8d2a5019304ed5233d1051c6919a2b3332da56f77961556151c4e34a22786a2e

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 11:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_64391982d9f430e3772c345265207605_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Size 149KB
Sample260805-m65saaab84
SHA256 8d2a5019304ed5233d1051c6919a2b3332da56f77961556151c4e34a22786a2e
MD5 64391982d9f430e3772c345265207605
SHA1 f9c4d7ea2bf5c605b757badc8668950e81bf98ce
SHA512 7af7639d996efce3fd3f1c93ee91b33f39a60eac692158cfde408bcb70fc395f18b0d8b87f1883e6120d3f2b6199148b5069a4f73e11874d7574b0d5e45d7179
SSDEEP 3072:vbuMGq4hOSOVwjsvHYcnpyOUMOZdDcD6n84nVnF:TGq4sHVwBQ2tcDmvnZF
TLSH
T12FE3E0117A909433D16322706875E1B3A56B74A113B946CBBBD91FBE9E706C09F3832B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2544	yEtXF.exe
4656	2026-08-05_64391982d9f430e3772c345265207605_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
1480	2026-08-05_64391982d9f430e3772c345265207605_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4656 set thread context of 1480	4656	2026-08-05_64391982d9f430e3772c345265207605_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_64391982d9f430e3772c345265207605_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yEtXF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_64391982d9f430e3772c345265207605_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4408 wrote to memory of 2544	4408	2026-08-05_64391982d9f430e3772c345265207605_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	89
PID 2544 wrote to memory of 4656	2544	yEtXF.exe	90
PID 4656 wrote to memory of 1480	4656	2026-08-05_64391982d9f430e3772c345265207605_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 4656 wrote to memory of 1480	4656	2026-08-05_64391982d9f430e3772c345265207605_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 4656 wrote to memory of 1480	4656	2026-08-05_64391982d9f430e3772c345265207605_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 4656 wrote to memory of 1480	4656	2026-08-05_64391982d9f430e3772c345265207605_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 4656 wrote to memory of 1480	4656	2026-08-05_64391982d9f430e3772c345265207605_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-05_64391982d9f430e3772c345265207605_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_64391982d9f430e3772c345265207605_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Users\Admin\AppData\Local\Temp\yEtXF.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-05_64391982d9f430e3772c345265207605_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe" ojvw0mDt
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Users\Admin\AppData\Local\Temp\2026-08-05_64391982d9f430e3772c345265207605_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\yEtXF.exe" Lhivw0k5
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4656
  - - C:\Users\Admin\AppData\Local\Temp\2026-08-05_64391982d9f430e3772c345265207605_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
      ycxOlrKY
      4⤵
      Executes dropped EXE
      PID:1480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

yEtXF.exe

Path C:\Users\Admin\AppData\Local\Temp\yEtXF.exe
Size 149KB
SHA256 951c96ec735d6013d43b40c969498db75830c44510c61f658994b9a542989442
MD5 444e827b607348671c1fb779f786a5d1
SHA1 fe5706e785cb057f735912091298260f3530e677
SHA512 54c4b257d59bd270612c8750d44081bc9f6852c01e1ce8d0bfa8786eb030991b997a2531e7cfd9b270bb2ba3690c030cc13140f6375a6bee7e867f3009a00721
SSDEEP 3072:vbuMGq4hOSOVJjsv6dox2vY+NH1R4XA1unHNxRXdHh:TGq4sHVRIAp10A1ulNHh
TLSH
T151E3E0267A51D433D15622305C71D6B7A62BB56113B841DBBB842BBE9F702C24E3C36F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1480-40-0x0000000000400000-0x000000000049D000-memory.dmp

Download