42510fa6c833a2f02c0027959d7185aaf279638a79def367fd99fc65df1884e9

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 19:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_934712b19d0411e8fb5493ff97a46b27_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Size 149KB
Sample260804-xxqbcaff42
SHA256 42510fa6c833a2f02c0027959d7185aaf279638a79def367fd99fc65df1884e9
MD5 934712b19d0411e8fb5493ff97a46b27
SHA1 8e2d97145f86a07ea746df95b5982391b4f4777b
SHA512 874bf6ac9203744013d413c352328b8ba165be6216aba4f158a85f07aa41c2e3f15739e74203e70580478622762b1a17daf90d1062e4a592bdb5e8125c546200
SSDEEP 3072:vbuMGq4hOSOVWjsv2gcXRECU6yWIjyymQkPMFjl:TGq4sHVaEPlmHqx
TLSH
T160E3E0317590E832E163267058B5D6F2662E7491277941CFB79C2FBE9E702C19E3832B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4104	7l6cf.exe
3336	2026-08-04_934712b19d0411e8fb5493ff97a46b27_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
4484	2026-08-04_934712b19d0411e8fb5493ff97a46b27_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3336 set thread context of 4484	3336	2026-08-04_934712b19d0411e8fb5493ff97a46b27_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_934712b19d0411e8fb5493ff97a46b27_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7l6cf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_934712b19d0411e8fb5493ff97a46b27_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 4104	2812	2026-08-04_934712b19d0411e8fb5493ff97a46b27_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	89
PID 4104 wrote to memory of 3336	4104	7l6cf.exe	90
PID 3336 wrote to memory of 4484	3336	2026-08-04_934712b19d0411e8fb5493ff97a46b27_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 3336 wrote to memory of 4484	3336	2026-08-04_934712b19d0411e8fb5493ff97a46b27_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 3336 wrote to memory of 4484	3336	2026-08-04_934712b19d0411e8fb5493ff97a46b27_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 3336 wrote to memory of 4484	3336	2026-08-04_934712b19d0411e8fb5493ff97a46b27_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 3336 wrote to memory of 4484	3336	2026-08-04_934712b19d0411e8fb5493ff97a46b27_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-04_934712b19d0411e8fb5493ff97a46b27_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_934712b19d0411e8fb5493ff97a46b27_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Users\Admin\AppData\Local\Temp\7l6cf.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-04_934712b19d0411e8fb5493ff97a46b27_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe" gSZXr1Gw
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4104
- - C:\Users\Admin\AppData\Local\Temp\2026-08-04_934712b19d0411e8fb5493ff97a46b27_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\7l6cf.exe" c9AiALIU
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3336
  - - C:\Users\Admin\AppData\Local\Temp\2026-08-04_934712b19d0411e8fb5493ff97a46b27_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
      JKZMsHI1
      4⤵
      Executes dropped EXE
      PID:4484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7l6cf.exe

Path C:\Users\Admin\AppData\Local\Temp\7l6cf.exe
Size 149KB
SHA256 1e5e81b14bc9dee9412608426d5ae1324a172dbeec38979930f00ccd9442c47d
MD5 fd98fd34c3eb9f01f3f6fb47bc626806
SHA1 d4ccfdf0e6766354e2a782d84b43a3d399f1be91
SHA512 eed31d22b0c922fcece530491e184b994b3fd4392e9fbab3cf0e500e6bd20bc3e8e28680effb95fa81d37fcecdcc007ceb4a89d8db8f79ba8a54e46d6de594bf
SSDEEP 3072:vbuMGq4hOSOVxjsvEmsjlxQ/ajaJ1+gindzzwMC/b:TGq4sHV51zBxQua+DdPwf/b
TLSH
T1ABE3E022B741D435E26226705871D6B3616FB96123B941CBB7991FBE4EB02C09F3836F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4484-40-0x0000000000400000-0x000000000049D000-memory.dmp

Download