b5844a56447f961be43eb4a5664aeccdf1046300baee58ad6d6e1875ae6e30d
MD5 c55a9d44d88df9b9ce16f0321861e788
SHA1 b99f84a21e22ece33e5196ba0fe5d7c339e27f74
SHA512 d2979dafc3bb11a27aeda3089959a76bc94bf557680667ea8014b7b1786e5a2926edf1d009b735ca947e527ba85b840f019058e15c331c309140cfc75b65f4ca
SSDEEP 3072:vbuMGq4hOSOV7jsvEGcUL86tGm9GgGCnDugPMZmFOe:TGq4sHVvTGBGYXGCDun9e
TLSH
T141E3E135BA518435D06325704871E2B3A67B791227B942CBBBA81BBE6FB05C15E3C31F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3840-40-0x0000000000400000-0x000000000049D000-memory.dmp

Download