3140bd89b7ba6444720727a62f09b81645d74c69dc3849595944f4b368ba314e

Analysis

max time kernel
150s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 05:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_9ee1d5258323ca206db7eac9e4b63a5c_elex_rhadamanthys_smoke-loader.exe
Size 687KB
Sample260802-gd28sstwdv
SHA256 3140bd89b7ba6444720727a62f09b81645d74c69dc3849595944f4b368ba314e
MD5 9ee1d5258323ca206db7eac9e4b63a5c
SHA1 94279ea40102cb0e5709d80d259eb6e7e438c0f5
SHA512 b96ed1f7be72cb7f2ca8a059ac7eb8bf6be90ed13aa3c1a1562b4e16f9a5ebda8d290672bf24112602246da27f39453c57b78963a42469d402fdb6e92d9ec0ee
SSDEEP 12288:3kIS6tX4Zc6tKm5Z7v3JT6C4l4qFev7+0N1R9Dgec:3rXIb37v3JT6/6qYvaKR97c
TLSH
T193E4E02476C1C430E5A7063256AADF66487EFD720F609ECBB7C82A1D5D706C1AB31B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2336	F0B4.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_9ee1d5258323ca206db7eac9e4b63a5c_elex_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F0B4.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2336	F0B4.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 2336	4700	2026-08-02_9ee1d5258323ca206db7eac9e4b63a5c_elex_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-02_9ee1d5258323ca206db7eac9e4b63a5c_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_9ee1d5258323ca206db7eac9e4b63a5c_elex_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Users\Admin\AppData\Local\Temp\F0B4.tmp
  "C:\Users\Admin\AppData\Local\Temp\F0B4.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-02_9ee1d5258323ca206db7eac9e4b63a5c_elex_rhadamanthys_smoke-loader.exe 588E92B187EC42AB4C7C16FD73B7AD49059BC395BBD1C92F87CE048F9069B816FADD4096445F3DB9F19A0E8B84C840BFE5285EAB35C4A14B7FACF0C33EC7ACF9
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F0B4.tmp

Path C:\Users\Admin\AppData\Local\Temp\F0B4.tmp
Size 687KB
SHA256 ddb239efd85895a104f6840848d5fccec6cfef3dd494fceadb8da82ec99a51cd
MD5 d1e81dc238363f51cf1d6e5603e0a116
SHA1 23f0f76173209895c77878411ab361e44cad576c
SHA512 ea9f276eb8e4ad21dec73352d3caa57c2c38c9227b616f28989852eb91ffb86c43bce9b42f926fd0147c7aba6003ff627eb094340bb4e1206a553b6a96eeff88
SSDEEP 12288:3kIS6tXeNpAk97PVwEOZ6f+MCk7EPFev7+0N1R9Dgec:3rX697tdOZcKEgYvaKR97c
TLSH
T1F4E4D02036C1C030E5A706324AA6DF67447EFD724FA09ADBB7C82A1D1A746D1B735B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2336-6-0x0000000000A10000-0x0000000000ABC000-memory.dmp

Download

memory/4700-4-0x0000000000100000-0x00000000001AC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads