419142f799ae5e81d27d84cb52bb2e1cb241a614159c3107c25dbd11db853af1

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_c732e060855a4966ae24a41c0200a4a3_amadey_elex_rhadamanthys_smoke-loader.exe
Size 1.1MB
Sample260805-sr8taaca87
SHA256 419142f799ae5e81d27d84cb52bb2e1cb241a614159c3107c25dbd11db853af1
MD5 c732e060855a4966ae24a41c0200a4a3
SHA1 11bc9235574a1ae59f5f9ed25d7db3c37f41fe9a
SHA512 57c6a7015fbc5f11f54dfe4cb24778fb9a83e671b90efe7ebfaeb6099870b72a070f54c89370d54b2340bccd1cf571ceef96b1ad367ff7d2ec7db8f271dc121c
SSDEEP 24576:O1A45BWLpBoMY8wYDAz+eBE6OQJ+6hTRt2Z5FHcmKk/yoig:O115UdBoMY4q+eBPXJ+6L8Z5+mKkaz
TLSH
T1593512A8E1A0D2F2C64604715B9ACBF7AD7E3D755B624EC333E9466D3C211C1A632723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
6472	5CCC.tmp

Executes dropped EXE 1 IoCs

pid	Process
6472	5CCC.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_c732e060855a4966ae24a41c0200a4a3_amadey_elex_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5CCC.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
6472	5CCC.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 6472	2604	2026-08-05_c732e060855a4966ae24a41c0200a4a3_amadey_elex_rhadamanthys_smoke-loader.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-05_c732e060855a4966ae24a41c0200a4a3_amadey_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_c732e060855a4966ae24a41c0200a4a3_amadey_elex_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Users\Admin\AppData\Local\Temp\5CCC.tmp
  "C:\Users\Admin\AppData\Local\Temp\5CCC.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-05_c732e060855a4966ae24a41c0200a4a3_amadey_elex_rhadamanthys_smoke-loader.exe 5F942045C841181D058ABD11D5609FC266D9BC8A84AD890604595795F7D7A4CB8AF88B087C618762F88DD5DD0C66C721C6DDB1B53C83298FB2CA06FE672E7391
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:6472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5CCC.tmp

Path C:\Users\Admin\AppData\Local\Temp\5CCC.tmp
Size 1.1MB
SHA256 af6120401d61d6ccc5543ca1920afcc34136735ede821ec7ce596cf5a0e52009
MD5 e806ea7417e14137905c485613214c1a
SHA1 5f3953079658f72864c511ee9097daa1f188cd6b
SHA512 d63124d5d8987759f4c879de298b1a34ae57d94728bed74085ca26a12c84ff515058c71ab8a0456e7e8cfe87c5bca845dd1480fdcafe093f605fcd7e89c6bfc0
SSDEEP 24576:O1A45BWLpBoMYXeu66nNdBhHq2vzeXvgh9QAiNBkapdC1TiZWPv:O115UdBoMYZhN3Jqg6fqmb0EuTGW
TLSH
T19A3512A4E58082F2D50604711A5ACBF72C393DB567625EC337DA17BE3E202C1BB36667
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads