0902583ad87f6d9049bbc61d03e38baaebb7d9c71aff6cfddf8d727ef3c074f0

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 13:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_013d63daed0d5c6fbafd58a12a78d30d_elex_rhadamanthys_smoke-loader.exe
Size 687KB
Sample260804-qhkc8a1fmb
SHA256 0902583ad87f6d9049bbc61d03e38baaebb7d9c71aff6cfddf8d727ef3c074f0
MD5 013d63daed0d5c6fbafd58a12a78d30d
SHA1 0977b21b422849970a744eeb277ca236bee7401a
SHA512 39aadcaf34fdf6dbcb6f0da522184fb0f5481261e78a65312394d73458469282496555328ca34617a0a3f09121c291cfb3a47e39e51cef393ad4a36920b39959
SSDEEP 12288:3kIS6tXykn/dm1sr/jIUnpFev7+0N1R9Dgec:3rXZn/dMsr/rnpYvaKR97c
TLSH
T172E4E02076C1C070E5A7063256A9EF62587EFD724FA09ACBB7C85A1D1A703D1A731B73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2812	FE31.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_013d63daed0d5c6fbafd58a12a78d30d_elex_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FE31.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2812	FE31.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5288 wrote to memory of 2812	5288	2026-08-03_013d63daed0d5c6fbafd58a12a78d30d_elex_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-03_013d63daed0d5c6fbafd58a12a78d30d_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_013d63daed0d5c6fbafd58a12a78d30d_elex_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5288
- C:\Users\Admin\AppData\Local\Temp\FE31.tmp
  "C:\Users\Admin\AppData\Local\Temp\FE31.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-03_013d63daed0d5c6fbafd58a12a78d30d_elex_rhadamanthys_smoke-loader.exe E6D5DA1C6590F34950EA3745A93D25092A8E4C9F4FD3B7047A90F052F33595E337427107BE57DFE0B5DCD5434C22501A2D3D562D34C05426D27DD1A145A860EB
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FE31.tmp

Path C:\Users\Admin\AppData\Local\Temp\FE31.tmp
Size 687KB
SHA256 a7bd67e54f5e12e9be834a026c66d829bd5cc60e202831539707d14dda95d0ec
MD5 62e10210fee28e024a2b456d7dc3f765
SHA1 58baffe4ea7b67391cbef004fc89d040e6e3a10d
SHA512 9e6a2c8f1b40b37a6bc26a239c0f96c3c4e73e391881d4d05b8288f2ea958d56042b8f185eb140c3d0309e51715d4e3fbd778bcedbbded0324540c6cb5508365
SSDEEP 12288:3kIS6tXd4r0sZGcYHw4Ck2zRJ6Fev7+0N1R9Dgec:3rXd3aGcYQbvzRJ6YvaKR97c
TLSH
T1E1E4E02036C1C070E5A7063256AADF6254BEFD724F909ACB77C86B1D0E742D1AB35B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2812-6-0x0000000000A30000-0x0000000000ADC000-memory.dmp

Download

memory/5288-4-0x0000000000940000-0x00000000009EC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads