e678f1ff9ee51c34480794bd81178262406ebb2f8972a838ae3aff67491f43d1

Analysis

max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 03:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_9d5183e6caa41494d1ee9f0d47684ca4_amadey_elex_karagany_rhadamanthys_smoke-loader.exe
Size 5.5MB
Sample260808-djy7jsgn2s
SHA256 e678f1ff9ee51c34480794bd81178262406ebb2f8972a838ae3aff67491f43d1
MD5 9d5183e6caa41494d1ee9f0d47684ca4
SHA1 ce49a4a98a1e42743d9f17a4223168240fabdbb0
SHA512 e469580b1f7b6dfc91f9704aee482e5e07d52f50fe33bbd53835ed2b23a7bab8fd9660e4502fef4d55a598f7546422416593fac10f779bcdf581fba9a08a27ed
SSDEEP 98304:7tJISZp6+Wvl3D1tBpzOUV3m+hVGiqhx0RHbNvR5D1toKOQ5MpIcRnVKN1f:XI8LclppiUFm+X1v7lD1tZOBFVK3f
TLSH
T1DF46339E70D04C25DCA92EB0D33A03F315EDADA58B19DE7AD4E884D12FD11A1AF38578
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2152	89A8.tmp

Executes dropped EXE 1 IoCs

pid	Process
2152	89A8.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_9d5183e6caa41494d1ee9f0d47684ca4_amadey_elex_karagany_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	89A8.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 2152	4528	2026-08-08_9d5183e6caa41494d1ee9f0d47684ca4_amadey_elex_karagany_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-08_9d5183e6caa41494d1ee9f0d47684ca4_amadey_elex_karagany_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_9d5183e6caa41494d1ee9f0d47684ca4_amadey_elex_karagany_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Users\Admin\AppData\Local\Temp\89A8.tmp
  "C:\Users\Admin\AppData\Local\Temp\89A8.tmp"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

89A8.tmp

Path C:\Users\Admin\AppData\Local\Temp\89A8.tmp
Size 5.5MB
SHA256 603e9558023947b093bdbb70a7ed6c8d6d9e86be787962a81d0295548d7579c3
MD5 d4003ca1a2729b47db1ca970f042999b
SHA1 50b2c119bde234afc97f81b6723ef5854a1d6244
SHA512 c8b6972e1f592d2386d02440420c617f9c9b7d97c23e8f630ead45a60f8c09fed9327d2416d251b440b1d90192b1a2e0f81705c8758c449d8337f6873308bb8a
SSDEEP 98304:AXk5cxZp6+Wvl3D1tBpzOUV3m+hVGiqhx0RHbNvR5D1toKOQ5MpIcRnVKN1f:A0WfLclppiUFm+X1v7lD1tZOBFVK3f
TLSH
T1564633AEB0D08C25DC551EB0D73A43F344E95C284B1AD96EE8E884E46FD11A1BF3C5B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download