9ddf75d6eef7036fa2b074c8f7fc1cdbf41a5be8b7956efc54dfd7b7c5c1fa10

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 20:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_21e2a0c8e088483494a9dec67c67492c_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Size 149KB
Sample260804-zry3eazene
SHA256 9ddf75d6eef7036fa2b074c8f7fc1cdbf41a5be8b7956efc54dfd7b7c5c1fa10
MD5 21e2a0c8e088483494a9dec67c67492c
SHA1 538131003d4670d58615412668c1a24a89a51bdd
SHA512 dfe7697d3c6d6591394ed76fb239139555230710e0c7c09b1d1d47ba18adbc439373821f32948f0c5061c6cb9954d28f4049b4011422a0728779e7e5d855adb5
SSDEEP 3072:vbuMGq4hOSOVdjsviYnsYgWCWJ2J59rMgtQBZkXr+sXFVmboNww5v:TGq4sHVtNQsYtB2/MLZ9sVVFZv
TLSH
T111E3E0217A91C872D16226B00D7197B3A65BB452277842CBBB891FBD8F706C09F3C35B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2360	ZLRta.exe
3644	2026-08-04_21e2a0c8e088483494a9dec67c67492c_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
4200	2026-08-04_21e2a0c8e088483494a9dec67c67492c_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3644 set thread context of 4200	3644	2026-08-04_21e2a0c8e088483494a9dec67c67492c_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_21e2a0c8e088483494a9dec67c67492c_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZLRta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_21e2a0c8e088483494a9dec67c67492c_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4304 wrote to memory of 2360	4304	2026-08-04_21e2a0c8e088483494a9dec67c67492c_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	89
PID 2360 wrote to memory of 3644	2360	ZLRta.exe	90
PID 3644 wrote to memory of 4200	3644	2026-08-04_21e2a0c8e088483494a9dec67c67492c_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 3644 wrote to memory of 4200	3644	2026-08-04_21e2a0c8e088483494a9dec67c67492c_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 3644 wrote to memory of 4200	3644	2026-08-04_21e2a0c8e088483494a9dec67c67492c_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 3644 wrote to memory of 4200	3644	2026-08-04_21e2a0c8e088483494a9dec67c67492c_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 3644 wrote to memory of 4200	3644	2026-08-04_21e2a0c8e088483494a9dec67c67492c_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-04_21e2a0c8e088483494a9dec67c67492c_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_21e2a0c8e088483494a9dec67c67492c_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4304
- C:\Users\Admin\AppData\Local\Temp\ZLRta.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-04_21e2a0c8e088483494a9dec67c67492c_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe" L98lAI2v
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Users\Admin\AppData\Local\Temp\2026-08-04_21e2a0c8e088483494a9dec67c67492c_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\ZLRta.exe" 4aZVAJ0e
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3644
  - - C:\Users\Admin\AppData\Local\Temp\2026-08-04_21e2a0c8e088483494a9dec67c67492c_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
      ZFDOIi2S
      4⤵
      Executes dropped EXE
      PID:4200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ZLRta.exe

Path C:\Users\Admin\AppData\Local\Temp\ZLRta.exe
Size 149KB
SHA256 1cfacdf3e6525960ae701975fd1b6d1e898a3cc2c8f4c801b36546afbe130c20
MD5 76378da4cd34ddb7a2c2da77c6b8d817
SHA1 b11a89a25554a0fd6e02292aded695e5fe8c0056
SHA512 11c2151e6ab0c65c3f7e71dcaefe334426c8c4c61c9a10d38f630fe0573866a2f341e35a7c554b457ad65c58cd18105aa15ebd5c39c45bb243d1adf0178ed11b
SSDEEP 3072:vbuMGq4hOSOVmjsv3K2vXZOgEdfGInOndU1QkMMBuCEE+mC6:TGq4sHVq4BONdGInIS1QyTX+y
TLSH
T12CE3E126BA50C432E19322700871D6B6B62F7A6117B941DBB7941FFD5FB02C19E3832B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4200-40-0x0000000000400000-0x000000000049D000-memory.dmp

Download