71ae5642681f8429459cd8acda92638bb2b7fbcb31178d1a0e24f3aa64e62009

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 10:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_e97af9b7a52ea23aa1c99f5ec3bef32d_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Size 149KB
Sample260802-mkd3fagp9w
SHA256 71ae5642681f8429459cd8acda92638bb2b7fbcb31178d1a0e24f3aa64e62009
MD5 e97af9b7a52ea23aa1c99f5ec3bef32d
SHA1 d258a04ce6af33a7854f4cd0ee59d464a88d268b
SHA512 b7bb1aa618adca1fceaa51df11dd0aa13cc3dbee8f30afbde229a8eb06deebbf9e49467a070df82fa536f9c5fb3cba26e30945b2d60e1ab8d69ead73acf1c050
SSDEEP 3072:vbuMGq4hOSOVfjsvDkt9j0HFaqe30V03MmGaVjEIBD0h:TGq4sHV7yi9uFpe30V03MiD4
TLSH
T1BBE3D0267A90C972D192323084B4A6F3A177B85127B845CFB7981FBE5E706C15E3C39B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2516	isHgc.exe
1540	2026-08-02_e97af9b7a52ea23aa1c99f5ec3bef32d_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
4208	2026-08-02_e97af9b7a52ea23aa1c99f5ec3bef32d_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1540 set thread context of 4208	1540	2026-08-02_e97af9b7a52ea23aa1c99f5ec3bef32d_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_e97af9b7a52ea23aa1c99f5ec3bef32d_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	isHgc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_e97af9b7a52ea23aa1c99f5ec3bef32d_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 2516	4292	2026-08-02_e97af9b7a52ea23aa1c99f5ec3bef32d_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	89
PID 2516 wrote to memory of 1540	2516	isHgc.exe	90
PID 1540 wrote to memory of 4208	1540	2026-08-02_e97af9b7a52ea23aa1c99f5ec3bef32d_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 1540 wrote to memory of 4208	1540	2026-08-02_e97af9b7a52ea23aa1c99f5ec3bef32d_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 1540 wrote to memory of 4208	1540	2026-08-02_e97af9b7a52ea23aa1c99f5ec3bef32d_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 1540 wrote to memory of 4208	1540	2026-08-02_e97af9b7a52ea23aa1c99f5ec3bef32d_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 1540 wrote to memory of 4208	1540	2026-08-02_e97af9b7a52ea23aa1c99f5ec3bef32d_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-02_e97af9b7a52ea23aa1c99f5ec3bef32d_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_e97af9b7a52ea23aa1c99f5ec3bef32d_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Users\Admin\AppData\Local\Temp\isHgc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-02_e97af9b7a52ea23aa1c99f5ec3bef32d_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe" 47kIKICy
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Users\Admin\AppData\Local\Temp\2026-08-02_e97af9b7a52ea23aa1c99f5ec3bef32d_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\isHgc.exe" VWBUqwGy
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1540
  - - C:\Users\Admin\AppData\Local\Temp\2026-08-02_e97af9b7a52ea23aa1c99f5ec3bef32d_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
      uVosMd3l
      4⤵
      Executes dropped EXE
      PID:4208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

isHgc.exe

Path C:\Users\Admin\AppData\Local\Temp\isHgc.exe
Size 149KB
SHA256 72ea08522510ded7340a2764134ef70ea9d14723163e242eab7e8fc2fc3b7669
MD5 7d9d81f2775c4f20f2943425d535df36
SHA1 ff83482896b140631dc076a515b08723a9549e8b
SHA512 33e4ba3f1dd4e659f84fad084461a9f8289875d36067c70efb1714b76cafcffe2c6f4285cf514c295f90be53dd582d4f1866c5317c936f36b7ee8b8a3b55364a
SSDEEP 3072:vbuMGq4hOSOVZjsvD7d4ifiQS+4/DgZ76WC1gaYak:TGq4sHVhQ5cj/scWC2aO
TLSH
T1E0E3DF29BA50D472D16722704975DAF3AA6B7962137840CBB79C0FBE5E302C14E3C76B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4208-40-0x0000000000400000-0x000000000049D000-memory.dmp

Download