1dd334bb4cbfbffdf931a6992bc2f82eb3d6e2ad42a70d530e25c43db31bef55

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_542e50349e6ddcfedbf3fb6dd4ef775a_elex_rhadamanthys_smoke-loader.exe
Size 687KB
Sample260803-wtcemsde35
SHA256 1dd334bb4cbfbffdf931a6992bc2f82eb3d6e2ad42a70d530e25c43db31bef55
MD5 542e50349e6ddcfedbf3fb6dd4ef775a
SHA1 5a46fb963b56b1f77054afbe58a4ad64ee8b00e8
SHA512 034d8515ae441f4333b240b87792ca081d6a49bdcbcc6deab6f704a62336ccc8b225bf59f79f1d7732760d8d281d00c0b60056d33ef5e23a82dce875e14cb6c6
SSDEEP 12288:3kIS6tX/S/jzcunx10wAyNOXAGFFev7+0N1R9Dgec:3rX/qjzpnx10oNOXYvaKR97c
TLSH
T16EE4E02036C1C430E5A6423246AADF62547EFD768F649ECB77C82A1D5E702D1BB34B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1168	75F1.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	75F1.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_542e50349e6ddcfedbf3fb6dd4ef775a_elex_rhadamanthys_smoke-loader.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1168	75F1.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 1168	4580	2026-08-03_542e50349e6ddcfedbf3fb6dd4ef775a_elex_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-03_542e50349e6ddcfedbf3fb6dd4ef775a_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_542e50349e6ddcfedbf3fb6dd4ef775a_elex_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Users\Admin\AppData\Local\Temp\75F1.tmp
  "C:\Users\Admin\AppData\Local\Temp\75F1.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-03_542e50349e6ddcfedbf3fb6dd4ef775a_elex_rhadamanthys_smoke-loader.exe 4723885F5E01DC57480E0FA24F1B0DC66428C9C08B3B77C0F9ED4861B58FB74337FC3F7D7DC9E7BEC5EB49E133C110D0262E7B05E32B8A6E77B9E060D569EDAD
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

75F1.tmp

Path C:\Users\Admin\AppData\Local\Temp\75F1.tmp
Size 687KB
SHA256 3043d97434202c1cc872a7adaed93b044592f189f8126c4b4cfdabbd67bbc0a2
MD5 a4518194f5e09a837d976d062478d4b3
SHA1 4f6a2e4c1bb41a24a6b135df97a64616b376e13d
SHA512 e3801f807cf422be55880483660604a9e8d47b344c3d541f30f660e70a622364a9cc3a93e4c41fec1a55f61ab434e5d105ded34734682f7121219be43a7f9593
SSDEEP 12288:3kIS6tX5mcFgMrfaeJ0+LdNoFev7+0N1R9Dgec:3rX5fFtfhJ02qYvaKR97c
TLSH
T133E4E01036D1C430E6A742324AAADF63587EFD324F649ACB77C86A1D1A703D1A735B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1168-6-0x0000000000090000-0x000000000013C000-memory.dmp

Download

memory/4580-4-0x0000000000440000-0x00000000004EC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads