09597d8458bc361059b82a9982e258f131e962f7af399cb60027355fe2dec261

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 14:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_c115fc4f1f6dd03c308b3db6b5205531_amadey_elex_rhadamanthys_smoke-loader.exe
Size 1.2MB
Sample260804-rmf22ayzaw
SHA256 09597d8458bc361059b82a9982e258f131e962f7af399cb60027355fe2dec261
MD5 c115fc4f1f6dd03c308b3db6b5205531
SHA1 a560a03f971a9199d830f48774c4964cabbcc209
SHA512 83ee8aec0388546c684341c7dfd0ce29df059549470d708aafcbeb6dc0e7ba0ad9d4f76bbed1dee82305e466f6f46ade23a26e7714e2edf0b9663d8dda2550ce
SSDEEP 24576:7UIcfl8Fl531HGZlSXziXzj7zDOpoFRmKaHXTln4QgjTb:7Ws1HG6XzQzOpoFRLUxn4JjTb
TLSH
T1FE451264A6A1C3B6C54A04308A2BCBF9AD353D3947119EC736E83A6D7D702C1773276B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2736	7A95.tmp

Executes dropped EXE 1 IoCs

pid	Process
2736	7A95.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_c115fc4f1f6dd03c308b3db6b5205531_amadey_elex_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7A95.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2736	7A95.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5816 wrote to memory of 2736	5816	2026-08-04_c115fc4f1f6dd03c308b3db6b5205531_amadey_elex_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-04_c115fc4f1f6dd03c308b3db6b5205531_amadey_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_c115fc4f1f6dd03c308b3db6b5205531_amadey_elex_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5816
- C:\Users\Admin\AppData\Local\Temp\7A95.tmp
  "C:\Users\Admin\AppData\Local\Temp\7A95.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-04_c115fc4f1f6dd03c308b3db6b5205531_amadey_elex_rhadamanthys_smoke-loader.exe D05B4978B583BA83B978D9EA5389CBC0CE209D253C7A5979C108212BC4FC13B3615A046A40A88A84EBFFD5C3310905D58782A191DF21B35DE282932BD29D4776
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7A95.tmp

Path C:\Users\Admin\AppData\Local\Temp\7A95.tmp
Size 1.2MB
SHA256 a45442f1cbed7aed4b6167e6558ca8b869e430bf0022c1dc3293c51d15603a45
MD5 174a112c5fa8c48e748018618c3dcb20
SHA1 b911e0811720c270bb649506ffaac63040de9ffb
SHA512 6d58f27cff8a03ec5f9a5fc6969a254a89b192ffcb432fc16157b3097cd3785d4a6214c2969ac4fc7fb631773a741a51adae2482765f0461c0bfa1435cd67ef1
SSDEEP 24576:7UIcfl8Fl531H74DM6xMPXW8AfKW2CKwjDYflZecht/6Wr5EZtgjTb:7Ws1H7wM6qWNKqPu6W9EAjTb
TLSH
T16F451265A990C2F7D50650718B2ADBE66D253D3A4A218EC733ED3A2D7D342C0BB36713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads