3f2dcf0b7a5ab7583f8b332e100bc773a4e947848e9e754538de17d16485f7c1

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 00:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_b3332d66a537f1948d00eb4eff54c5be_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Size 149KB
Sample260808-anhhtaag76
SHA256 3f2dcf0b7a5ab7583f8b332e100bc773a4e947848e9e754538de17d16485f7c1
MD5 b3332d66a537f1948d00eb4eff54c5be
SHA1 7e3261b43a39c94be341b99bd019eab79ad2d477
SHA512 ad270cd197c430980ccdbeb3b5cb39adfc90d594d2132c0ec8eb95458e4da60fcd9b10b81c38af46730dcaf203bb3a8ba93d067ff2b14146f014550d008ca0c9
SSDEEP 3072:vbuMGq4hOSOVWjsvJciaMMlwhkX6fLd+FsukEFQdqCUIQalT:TGq4sHVa5lwhkKzdWsuxQdqpq
TLSH
T1E5E3D02179908832E5A215715C71D6B3A62B756217B842CBBBAC0FBDAF706C05E3835F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2892	genPG.exe
1824	2026-08-08_b3332d66a537f1948d00eb4eff54c5be_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
5580	2026-08-08_b3332d66a537f1948d00eb4eff54c5be_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1824 set thread context of 5580	1824	2026-08-08_b3332d66a537f1948d00eb4eff54c5be_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_b3332d66a537f1948d00eb4eff54c5be_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_b3332d66a537f1948d00eb4eff54c5be_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	genPG.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 752 wrote to memory of 2892	752	2026-08-08_b3332d66a537f1948d00eb4eff54c5be_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	89
PID 2892 wrote to memory of 1824	2892	genPG.exe	90
PID 1824 wrote to memory of 5580	1824	2026-08-08_b3332d66a537f1948d00eb4eff54c5be_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 1824 wrote to memory of 5580	1824	2026-08-08_b3332d66a537f1948d00eb4eff54c5be_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 1824 wrote to memory of 5580	1824	2026-08-08_b3332d66a537f1948d00eb4eff54c5be_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 1824 wrote to memory of 5580	1824	2026-08-08_b3332d66a537f1948d00eb4eff54c5be_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 1824 wrote to memory of 5580	1824	2026-08-08_b3332d66a537f1948d00eb4eff54c5be_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-08_b3332d66a537f1948d00eb4eff54c5be_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_b3332d66a537f1948d00eb4eff54c5be_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:752
- C:\Users\Admin\AppData\Local\Temp\genPG.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b3332d66a537f1948d00eb4eff54c5be_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe" vFDMgEil
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Users\Admin\AppData\Local\Temp\2026-08-08_b3332d66a537f1948d00eb4eff54c5be_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\genPG.exe" UXhEH8ij
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1824
  - - C:\Users\Admin\AppData\Local\Temp\2026-08-08_b3332d66a537f1948d00eb4eff54c5be_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
      G22MIA4f
      4⤵
      Executes dropped EXE
      PID:5580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

genPG.exe

Path C:\Users\Admin\AppData\Local\Temp\genPG.exe
Size 149KB
SHA256 87e6625b4919e887089a17da4846d6feef1735b7ee48b138dc378f56b117a035
MD5 225c3eb688ca968bb0c2d71e63e7ac4f
SHA1 879da02d9743e4536646004a496abe196f8b3861
SHA512 d38d46f62c1b4779bcfa77eb45d3115eafb1f7f39ca3c88be0af37e1b2e198972aa69bb35fa5a947212d8692a167abc614e2ee357aa84cf134379192ce7f7254
SSDEEP 3072:vbuMGq4hOSOVPjsvDDHaYfx1bpidvj/S5fKJdWQlDFjc/cElG43p8U9:TGq4sHVrSraYxlq/S5SJPDFYUEZp3
TLSH
T11DE3E02579628572D197273048B096B3E62BB86213B845CFB7891FB96F702C15F3872F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5580-40-0x0000000000400000-0x000000000049D000-memory.dmp

Download