f81624807686bd67ed6f2df06d1f4c3551579a761c9a72a9c3a2e870b03a3ed3

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 13:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_83dd0b254877953d77978c4efb2278cd_amadey_elex_rhadamanthys_smoke-loader.exe
Size 1.1MB
Sample260801-qqbfaazxht
SHA256 f81624807686bd67ed6f2df06d1f4c3551579a761c9a72a9c3a2e870b03a3ed3
MD5 83dd0b254877953d77978c4efb2278cd
SHA1 25c0b7f67ad9353fea05e4bdf9b10efc78d386c4
SHA512 681778ff90635bd195d2e4b7c12363ae125a199fb5ee5529a3aa2a94bf061dc4389fcd1c7639cad22f916814608d35dba451b091560a6edb048aef4a05750ee6
SSDEEP 24576:S1A45BWLpBoMYHHXuPez2Ptb1Eh287K1eVpEuim0oL8F:S115UdBoMYHHXuPL12TosZ9Ly
TLSH
T11C351264E580C2F2D54604702E99CBF76D7A7D7127B69EC736EA1AA82C301C1E73271B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4120	5A4B.tmp

Executes dropped EXE 1 IoCs

pid	Process
4120	5A4B.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_83dd0b254877953d77978c4efb2278cd_amadey_elex_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5A4B.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4120	5A4B.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 4120	4864	2026-08-01_83dd0b254877953d77978c4efb2278cd_amadey_elex_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-01_83dd0b254877953d77978c4efb2278cd_amadey_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_83dd0b254877953d77978c4efb2278cd_amadey_elex_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Users\Admin\AppData\Local\Temp\5A4B.tmp
  "C:\Users\Admin\AppData\Local\Temp\5A4B.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-01_83dd0b254877953d77978c4efb2278cd_amadey_elex_rhadamanthys_smoke-loader.exe C8DF2429BD24DB886B34F436C2A6796D2A81E6D740529C91EA61EA73F4CB0961B6563AA0E0CFDC1D368289F3D1813AB4AA84403163D899091E242E2849D9C2A4
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5A4B.tmp

Path C:\Users\Admin\AppData\Local\Temp\5A4B.tmp
Size 1.1MB
SHA256 6f8ed65863f9801a92ee61adbb83ee4488560c8be826f4133121d5432ce468a9
MD5 43f34115a05f53dab737756b7568f411
SHA1 49690c27eaf652509ea7f183dabbc06ea3165a0f
SHA512 8bb413c5e6fba394e76db8b27a65bb0c8b942990aa638c41032b98527e530daeac586207aaf143e443b49ae8b1267563147335730f6a79d8b1583f5e6ca5a0ad
SSDEEP 24576:S1A45BWLpBoMYnWdpwz3+nRwValUM9gahp2e43R78BUo9m7j:S115UdBoMY9aamgUKCBUo9q
TLSH
T12C351268E590D2F3C54504719AAACBE72C793CB51B629EC332E90B3D3D211C2A73675B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads