9328e1aee8a20097e5c855041dca57eff96332b3bc1e40c6897fc9b92ae2b27a

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 14:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_bc21d3331b817b745ae6001de2f2d18b_elex_rhadamanthys_smoke-loader.exe
Size 687KB
Sample260804-rqqewasfjf
SHA256 9328e1aee8a20097e5c855041dca57eff96332b3bc1e40c6897fc9b92ae2b27a
MD5 bc21d3331b817b745ae6001de2f2d18b
SHA1 9c4bf5b58845c745e124c855fdcfa2fa6ab53ef0
SHA512 54ee00c01ea218b6b843d4e077e4c09f4c2654ab6efa9d64b40f7089d61c728b42d65e89217c8db3f2f973431382cc304a02e99417333bb27d009d0df89bfce3
SSDEEP 12288:3kIS6tXYGr/YPQWr+LBi1Fev7+0N1R9Dgec:3rXVYQE1YvaKR97c
TLSH
T1C0E4E01035D1C430E5A706324AA9DE62487EFD724F60AACBB7C82A1D5E743D1EB74B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3192	44CF.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_bc21d3331b817b745ae6001de2f2d18b_elex_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	44CF.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3192	44CF.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4488 wrote to memory of 3192	4488	2026-08-04_bc21d3331b817b745ae6001de2f2d18b_elex_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-04_bc21d3331b817b745ae6001de2f2d18b_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_bc21d3331b817b745ae6001de2f2d18b_elex_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4488
- C:\Users\Admin\AppData\Local\Temp\44CF.tmp
  "C:\Users\Admin\AppData\Local\Temp\44CF.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-04_bc21d3331b817b745ae6001de2f2d18b_elex_rhadamanthys_smoke-loader.exe 1076E1704DD1F6B9C1C6F0F076C99EAF925C67919533A9E8DA81BE047694F54540B72F7C0C6E5CBC0BD609A89F1C482083AC6BBF90193E20C18ABDED24BF1B5C
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

44CF.tmp

Path C:\Users\Admin\AppData\Local\Temp\44CF.tmp
Size 687KB
SHA256 8237c7b73bc50f681c8029ade496eefa89d2376cbb18e4e48a8d778157727b46
MD5 49a156b648baff5b6f201686e6492e4f
SHA1 61093a00eee622d26351f981e03b4076a935aced
SHA512 49b59b520195f9f80d4de97c91243630422e68bdcf2838f3a214e62ce0b55c9fc76d4dfdcd55e74e1ae46fc1a5e7eb983405c3f37760961ae39f45b07b7677ac
SSDEEP 12288:3kIS6tXT5RuU7EpVL51EoYnwow7Fev7+0N1R9Dgec:3rXTWDVLr5ogYvaKR97c
TLSH
T1C6E4E01476C1C030E5E7063256AADE6658BEFD324FA09ECBB7D45A1D2E342D1B634B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3192-6-0x0000000000200000-0x00000000002AC000-memory.dmp

Download

memory/4488-4-0x00000000006D0000-0x000000000077C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads