c663a206a4977756a0db42202d564b9445e1e4b00d021c90ddda5a499107c426

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 03:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_15f085dd695ddf0b05131c206cf9e538_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Size 149KB
Sample260804-dxd4jacc42
SHA256 c663a206a4977756a0db42202d564b9445e1e4b00d021c90ddda5a499107c426
MD5 15f085dd695ddf0b05131c206cf9e538
SHA1 b0595380d82a2794050d673526a239ea21476556
SHA512 20835b0dcb7ab44b4c6b74ce810e90e482e75ce1863b85ad0f6c8a01f12ec5be3d70d78b80839e348359cc25f32642df493f88e27372d4445ae96c430a264dce
SSDEEP 3072:vbuMGq4hOSOVkjsvN9jubUl0FaDqJzteKTF4MNP+VXjp:TGq4sHVcUybUyFYqtte4mM4z
TLSH
T122E3E026B995C471D09225304AB5D6B3B26FB92167B805CBB7481FBE5F606C18E3C32F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
5388	JKoTI.exe
4636	2026-08-03_15f085dd695ddf0b05131c206cf9e538_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
3836	2026-08-03_15f085dd695ddf0b05131c206cf9e538_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4636 set thread context of 3836	4636	2026-08-03_15f085dd695ddf0b05131c206cf9e538_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_15f085dd695ddf0b05131c206cf9e538_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JKoTI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_15f085dd695ddf0b05131c206cf9e538_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 5388	912	2026-08-03_15f085dd695ddf0b05131c206cf9e538_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	89
PID 5388 wrote to memory of 4636	5388	JKoTI.exe	90
PID 4636 wrote to memory of 3836	4636	2026-08-03_15f085dd695ddf0b05131c206cf9e538_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 4636 wrote to memory of 3836	4636	2026-08-03_15f085dd695ddf0b05131c206cf9e538_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 4636 wrote to memory of 3836	4636	2026-08-03_15f085dd695ddf0b05131c206cf9e538_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 4636 wrote to memory of 3836	4636	2026-08-03_15f085dd695ddf0b05131c206cf9e538_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 4636 wrote to memory of 3836	4636	2026-08-03_15f085dd695ddf0b05131c206cf9e538_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-03_15f085dd695ddf0b05131c206cf9e538_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_15f085dd695ddf0b05131c206cf9e538_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:912
- C:\Users\Admin\AppData\Local\Temp\JKoTI.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-03_15f085dd695ddf0b05131c206cf9e538_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe" s5IfyVtj
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5388
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_15f085dd695ddf0b05131c206cf9e538_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\JKoTI.exe" EsYUte5E
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4636
  - - C:\Users\Admin\AppData\Local\Temp\2026-08-03_15f085dd695ddf0b05131c206cf9e538_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
      6kViogSx
      4⤵
      Executes dropped EXE
      PID:3836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

JKoTI.exe

Path C:\Users\Admin\AppData\Local\Temp\JKoTI.exe
Size 149KB
SHA256 a68435644f51995ada14651a423cc20230681f8155d54db2e416caa1b6b2338e
MD5 951f3564fe45fb7530bf59e66e1a95d0
SHA1 ecf045cff8347e0ab71520c01a3a23f127965ec8
SHA512 951b40f2541a30f7e781bd4238762a55ffe95d73acc0279b0f26652670e2469be1ad9a39d1432aed86f7b903ea6ce6d7e98189d522d26105a3ca8484d4076c68
SSDEEP 3072:vbuMGq4hOSOVRjsvbzxcHSd/q34UnAalx0KsKq:TGq4sHVZIC+XuAalxw
TLSH
T1DBE3D0257A91C031D56336705DB4A2F3A62B75A153B841CBB79D1BBE6E702C08F3932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3836-40-0x0000000000400000-0x000000000049D000-memory.dmp

Download