03a717ee0132744c5269c95219cb59615a4aa522657d5839c4f5907fb5df08b0

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 18:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_127bfd4650396cac6339cb864e9adc2f_amadey_elex_rhadamanthys_smoke-loader.exe
Size 1.2MB
Sample260803-xj48caeb54
SHA256 03a717ee0132744c5269c95219cb59615a4aa522657d5839c4f5907fb5df08b0
MD5 127bfd4650396cac6339cb864e9adc2f
SHA1 fea6ba8e05fc12499813f43b308c6e459d511c67
SHA512 dc1f5a23f1472e9e6cbd5c95b54ebf6f2124ee742adaf35023a89cff340df8b443e62bbf71eacb5d7f853d85a4ac64248f68492391a21fe033b78434b86654b4
SSDEEP 24576:7UIcfl8Fl531HdOllfUM4zj8sx/pvuNpktFmbxM/r/gjTb:7Ws1HdOm8I/pv2ktFmlIcjTb
TLSH
T180451264A990C2F2C58A54B05F5ADBF66D243C351A11AEC732DD3A7E7E702C06B72327
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5344	31B5.tmp

Executes dropped EXE 1 IoCs

pid	Process
5344	31B5.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_127bfd4650396cac6339cb864e9adc2f_amadey_elex_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	31B5.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5344	31B5.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 5344	5016	2026-08-03_127bfd4650396cac6339cb864e9adc2f_amadey_elex_rhadamanthys_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-03_127bfd4650396cac6339cb864e9adc2f_amadey_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_127bfd4650396cac6339cb864e9adc2f_amadey_elex_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Users\Admin\AppData\Local\Temp\31B5.tmp
  "C:\Users\Admin\AppData\Local\Temp\31B5.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-03_127bfd4650396cac6339cb864e9adc2f_amadey_elex_rhadamanthys_smoke-loader.exe 10733609CA98E8CF01DED62F44191E77D2CE6A8A6A7CC2E3CEDE89FFD73B404D6E187C7DB775764F6899C99EBFA437855EC943DC181BD66984A01544977A20C7
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

31B5.tmp

Path C:\Users\Admin\AppData\Local\Temp\31B5.tmp
Size 1.2MB
SHA256 1db021c4ee5ede146398d9f258e67bda6190aa97e4a06b46154455d17b7cd9e5
MD5 3cf421b41fd59cbcf745520102a32cf6
SHA1 6b92fafed44a49cf776495323a0a85d9fde4d647
SHA512 f27d003cb1b7eb8c2b4baae78a8beb3e552bd0cdbdd1c63950b977b58a857e63492d97ddd9e1c94905d1fcb4b27f012b1657199fa68befbc7e4407c3b2c16e9f
SSDEEP 24576:7UIcfl8Fl531HorvGbKIuNSYRaFGEzYoewHABjbY6ql3cL7WYgjTb:7Ws1HoDI8kYRaBpjgxbY6hL7WRjTb
TLSH
T103451265A5A0C2B7C14A44708A5ACBFB6D353C394A629FC732DD3A397D712C0B67231B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads