3292942482e474ce5f18919c5e8d734cee2c0adbfbec797e8ac4b1092c0b0cb8

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 05:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_48a30a105f544e8375af00b38e2b94e1_amadey_elex_rhadamanthys_smoke-loader.exe
Size 76KB
Sample260808-fn72cs1bld
SHA256 3292942482e474ce5f18919c5e8d734cee2c0adbfbec797e8ac4b1092c0b0cb8
MD5 48a30a105f544e8375af00b38e2b94e1
SHA1 c9bd86dc3637fa95a6f8239f6524ad5d128a4807
SHA512 922f548e70eb73d8eab20c693ade63c8b013111c4f444da439c65eeeaa0465fe2564801ac795b2d7172052666b570b7fe30578574d0aeb76d4d7844faa9e827b
SSDEEP 1536:E0ktmioyHil5kBionHDtaPM3jIHO+bXbX4QK4kcvx2XHjlkJM:Ty8iionHDP3jIHO+jbX4QK4kcvx2XH8M
TLSH
T18A737D1337C189B2F96380B1487ACB20535BB82197A142CB7B9A7B0F9E733D149B7657
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4636	zipkacip.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	icanhazip.com

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_48a30a105f544e8375af00b38e2b94e1_amadey_elex_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zipkacip.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 4636	4920	2026-08-08_48a30a105f544e8375af00b38e2b94e1_amadey_elex_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-08_48a30a105f544e8375af00b38e2b94e1_amadey_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_48a30a105f544e8375af00b38e2b94e1_amadey_elex_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Users\Admin\AppData\Local\Temp\zipkacip.exe
  C:\Users\Admin\AppData\Local\Temp\zipkacip.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

zipkacip.exe

Path C:\Users\Admin\AppData\Local\Temp\zipkacip.exe
Size 76KB
SHA256 8b4ffc7d7671fd115cf5709577d737e0a5029902b20b243fb48cc65ecbaa04d3
MD5 a396fe515d57f1a6bd07cbe7c06a229c
SHA1 6b53c16f58ece4f78d954a84c7bac036aab51b30
SHA512 a9cb3cc08bbba5cdae0e29600963a37cec223e52865d243ba79c7b9a79acbc0ab3b75194121074dfddf5fd0860bb08e68ea0519eaee4242e4610f5e4ee58a9f8
SSDEEP 1536:E0ktmioyHil5kBionHDtaPM3jIHO+bXbX4QK4kcvx2XHjlkJMe:Ty8iionHDP3jIHO+jbX4QK4kcvx2XH8L
TLSH
T1DE737D1337C189B2F96380B1487ACB20535BB82197A142CF7A9A7B0F9E733D149B7657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads