89cbf6240d4397fc6b34912985b320a1c8cd6a616afd6ec2da46427e95207d01

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 11:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_3a52ac3fb87915ba035c84673927e587_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Size 149KB
Sample260805-nb5pgaac95
SHA256 89cbf6240d4397fc6b34912985b320a1c8cd6a616afd6ec2da46427e95207d01
MD5 3a52ac3fb87915ba035c84673927e587
SHA1 1328fdbe7dc87a1ef089d8bb7258ee47d2aab617
SHA512 188d1f1facfb6a0e7ac20a601a932caf4c027fb9e95a30cc15d5b1a8622345c463ec7069b55579da40fb5cab337675ab949ef3e74f8d40ff74399346faa846cb
SSDEEP 3072:vbuMGq4hOSOVNjsvvxTOHLEwACT0LP1k9EtiLfLMYqS:TGq4sHVdyg1BT0LP1kQiLfLOS
TLSH
T145E3F126B950D836D06326345C7591B7A56FB4A2237812CB778C2FBE1E707C19E3836B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2424	ejj9t.exe
1808	2026-08-05_3a52ac3fb87915ba035c84673927e587_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
940	2026-08-05_3a52ac3fb87915ba035c84673927e587_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1808 set thread context of 940	1808	2026-08-05_3a52ac3fb87915ba035c84673927e587_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ejj9t.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_3a52ac3fb87915ba035c84673927e587_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_3a52ac3fb87915ba035c84673927e587_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 2424	4932	2026-08-05_3a52ac3fb87915ba035c84673927e587_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	89
PID 2424 wrote to memory of 1808	2424	ejj9t.exe	90
PID 1808 wrote to memory of 940	1808	2026-08-05_3a52ac3fb87915ba035c84673927e587_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 1808 wrote to memory of 940	1808	2026-08-05_3a52ac3fb87915ba035c84673927e587_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 1808 wrote to memory of 940	1808	2026-08-05_3a52ac3fb87915ba035c84673927e587_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 1808 wrote to memory of 940	1808	2026-08-05_3a52ac3fb87915ba035c84673927e587_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 1808 wrote to memory of 940	1808	2026-08-05_3a52ac3fb87915ba035c84673927e587_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-05_3a52ac3fb87915ba035c84673927e587_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_3a52ac3fb87915ba035c84673927e587_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Users\Admin\AppData\Local\Temp\ejj9t.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-05_3a52ac3fb87915ba035c84673927e587_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe" OYpAkudQ
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2424
- - C:\Users\Admin\AppData\Local\Temp\2026-08-05_3a52ac3fb87915ba035c84673927e587_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\ejj9t.exe" mqLG5wYJ
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1808
  - - C:\Users\Admin\AppData\Local\Temp\2026-08-05_3a52ac3fb87915ba035c84673927e587_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
      LoKscZnn
      4⤵
      Executes dropped EXE
      PID:940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ejj9t.exe

Path C:\Users\Admin\AppData\Local\Temp\ejj9t.exe
Size 149KB
SHA256 587f63f76617b5b7e3e5be9f10a831adc9b6bd777e610bbcd8463075015a0053
MD5 81f8f7d55ba1bdafaed56cca7eacc8cc
SHA1 ce4da093fc7716f6828debbf1f5b944de5fd95ae
SHA512 bb5f097bbd99436671a403603a36bf4846dc782d238117d6df0e01648a3bcc55e2731d19f040c627f31f4f1ab5eeb3af8a707172c440a83326260c6c1a2ad440
SSDEEP 3072:vbuMGq4hOSOVkjsv5DdzOjgssahjXyxjb6cA65JPuUJsS5:TGq4sHVc2Jc5sahDIace6sW
TLSH
T113E3E0267AE1C431E1532A704C71A2B3A52FB561237846CB7B891FBE5E702C19E3935F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/940-40-0x0000000000400000-0x000000000049D000-memory.dmp

Download