ca25504ea53c0c89485d572047f40f66f5434e6b6f6f0579722ff3beae34de45

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 18:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_8a459f660d2264bd86060b4638259074_elex_rhadamanthys_smoke-loader.exe
Size 687KB
Sample260808-xhksbaxtas
SHA256 ca25504ea53c0c89485d572047f40f66f5434e6b6f6f0579722ff3beae34de45
MD5 8a459f660d2264bd86060b4638259074
SHA1 3c51aef44a8181625943d0eb0aacf76d954025b9
SHA512 9fc874040d8404a7fcd9f3a73a4ff054b2c23bd8c32efbefebc75d0855be00b77c86e1058b72d5cb6d235d002de2dd98dc1b6bda2bac727aa730c4b948904201
SSDEEP 12288:3kIS6tX9CPewUmxA2OQlOdFIEdKFev7+0N1R9Dgec:3rXBxkEEYvaKR97c
TLSH
T154E4D02436C1C431E5A7063646AADE6254BEFD324F60AECBB7C8261D5D706D1BB31B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3272	E620.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_8a459f660d2264bd86060b4638259074_elex_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E620.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3272	E620.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 3272	4784	2026-08-08_8a459f660d2264bd86060b4638259074_elex_rhadamanthys_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-08_8a459f660d2264bd86060b4638259074_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_8a459f660d2264bd86060b4638259074_elex_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Users\Admin\AppData\Local\Temp\E620.tmp
  "C:\Users\Admin\AppData\Local\Temp\E620.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-08_8a459f660d2264bd86060b4638259074_elex_rhadamanthys_smoke-loader.exe 89ECBB48B175BFECC6B2993BBAACBBC300631B42D35AB6B8F4AA0957B6DC6F3385B0244155B6F12D2AB30C66D23C4D296AC1FAB848E3A546C1AE039AFDCC8937
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E620.tmp

Path C:\Users\Admin\AppData\Local\Temp\E620.tmp
Size 687KB
SHA256 529f1fedc285d41ed27ec609e9845d181762e47b991b353eced54cf8d7e2aa71
MD5 b263b5262e56b0f71464ca13d76bad6c
SHA1 24c807480dae02e3bb1bfaf3b332da73b3a845b2
SHA512 b28d1f89819d1bb1619b258d51f889588a23ef9cc8bc9adeaa95457e5e89a76bd58fb8f0d03b4daae6dc7360d5eed8d7bfe3ba106330f90421232db17a3992d1
SSDEEP 12288:3kIS6tXZfxLw0FNPO7OzireDFev7+0N1R9Dgec:3rXZfxMXOokYvaKR97c
TLSH
T1C1E4E02036D1C070E6A7463256AADF6354BEFD324F609ACBB7D82A1C5D702D1A734B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3272-6-0x0000000000B00000-0x0000000000BAC000-memory.dmp

Download

memory/4784-5-0x0000000000BD0000-0x0000000000C7C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads