bffc7c6bc931a653699523de846983b0356d3584acef20540eb357b32a6428ee

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 10:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_56a9faee09b8f712a582bbbd8550723d_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Size 149KB
Sample260808-l136tsysev
SHA256 bffc7c6bc931a653699523de846983b0356d3584acef20540eb357b32a6428ee
MD5 56a9faee09b8f712a582bbbd8550723d
SHA1 0c6a93061379b10c81704a24357e016b92c473ee
SHA512 7bcca1512331407b2f86fbde30f6a75cd51dd5c7c0cea3e3944630f584f0e5cfe9c88b8eeb8be65d1d6c0148dbe3404e5fd8fe2e215eeae40c75ed6726f2d10e
SSDEEP 3072:vbuMGq4hOSOVIjsvbfxjmi3R+Yj7TyClowRMDgVL9mf+r:TGq4sHVoiVmih+Yj3ho4HE+r
TLSH
T1BBE3E011BA50D472D16326304CB2D2F7E62E795057B841CBBB990BBE6E602C09E3D76B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4644	EJqr0.exe
2900	2026-08-08_56a9faee09b8f712a582bbbd8550723d_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
3216	2026-08-08_56a9faee09b8f712a582bbbd8550723d_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2900 set thread context of 3216	2900	2026-08-08_56a9faee09b8f712a582bbbd8550723d_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_56a9faee09b8f712a582bbbd8550723d_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EJqr0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_56a9faee09b8f712a582bbbd8550723d_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 4644	4924	2026-08-08_56a9faee09b8f712a582bbbd8550723d_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	89
PID 4644 wrote to memory of 2900	4644	EJqr0.exe	90
PID 2900 wrote to memory of 3216	2900	2026-08-08_56a9faee09b8f712a582bbbd8550723d_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 2900 wrote to memory of 3216	2900	2026-08-08_56a9faee09b8f712a582bbbd8550723d_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 2900 wrote to memory of 3216	2900	2026-08-08_56a9faee09b8f712a582bbbd8550723d_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 2900 wrote to memory of 3216	2900	2026-08-08_56a9faee09b8f712a582bbbd8550723d_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 2900 wrote to memory of 3216	2900	2026-08-08_56a9faee09b8f712a582bbbd8550723d_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-08_56a9faee09b8f712a582bbbd8550723d_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_56a9faee09b8f712a582bbbd8550723d_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Users\Admin\AppData\Local\Temp\EJqr0.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-08_56a9faee09b8f712a582bbbd8550723d_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe" ehVKnjeb
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4644
- - C:\Users\Admin\AppData\Local\Temp\2026-08-08_56a9faee09b8f712a582bbbd8550723d_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\EJqr0.exe" hE9VqnxF
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2900
  - - C:\Users\Admin\AppData\Local\Temp\2026-08-08_56a9faee09b8f712a582bbbd8550723d_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
      jJwIqKKy
      4⤵
      Executes dropped EXE
      PID:3216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EJqr0.exe

Path C:\Users\Admin\AppData\Local\Temp\EJqr0.exe
Size 149KB
SHA256 a5ac2b4d985ba481714584302f966979c9d3687e4fccb41f7d147cb8aa65bd76
MD5 3972082df620043a4e3c9e59bfc6efed
SHA1 362693a338cff6b9220fcb53aedc5044e65d623f
SHA512 aaa2629dd3b366abd8debd352d7a3ec14606cbb09ea54ad1dfa9b705d233d4e30059381cb0d8a53ad2f9bf516adfef4af10118bd4bcf6f845a03da4d9ff1d26c
SSDEEP 3072:vbuMGq4hOSOVgjsv+zbYnAzOAcmyXiFHW:TGq4sHVg7zbBitm6iFHW
TLSH
T1E9E3D022BA90C472D0A326715930D6F2BA6F75A117B901CB77881FBE6E706C15B3835F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3216-40-0x0000000000400000-0x000000000049D000-memory.dmp

Download