633cba373870d3f148e8730a98b71a5aec6c3996291b2eebfdac69ff2d3ae4ea

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 00:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_6e48efd8caebb6f095d64f6a41c08884_elex_rhadamanthys_smoke-loader.exe
Size 687KB
Sample260802-at7pws1aqa
SHA256 633cba373870d3f148e8730a98b71a5aec6c3996291b2eebfdac69ff2d3ae4ea
MD5 6e48efd8caebb6f095d64f6a41c08884
SHA1 382482e71812c2f203a1b87d2d1cda05999f58e0
SHA512 20da0a049bd53e2e22e082a55ec2a2ed207b7aeda9587599c9f8cc5d2c7fbc2e2086f20f6bfbadc62919ebb7b08865c20845f0e0a4ce325cc5078bd253ee1de7
SSDEEP 12288:3kIS6tXgW8VskpPd9K+x9Pw3fKE1p/FV6Fev7+0N1R9Dgec:3rXUik5Qj1tP6YvaKR97c
TLSH
T193E4E05036D1C470E5E7063245A6EF63587EFD324FA4AECBA7C82A1D1A702D1A734B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2448	5BB3.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_6e48efd8caebb6f095d64f6a41c08884_elex_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5BB3.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2448	5BB3.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 2448	2624	2026-08-01_6e48efd8caebb6f095d64f6a41c08884_elex_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-01_6e48efd8caebb6f095d64f6a41c08884_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_6e48efd8caebb6f095d64f6a41c08884_elex_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Users\Admin\AppData\Local\Temp\5BB3.tmp
  "C:\Users\Admin\AppData\Local\Temp\5BB3.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-01_6e48efd8caebb6f095d64f6a41c08884_elex_rhadamanthys_smoke-loader.exe E200CC620B4BB882D1BBCE4345402485712C566E9ED06FCE846D2EE51616AD2A7C452E4ACDBDC9643D7FABB7108358872ACEA33E4E4FDB12EB6413D18BB0EAAD
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5BB3.tmp

Path C:\Users\Admin\AppData\Local\Temp\5BB3.tmp
Size 687KB
SHA256 1220dd01fe4d3df30f5acf83e81a5ffab6ac3dabfc940612a2a96349812f9452
MD5 10758b38ab8f9a2df4cc2e41ff1cce69
SHA1 07ac87c3021d003a9cdef7884360d57e1f969ea7
SHA512 c1cf70076b197b9ade24876234dc3010fb59803d2e2c15d41a77e3a43f2dedd4a3fc4e87a2607045243e3e06f5b9b0889738b421f3078af23dd5ee131b81713d
SSDEEP 12288:3kIS6tXYeZQIGu239m9h8nLWeBN0sWFev7+0N1R9Dgec:3rXBZQIGfcY1dWYvaKR97c
TLSH
T1E1E4E02036C1C430E5A7463256A9EF6344BEFD764FA0AECBB7C42A1D19706D0A735B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2448-6-0x0000000000110000-0x00000000001BC000-memory.dmp

Download

memory/2624-4-0x0000000000310000-0x00000000003BC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads