fbf31ddc3069f97f96cc77b3b8b5ac1f13dc5283b49803e6db34419f54fa608d

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 16:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_d1d1b44832ed3f24da2cb4f14c003abd_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Size 149KB
Sample260803-vcfkaswsbv
SHA256 fbf31ddc3069f97f96cc77b3b8b5ac1f13dc5283b49803e6db34419f54fa608d
MD5 d1d1b44832ed3f24da2cb4f14c003abd
SHA1 09f153ad81947cab6a108334e720096cfe096d21
SHA512 ceebde3fcf46bec38fba12d976c6d61519a6ca3f33bea2cd42198a4626c99b5c0c6f145a1defb891c4e59690a77cc0b066d2f1362112fbf16b14d45a6906e547
SSDEEP 3072:vbuMGq4hOSOV5jsvrBPG5h88F1X62K3kkjuSGbP:TGq4sHVBiBPGE8jFnSCP
TLSH
T15CE3D025B6A0D032D1A22A704C7496B3B66F75A117F905C77BA82FBD5F702C05E3836B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4364	BqhuI.exe
4752	2026-08-03_d1d1b44832ed3f24da2cb4f14c003abd_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
3468	2026-08-03_d1d1b44832ed3f24da2cb4f14c003abd_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4752 set thread context of 3468	4752	2026-08-03_d1d1b44832ed3f24da2cb4f14c003abd_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_d1d1b44832ed3f24da2cb4f14c003abd_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_d1d1b44832ed3f24da2cb4f14c003abd_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BqhuI.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 4364	4092	2026-08-03_d1d1b44832ed3f24da2cb4f14c003abd_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	89
PID 4364 wrote to memory of 4752	4364	BqhuI.exe	90
PID 4752 wrote to memory of 3468	4752	2026-08-03_d1d1b44832ed3f24da2cb4f14c003abd_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 4752 wrote to memory of 3468	4752	2026-08-03_d1d1b44832ed3f24da2cb4f14c003abd_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 4752 wrote to memory of 3468	4752	2026-08-03_d1d1b44832ed3f24da2cb4f14c003abd_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 4752 wrote to memory of 3468	4752	2026-08-03_d1d1b44832ed3f24da2cb4f14c003abd_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 4752 wrote to memory of 3468	4752	2026-08-03_d1d1b44832ed3f24da2cb4f14c003abd_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-03_d1d1b44832ed3f24da2cb4f14c003abd_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_d1d1b44832ed3f24da2cb4f14c003abd_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Users\Admin\AppData\Local\Temp\BqhuI.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-03_d1d1b44832ed3f24da2cb4f14c003abd_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe" KUZJO2RV
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4364
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_d1d1b44832ed3f24da2cb4f14c003abd_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\BqhuI.exe" 32mFGi2E
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4752
  - - C:\Users\Admin\AppData\Local\Temp\2026-08-03_d1d1b44832ed3f24da2cb4f14c003abd_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
      Xy5GFMQ3
      4⤵
      Executes dropped EXE
      PID:3468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BqhuI.exe

Path C:\Users\Admin\AppData\Local\Temp\BqhuI.exe
Size 149KB
SHA256 150a63bf3d3c8bbf1de58b4be25224a0d3da1564bb92b07a8522f40c1e93b9cc
MD5 791c474a50b58fe3d8bb16d3d0e3bbda
SHA1 7f451b298249927f35d5b8f7eb4b76984e2f8719
SHA512 73831d077acb64687b589258901eaf119a78ebcf4217ed2e9c8539953ad0bb10a4a496f5e7481794bed0e1037862ec1aea71b8f653ee3f234078c5fc5d8e0f82
SSDEEP 3072:vbuMGq4hOSOVhjsvK+qI9XpsBb3gly84intZWPmN:TGq4sHVpfqBpa3qx7tZmmN
TLSH
T10EE3E1297690D432D56326704C7096B2A1BBB59227B445DF7B881FBE4FB01C19F3C72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3468-40-0x0000000000400000-0x000000000049D000-memory.dmp

Download