2cc0d3ed9abbe6dc4d72df3fc0fe6fe365c839eb63619896a06b415a06086bd3

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 21:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_58393bb6982ca94508ed19d9295ceaab_elex_rhadamanthys_smoke-loader.exe
Size 687KB
Sample260805-z2wp2aea63
SHA256 2cc0d3ed9abbe6dc4d72df3fc0fe6fe365c839eb63619896a06b415a06086bd3
MD5 58393bb6982ca94508ed19d9295ceaab
SHA1 4cf3801eb788a6c9afb7db322a23aa6494d57585
SHA512 9148d269a534f67ed53d794d91bf3666f3baceebb964edc0b398f8e2aea1c49c9ebb7f032ffdd7b427294837c711fd80072740ca2abdd1c2cd593b3f658b7fc3
SSDEEP 12288:3kIS6tX8eq90QEFsy+IKQkEGnFev7+0N1R9Dgec:3rX8equQEFwdQBiYvaKR97c
TLSH
T1F2E4D02176C1C470E5A7463246AADF62487EFD714FA09ACBA7C82A1D19703D1BB31B73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1316	40B8.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_58393bb6982ca94508ed19d9295ceaab_elex_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	40B8.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1316	40B8.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 1316	1188	2026-08-05_58393bb6982ca94508ed19d9295ceaab_elex_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-05_58393bb6982ca94508ed19d9295ceaab_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_58393bb6982ca94508ed19d9295ceaab_elex_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Users\Admin\AppData\Local\Temp\40B8.tmp
  "C:\Users\Admin\AppData\Local\Temp\40B8.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-05_58393bb6982ca94508ed19d9295ceaab_elex_rhadamanthys_smoke-loader.exe 121961744755E7963008EC4358DA7D493683561ABC13972E6585C40401881DA96726554A8D0B24ACD015F32FE2A088277114F92D5B957AFC91290CEE49F37611
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

40B8.tmp

Path C:\Users\Admin\AppData\Local\Temp\40B8.tmp
Size 687KB
SHA256 2b378c82869b793e6cefd2129979ff1bf0332ba37061ed20eb116f43d6cf3373
MD5 d2c67ea5c0614c8eead3f239c06123b7
SHA1 3d38f70bbf8394613f1ea4a9831ab4712bb97087
SHA512 57f893d4a6347fafde273fcb3e18a2d08d8e7f1c2ce4ee1b61f00e22e97b58043f47b61ac56ab938aee4cd6c748b154f686a22f383806b7252bdde5e253e1eb5
SSDEEP 12288:3kIS6tX5j4Kp9Ui67jpnBXTTseG51wHFev7+0N1R9Dgec:3rXd4Kb/ksejYvaKR97c
TLSH
T127E4E01032C2C470E5E7463245A9DF62587EFD764FA49ACBB7C86A1D4E702D0AB34B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1188-4-0x0000000000BF0000-0x0000000000C9C000-memory.dmp

Download

memory/1316-6-0x00000000001B0000-0x000000000025C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads