Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/08/2026, 03:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-01_6b217480cbb43e20c78a5416e056f832_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_6b217480cbb43e20c78a5416e056f832_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 2026-08-01_6b217480cbb43e20c78a5416e056f832_amadey_elex_rhadamanthys_smoke-loader_stop.exe
- Size 3.9MB
- Sample260801-dpdssscg64
- SHA256 4494effa532825020913199b706ea4a762501716dc9abe26985ebe40f1d6d6aa
- MD5 6b217480cbb43e20c78a5416e056f832
- SHA1 01fe658888f20b0346ebbc0524ec0a32b703cc94
- SHA512 f520cb8b9e7ffd710d30d09a2d936cf15f03f848c757c1c881d6ace95b6f38fb4f04ea9c8fcf13b5235fca1cd88635256b2c33f89a88167b2ca99fbb7f18d279
- SSDEEP 98304:yHZEUgZD6NiHhGnO1UXD/OT4ZXzfad+RvdRICkgV:yHZI6qMnO12D/OcZDyd+VdSuV
- TLSH T18F1633BD6C1950E2EF764EBC0E6E599438FACC26327EC512E6A008C645E525E373D21F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 5 IoCs
resource yara_rule behavioral2/memory/4240-0-0x00000000029E0000-0x0000000002D6A000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4240-1-0x00000000029E0000-0x0000000002D6A000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4240-3-0x00000000029E0000-0x0000000002D6A000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4240-2-0x00000000029E0000-0x0000000002D6A000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4240-4-0x00000000029E0000-0x0000000002D6A000-memory.dmp INDICATOR_EXE_Packed_ASPack - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-01_6b217480cbb43e20c78a5416e056f832_amadey_elex_rhadamanthys_smoke-loader_stop.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4240 2026-08-01_6b217480cbb43e20c78a5416e056f832_amadey_elex_rhadamanthys_smoke-loader_stop.exe 4240 2026-08-01_6b217480cbb43e20c78a5416e056f832_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_6b217480cbb43e20c78a5416e056f832_amadey_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_6b217480cbb43e20c78a5416e056f832_amadey_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4240