1dd334bb4cbfbffdf931a6992bc2f82eb3d6e2ad42a70d530e25c43db31bef55

Analysis

max time kernel
149s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_542e50349e6ddcfedbf3fb6dd4ef775a_elex_rhadamanthys_smoke-loader.exe
Size 687KB
Sample260803-wtcemsde35
SHA256 1dd334bb4cbfbffdf931a6992bc2f82eb3d6e2ad42a70d530e25c43db31bef55
MD5 542e50349e6ddcfedbf3fb6dd4ef775a
SHA1 5a46fb963b56b1f77054afbe58a4ad64ee8b00e8
SHA512 034d8515ae441f4333b240b87792ca081d6a49bdcbcc6deab6f704a62336ccc8b225bf59f79f1d7732760d8d281d00c0b60056d33ef5e23a82dce875e14cb6c6
SSDEEP 12288:3kIS6tX/S/jzcunx10wAyNOXAGFFev7+0N1R9Dgec:3rX/qjzpnx10oNOXYvaKR97c
TLSH
T16EE4E02036C1C430E5A6423246AADF62547EFD768F649ECB77C82A1D5E702D1BB34B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4284	534B.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_542e50349e6ddcfedbf3fb6dd4ef775a_elex_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	534B.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4284	534B.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 4284	1800	2026-08-03_542e50349e6ddcfedbf3fb6dd4ef775a_elex_rhadamanthys_smoke-loader.exe	83

C:\Users\Admin\AppData\Local\Temp\2026-08-03_542e50349e6ddcfedbf3fb6dd4ef775a_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_542e50349e6ddcfedbf3fb6dd4ef775a_elex_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Users\Admin\AppData\Local\Temp\534B.tmp
  "C:\Users\Admin\AppData\Local\Temp\534B.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-03_542e50349e6ddcfedbf3fb6dd4ef775a_elex_rhadamanthys_smoke-loader.exe 016338822F197DFD03F884791B021FC8C8028F6D2AFDA93BE9CFB5447400CDFC0E6C5A4417D45EC2D11FC1B1D40EB50762A663D192DC4AC1E503D6D7D7E1E1CD
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

534B.tmp

Path C:\Users\Admin\AppData\Local\Temp\534B.tmp
Size 687KB
SHA256 279d8ff1eea18536b962dcc67be5fb8a2d5df3617e723566fd07f5d910e8c582
MD5 a69f6bf9c8d002d76f239fe032f22313
SHA1 644feb77847a429f78c46dc12a8f12fe08f6efbc
SHA512 7ba7a387a2cd01784bf9eb3e820b100359c0e46ff970df648e8057cfb913b6202d2a0427c7dbb097343c64bbc71967000807e2791b0ed1d499b3bf9cd33e18d0
SSDEEP 12288:3kIS6tXaAPh5j6VgJEg70pct6tEFev7+0N1R9Dgec:3rXD5OVwGet4EYvaKR97c
TLSH
T1ADE4E06075C2C430E1A7063246A6EE6254BEFD764FA09ECBB7C42A0D4E743D1A735B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1800-4-0x00000000009C0000-0x0000000000A6C000-memory.dmp

Download

memory/4284-5-0x00000000009A0000-0x0000000000A4C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads