ae8b5cf43b463b0625dfba2b1f30f23c10e7c6242de3dc74896c5e95eb46413a

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Size 149KB
Sample260805-vr1tsacf99
SHA256 ae8b5cf43b463b0625dfba2b1f30f23c10e7c6242de3dc74896c5e95eb46413a
MD5 e1d6bbcf249e5a14d05f9a5fca0b14e1
SHA1 f5beac1e88e5b673e5762cc34bf4a45d6e77f3a4
SHA512 053d2c5ecc58735e438dba2468d516f68b0592bbe7f623349f9c8693667fdd279ebe0fc5023092ef7835dd0614bbeabd4bef438357ae39ff05e8f4ef820669b3
SSDEEP 3072:vbuMGq4hOSOVOSjsvhAtAr2oX/sP+OUjmmrBv4DtmfQY1/31H2:TGq4sHVO+E2wOAfVem/R31W
TLSH
T192E3E021BBA1C472E52321305CB181B6A67B7592177845DBBBD91FBE8F702C05E3932B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4612	yHroD.exe
440	2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
4232	2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 440 set thread context of 4232	440	2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yHroD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5860 wrote to memory of 4612	5860	2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	89
PID 4612 wrote to memory of 440	4612	yHroD.exe	90
PID 440 wrote to memory of 4232	440	2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 440 wrote to memory of 4232	440	2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 440 wrote to memory of 4232	440	2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 440 wrote to memory of 4232	440	2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 440 wrote to memory of 4232	440	2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5860
- C:\Users\Admin\AppData\Local\Temp\yHroD.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe" OkwmrSqG
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4612
- - C:\Users\Admin\AppData\Local\Temp\2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\yHroD.exe" 0g4bxfWI
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:440
  - - C:\Users\Admin\AppData\Local\Temp\2026-08-05_e1d6bbcf249e5a14d05f9a5fca0b14e1_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
      wOEV7GHG
      4⤵
      Executes dropped EXE
      PID:4232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

yHroD.exe

Path C:\Users\Admin\AppData\Local\Temp\yHroD.exe
Size 149KB
SHA256 bfe74ae6e3cf9e99a3c9611b0c7776a5de422589ecf38d7f834595bdf6336411
MD5 dbedc56f2ca1500eaf52235b12136e61
SHA1 c189d233663433fa13a798618e77d14e317496af
SHA512 1e9418888692ee976cf38dd0153b6eb2e7f481bfd19c66a036ddbd4ba2375be09f3bfe6e859ed2952747b334e2e37012efd2659e266312abd8634d6e5aa20be2
SSDEEP 3072:vbuMGq4hOSOVdjsv8A+bL+nxoqDY5NaH21Wr3Ulczck0j3roW+b:TGq4sHVtvAuLRqDYnozUlM0j3ry
TLSH
T175E3D0217691D436D16726704C71E2B3E66B392117B845CBB7A81BBE6FB02C15E3832F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4232-40-0x0000000000400000-0x000000000049D000-memory.dmp

Download