d8b91e39f3bdab34f7aa278a9af5f813cffcb12a29066adb8614c22840395a65

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 02:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_8bfe6d0a661f4d88035eb616745553ae_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Size 149KB
Sample260805-dfxvbaak21
SHA256 d8b91e39f3bdab34f7aa278a9af5f813cffcb12a29066adb8614c22840395a65
MD5 8bfe6d0a661f4d88035eb616745553ae
SHA1 fd2db5a33fda17baed71ba89d302e7afe9bf1964
SHA512 2789b6e6aa9b582f45be80b12b8190886d2490182fc219d467e0361e375e0e7ae06777600e0bc14eae6bd57c14daaff19f9b4360565c369f7b12454ced8d37c6
SSDEEP 3072:vbuMGq4hOSOVFjsv9QukqzlUEXqiAwfynFi+eGLR5Of+WYe8gvO:TGq4sHVVKkwCQtWnk+JDtF
TLSH
T119E3D021B692D473D16322308D71E6B2E62BBA61137845CB7B980FBD5F706C19E3835E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4516	AosYa.exe
2576	2026-08-05_8bfe6d0a661f4d88035eb616745553ae_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
3216	2026-08-05_8bfe6d0a661f4d88035eb616745553ae_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2576 set thread context of 3216	2576	2026-08-05_8bfe6d0a661f4d88035eb616745553ae_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_8bfe6d0a661f4d88035eb616745553ae_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AosYa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_8bfe6d0a661f4d88035eb616745553ae_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 4516	4216	2026-08-05_8bfe6d0a661f4d88035eb616745553ae_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	89
PID 4516 wrote to memory of 2576	4516	AosYa.exe	90
PID 2576 wrote to memory of 3216	2576	2026-08-05_8bfe6d0a661f4d88035eb616745553ae_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 2576 wrote to memory of 3216	2576	2026-08-05_8bfe6d0a661f4d88035eb616745553ae_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 2576 wrote to memory of 3216	2576	2026-08-05_8bfe6d0a661f4d88035eb616745553ae_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 2576 wrote to memory of 3216	2576	2026-08-05_8bfe6d0a661f4d88035eb616745553ae_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 2576 wrote to memory of 3216	2576	2026-08-05_8bfe6d0a661f4d88035eb616745553ae_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-05_8bfe6d0a661f4d88035eb616745553ae_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_8bfe6d0a661f4d88035eb616745553ae_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Users\Admin\AppData\Local\Temp\AosYa.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-05_8bfe6d0a661f4d88035eb616745553ae_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe" CZCupAEJ
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4516
- - C:\Users\Admin\AppData\Local\Temp\2026-08-05_8bfe6d0a661f4d88035eb616745553ae_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\AosYa.exe" HPZlk0Dj
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2576
  - - C:\Users\Admin\AppData\Local\Temp\2026-08-05_8bfe6d0a661f4d88035eb616745553ae_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
      vdE9JvrI
      4⤵
      Executes dropped EXE
      PID:3216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AosYa.exe

Path C:\Users\Admin\AppData\Local\Temp\AosYa.exe
Size 149KB
SHA256 e5723157a77286d78bac73fdc33a23f30fda94e5276bf3d6b360feee5d386a56
MD5 67b6f5f3bac070ff644519e04fad3937
SHA1 503db2b2d4e55bd9f6f74a15a5aa74f3b67e5215
SHA512 3fa03fcd2299e7e72f57356e151bdbfaf920f9c75590f95a6b2ca80904759fc5d6a7e9d2e096777c441c1fa512bba7004dbfa7a34f328433e18ce477006b3d83
SSDEEP 3072:vbuMGq4hOSOVtjsvvlC7aTx3UU6Um+4X9c1EkVsQpqKKzCzYIWf:TGq4sHV9p7O1UtN+4XC1EUnqzCzhWf
TLSH
T157E3D025BAA06531D05312709D61D2B7B92B355117B802C7BB982FFEAFB05C19E3D32B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3216-40-0x0000000000400000-0x000000000049D000-memory.dmp

Download