54e662a8dedfba0fff8e60e9dd4b498444b7075d46b7f48b769a763b30c887c9

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 10:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_f2ce934937b0b65a0c910e0db4996ebc_elex_rhadamanthys_smoke-loader.exe
Size 687KB
Sample260803-mtkxcagb96
SHA256 54e662a8dedfba0fff8e60e9dd4b498444b7075d46b7f48b769a763b30c887c9
MD5 f2ce934937b0b65a0c910e0db4996ebc
SHA1 8dc23b44684f654c70fc392a693943dddb0f8963
SHA512 d26af1ab86796a8a3d7fe9a5841984475aa34dc6746c018c1820310b22992a0c86679859328ab6896040e91b73b4e3339b030b69b262cbd2c7a6201a41cd4e95
SSDEEP 12288:3kIS6tX7RfqZBV3hYi4/EAGL1P9Nvva6tFev7+0N1R9Dgec:3rX7Ryoi4/EAGbNvvaoYvaKR97c
TLSH
T174E4E02036C1C470E6A6063256A9DF6244BEFD710FA09ECB77C82A1D5E703D1AB75B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2028	C9CE.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_f2ce934937b0b65a0c910e0db4996ebc_elex_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C9CE.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2028	C9CE.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5824 wrote to memory of 2028	5824	2026-08-03_f2ce934937b0b65a0c910e0db4996ebc_elex_rhadamanthys_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-03_f2ce934937b0b65a0c910e0db4996ebc_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_f2ce934937b0b65a0c910e0db4996ebc_elex_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5824
- C:\Users\Admin\AppData\Local\Temp\C9CE.tmp
  "C:\Users\Admin\AppData\Local\Temp\C9CE.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-03_f2ce934937b0b65a0c910e0db4996ebc_elex_rhadamanthys_smoke-loader.exe 1355E71DCC5218334B85362C0A0BC1C373EA7E15C5677C449EB1ACBD8D63E8E2EF2A96EF5825BBEC8E16AB0F6C877ACFE47287E4A7351F284628C2752672F4BF
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C9CE.tmp

Path C:\Users\Admin\AppData\Local\Temp\C9CE.tmp
Size 687KB
SHA256 9cecb63e919e488d2adc8fd9f88daa2162921f322562bcb906ea94096f569291
MD5 5920a4001155b18652bb354709211806
SHA1 c1392af2bd97120de3702ebd7f638d6c4c3ecf75
SHA512 dbf6f9de0c380314a22374dc70cccaf09aeab2e43712acb48f70439abc7c732a4dd6af11aeef062047ebc3363bc0b3f158cfd5ad37082f7b49335022b1c6fd6a
SSDEEP 12288:3kIS6tXqfcpNVWxiR737mYXcEJhFev7+0N1R9Dgec:3rX3NoY73tXcsYvaKR97c
TLSH
T1C0E4E02076C1C430E5A7063256AADE62547EFD724FA1AECBB7C82A1D1D702D1A731B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2028-6-0x0000000000F20000-0x0000000000FCC000-memory.dmp

Download

memory/5824-4-0x00000000006D0000-0x000000000077C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads