53dffbfc397602436927f319bdda7685340ff1fc87221438b6ac765afa938658

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 15:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_6e1354450fb4ffa743a94acc0d9c4248_elex_rhadamanthys_smoke-loader.exe
Size 687KB
Sample260807-tedm2syglf
SHA256 53dffbfc397602436927f319bdda7685340ff1fc87221438b6ac765afa938658
MD5 6e1354450fb4ffa743a94acc0d9c4248
SHA1 43e77554465bc993a4c31731419028891d8ee433
SHA512 428e2ca3eb6f436a3133b4d48bf2b7139119c33014fa51b13508214a9a479f136a04750ff38322f5babe7bacef00bc8ee5b4e99e1b2197f6d15528b3feb6599c
SSDEEP 12288:3kIS6tX0N2SUVIU/Bdm3xFev7+0N1R9Dgec:3rX5AUJ+xYvaKR97c
TLSH
T12BE4E02036C1C070E5B6423256AADF63487EFD724FA09ECBB7C82B1D49746D1A635B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3000	F1CD.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_6e1354450fb4ffa743a94acc0d9c4248_elex_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F1CD.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3000	F1CD.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 3000	1848	2026-08-07_6e1354450fb4ffa743a94acc0d9c4248_elex_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-07_6e1354450fb4ffa743a94acc0d9c4248_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_6e1354450fb4ffa743a94acc0d9c4248_elex_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Users\Admin\AppData\Local\Temp\F1CD.tmp
  "C:\Users\Admin\AppData\Local\Temp\F1CD.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-07_6e1354450fb4ffa743a94acc0d9c4248_elex_rhadamanthys_smoke-loader.exe CD40BA716E6CA26CF44003B700FE4A8A66261A82940EBDBAF187D1088FCEB38EF08406C2FA78F28EF257F3E2881DCB62F55BE7ABD72405A1EBFC2432DA2FB069
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F1CD.tmp

Path C:\Users\Admin\AppData\Local\Temp\F1CD.tmp
Size 687KB
SHA256 f62f236f6cbae3615627a77b6593cb61709004acb44f15957d9edbfa6e1cb076
MD5 12cb98cf34ad2a1967e52ec3e8b07d8f
SHA1 720ca086e8f0ffdf2ddffa2dce94b11868188b15
SHA512 ae9e2a48a65dd349ab3a6a7670cc5891dd512d02362b80eb07e18cc092595099d464691d81f9e948516974db962ec2d8585eb02451ca5eaf63d54020e5b8c6ae
SSDEEP 12288:3kIS6tXFMMjWms6Q3YGldJJ4Eq9XtgSsFev7+0N1R9Dgec:3rXEn6Q3Yw4Eq9HsYvaKR97c
TLSH
T1D0E4E01076C2C030E5A6063256A5EF6348BEFD724F609ACBB7C82A5D1E742D1A735B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1848-5-0x0000000000D20000-0x0000000000DCC000-memory.dmp

Download

memory/3000-6-0x0000000000C40000-0x0000000000CEC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads