e987da425590df8174403eab9678acd392229859cce752971b111a1351511ae5

Analysis

max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 17:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_d3b7ec948e6bc83ff2398f29a8732449_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Size 149KB
Sample260808-vrftlsan7t
SHA256 e987da425590df8174403eab9678acd392229859cce752971b111a1351511ae5
MD5 d3b7ec948e6bc83ff2398f29a8732449
SHA1 686aeb48fd596921faf4f8585f576f2650aea58a
SHA512 5673f20d4d9e0586b64cb2601adc7288f1cf095a7bfcbd8dfc620151ec3bb9743ad05537c9e2103bc65320a8f86a1b3e7c609a721ce9dcc2b43e4edd8f273878
SSDEEP 3072:vbuMGq4hOSOVbjsvlTrp0xQRPwTc5qgGL1NcokweGs3JtQNP:TGq4sHVPoJ0GtwWqgm1Nx0JtQt
TLSH
T194E3E11579819472D0A226704CB1D9F3A12BB96223B946CB739C0BBE5F706C19E3D36F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2624	7QksQ.exe
2868	2026-08-08_d3b7ec948e6bc83ff2398f29a8732449_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
3260	2026-08-08_d3b7ec948e6bc83ff2398f29a8732449_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2868 set thread context of 3260	2868	2026-08-08_d3b7ec948e6bc83ff2398f29a8732449_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_d3b7ec948e6bc83ff2398f29a8732449_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7QksQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_d3b7ec948e6bc83ff2398f29a8732449_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3468 wrote to memory of 2624	3468	2026-08-08_d3b7ec948e6bc83ff2398f29a8732449_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	89
PID 2624 wrote to memory of 2868	2624	7QksQ.exe	90
PID 2868 wrote to memory of 3260	2868	2026-08-08_d3b7ec948e6bc83ff2398f29a8732449_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 2868 wrote to memory of 3260	2868	2026-08-08_d3b7ec948e6bc83ff2398f29a8732449_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 2868 wrote to memory of 3260	2868	2026-08-08_d3b7ec948e6bc83ff2398f29a8732449_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 2868 wrote to memory of 3260	2868	2026-08-08_d3b7ec948e6bc83ff2398f29a8732449_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 2868 wrote to memory of 3260	2868	2026-08-08_d3b7ec948e6bc83ff2398f29a8732449_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-08_d3b7ec948e6bc83ff2398f29a8732449_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_d3b7ec948e6bc83ff2398f29a8732449_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3468
- C:\Users\Admin\AppData\Local\Temp\7QksQ.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-08_d3b7ec948e6bc83ff2398f29a8732449_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe" mRUykIz5
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2624
- - C:\Users\Admin\AppData\Local\Temp\2026-08-08_d3b7ec948e6bc83ff2398f29a8732449_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\7QksQ.exe" PTaYRFdt
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2868
  - - C:\Users\Admin\AppData\Local\Temp\2026-08-08_d3b7ec948e6bc83ff2398f29a8732449_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
      6Ac8TJvI
      4⤵
      Executes dropped EXE
      PID:3260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7QksQ.exe

Path C:\Users\Admin\AppData\Local\Temp\7QksQ.exe
Size 149KB
SHA256 d3f627df0e70ecb324d57263aeae2fdfdc26a4fb4c00d412e1d1dad9bf74c7b2
MD5 83352292de743670c95ba1f13b6d21e6
SHA1 bc464ea4e2da4267baf78e991417bac48bda4387
SHA512 eaccd2cbed8486de1697c4861624e46d5eee52dc459b141c3403772034918e571cda52fd0d1d93ee498ab876bee54c754e1dc7673b5909cdcf3d703459524d28
SSDEEP 3072:vbuMGq4hOSOVzjsv7JyjEdy0wAJbbh+Gi:TGq4sHVnRwdy0wAF4d
TLSH
T1FCE3D0397A90D472E49221709471DAB2B61F756227B841CBBBA81FBD5F302C15E3835F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3260-40-0x0000000000400000-0x000000000049D000-memory.dmp

Download