78c61f6d6d0bbbc44bbe96997d82853a116c3e065df8968b8cc22dd38e10f8b9

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 21:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_038187000434fc0723a76be053165575_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Size 149KB
Sample260804-1ane1sen3s
SHA256 78c61f6d6d0bbbc44bbe96997d82853a116c3e065df8968b8cc22dd38e10f8b9
MD5 038187000434fc0723a76be053165575
SHA1 058d33e75d87ba8984194e849070c6a0f3c5423a
SHA512 84dde5b0a4c17f19f92fef5ed4953e94e03dc46c8a5cc0240d43cc3efbb60de2129957d43461eae3a3b362d04800cd2c56a2a49042a8ec9c20c3ca35f6230896
SSDEEP 3072:vbuMGq4hOSOVgjsvOvBLd7w1hEASNbtLtjWEqgXazq68BBIKdVb+0:TGq4sHVgldZASNGEqSG9YCKdI0
TLSH
T115E3E025BA91C836E06326700CB0D6F6A56775A217B842CB77891FBE4F603C15F3836B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2876	Gf6vf.exe
3776	2026-08-04_038187000434fc0723a76be053165575_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
5660	2026-08-04_038187000434fc0723a76be053165575_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3776 set thread context of 5660	3776	2026-08-04_038187000434fc0723a76be053165575_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_038187000434fc0723a76be053165575_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gf6vf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_038187000434fc0723a76be053165575_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5320 wrote to memory of 2876	5320	2026-08-04_038187000434fc0723a76be053165575_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	89
PID 2876 wrote to memory of 3776	2876	Gf6vf.exe	90
PID 3776 wrote to memory of 5660	3776	2026-08-04_038187000434fc0723a76be053165575_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 3776 wrote to memory of 5660	3776	2026-08-04_038187000434fc0723a76be053165575_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 3776 wrote to memory of 5660	3776	2026-08-04_038187000434fc0723a76be053165575_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 3776 wrote to memory of 5660	3776	2026-08-04_038187000434fc0723a76be053165575_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 3776 wrote to memory of 5660	3776	2026-08-04_038187000434fc0723a76be053165575_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-04_038187000434fc0723a76be053165575_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_038187000434fc0723a76be053165575_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5320
- C:\Users\Admin\AppData\Local\Temp\Gf6vf.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-04_038187000434fc0723a76be053165575_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe" 4zVF5JJ3
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2876
- - C:\Users\Admin\AppData\Local\Temp\2026-08-04_038187000434fc0723a76be053165575_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\Gf6vf.exe" oWD9E6uR
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3776
  - - C:\Users\Admin\AppData\Local\Temp\2026-08-04_038187000434fc0723a76be053165575_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
      qBSSvGjb
      4⤵
      Executes dropped EXE
      PID:5660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Gf6vf.exe

Path C:\Users\Admin\AppData\Local\Temp\Gf6vf.exe
Size 149KB
SHA256 6d044c9fdd3f0c67e6927be9cd90fadb35374c94f911f2d9c31cc76f47fe04b0
MD5 aa38ac9bd989fb9b6b61b193c9f20fab
SHA1 0928d511f06cbac64e5100d13221c74b34dee5f8
SHA512 c6e47917d2a38cd3c604e6a4c03cba749fef3222217d027f99e5295c5912e0412d781abb2e0f86409e1073d61655656a24008260b1a537cc9ede86daab25f1e6
SSDEEP 3072:vbuMGq4hOSOV9jsv1rs6zgUDdy2QicD+tkAo8+ZeVHn:TGq4sHVNs46zgYI2K+7vZ
TLSH
T176E3E011BDA09472E05366705871D7B2A66A791213B946CBBB981FBE1F703C09E3872F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5660-40-0x0000000000400000-0x000000000049D000-memory.dmp

Download