3589e0c7f5348d9b2b1e88268281b2c03ad9adfc92d5b5046406e5aa21f56c36

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 07:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_3f7abbf10905dc24468bf8a449a2d034_amadey_elex_karagany_rhadamanthys_smoke-loader.exe
Size 5.5MB
Sample260809-jp1v8atclb
SHA256 3589e0c7f5348d9b2b1e88268281b2c03ad9adfc92d5b5046406e5aa21f56c36
MD5 3f7abbf10905dc24468bf8a449a2d034
SHA1 288b4b04bdbb1f0e89cb96290b37a7f234d406a0
SHA512 28fbb2be7fbd2b7fe9dc49841a9da75081066bac6802a55df3b9b5776979579426247f4a5f8782f349f0aacf7137b6d6238db48cdf74426abfa62eea553b4c86
SSDEEP 98304:uKPZp6+Wvl3D1tBpzOUV3m+hVGiqhx0RHbNvR5D1toKOQ5MpIcRnVKN1f:uQLclppiUFm+X1v7lD1tZOBFVK3f
TLSH
T1BE4633BEB1E08C24DC965E70DB3E03F350E99D648B1AD96EE4E484D52FC12A16F384B5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5980	B77F.tmp

Executes dropped EXE 1 IoCs

pid	Process
5980	B77F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_3f7abbf10905dc24468bf8a449a2d034_amadey_elex_karagany_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B77F.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 5980	2608	2026-08-09_3f7abbf10905dc24468bf8a449a2d034_amadey_elex_karagany_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-09_3f7abbf10905dc24468bf8a449a2d034_amadey_elex_karagany_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_3f7abbf10905dc24468bf8a449a2d034_amadey_elex_karagany_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Users\Admin\AppData\Local\Temp\B77F.tmp
  "C:\Users\Admin\AppData\Local\Temp\B77F.tmp"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

B77F.tmp

Path C:\Users\Admin\AppData\Local\Temp\B77F.tmp
Size 5.5MB
SHA256 b634c4be7af88b9255a88442e53e6888c4d3c65129dc70f802de6e6f1a63ba2b
MD5 8d98aef5abfbe4a552c91d967164feb8
SHA1 fdf7134431eb584f34bfe6f97abb2a03f75e5ffd
SHA512 77c5337c088ce70b49cda19d9f633fc593476984c4755b3dbdc17fdd260237d2f2e8366002d9f622253800f32360565e9cd2b404df6da70b2aef361bb6dccd38
SSDEEP 98304:hkCRoIZp6+Wvl3D1tBpzOUV3m+hVGiqhx0RHbNvR5D1toKOQ5MpIcRnVKN1f:SbmLclppiUFm+X1v7lD1tZOBFVK3f
TLSH
T1C24633ADB0D04C25DC5B5EB1D73E03E341E99E244B1AD9BAE4E888D12FC15A1BF385B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download