f99600ef5e9edb9421ea0a1b40c843632c0a2e9b4c2227de77616aec26f3bd3b

Analysis

max time kernel
148s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_3c329944a8db54ea302cb9698d317b04_elex_rhadamanthys_smoke-loader.exe
Size 687KB
Sample260804-tlavqsdd54
SHA256 f99600ef5e9edb9421ea0a1b40c843632c0a2e9b4c2227de77616aec26f3bd3b
MD5 3c329944a8db54ea302cb9698d317b04
SHA1 3537294bca24878452d07039361a7120e696eb04
SHA512 b2036a81dda974f714fe111c2fd7aa05fa9ef78c6208a209609f540752ac1537f0abbbdd28d7936c24bd8bbb629a57f811e07d78e9ca8f27c0ff3a4935090fe8
SSDEEP 12288:3kIS6tX84FUqLetGhhQe9eU2B8/1Efl3Fev7+0N1R9Dgec:3rX8u9qtGhCeZdEfl3YvaKR97c
TLSH
T183E4E01036C1C070E5A7063256A9DF62547EFD724FA0AACBB7C86A1D1E707D0AB74B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5012	48A.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_3c329944a8db54ea302cb9698d317b04_elex_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	48A.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5012	48A.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 5012	4588	2026-08-04_3c329944a8db54ea302cb9698d317b04_elex_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-04_3c329944a8db54ea302cb9698d317b04_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_3c329944a8db54ea302cb9698d317b04_elex_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Users\Admin\AppData\Local\Temp\48A.tmp
  "C:\Users\Admin\AppData\Local\Temp\48A.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-04_3c329944a8db54ea302cb9698d317b04_elex_rhadamanthys_smoke-loader.exe 4D2C0D39581CBC4DF295F59F33F46B718674E9CB580623795B28F4B534D9AB1401F423E7D7B7632C4304F25CED7F237B17D8DE1423EFF73D185A66198CAF3FF2
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

48A.tmp

Path C:\Users\Admin\AppData\Local\Temp\48A.tmp
Size 687KB
SHA256 e8782f5c31255f713859476fe2768131d8c4ad6cea91c509d74299a5780db47d
MD5 62d373797ab9c98f2ff63bd3dd955113
SHA1 9c3105dc0b563cebfd9db2956cab2d8d22159d25
SHA512 787b3c67ac13fa08d07a5dca809816c7e7f58831b956ace123da4dfd682894726a48e288779dee58fa192b634c7ccfdd4b7cc1f14ba06cfc242059c25f0141b9
SSDEEP 12288:3kIS6tX8wFHDDAvR03h0PDhkg+M9zgWhFev7+0N1R9Dgec:3rXvDwR0xUDLphYvaKR97c
TLSH
T16DE4E02075C1C470E5AB463646A9EF63447EFD324F609ECBB7C82A1E5A702D1A731B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4588-4-0x0000000000DD0000-0x0000000000E7C000-memory.dmp

Download

memory/5012-6-0x0000000000CF0000-0x0000000000D9C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads