8f99dcf27ed408b22b0c365e9e47d95a8cab77997e34cb64372e9183e968f8ab

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 11:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_1a614b64cc3028315b7c1f60e52799b2_elex_rhadamanthys_smoke-loader.exe
Size 687KB
Sample260809-nbsd5szwas
SHA256 8f99dcf27ed408b22b0c365e9e47d95a8cab77997e34cb64372e9183e968f8ab
MD5 1a614b64cc3028315b7c1f60e52799b2
SHA1 936a933c58743bd0f30f85323f16892231b19c12
SHA512 ed2fbcf6ca175d05099de9907432fb8e4d4667b8429366651b31f397b5bc69a55c32ab22f8e960c70b410ca5b934f80e12937b706d27d4405538a90c537dcbb5
SSDEEP 12288:3kIS6tXb4OHWdwL6gnN6VbP2hIgKTFev7+0N1R9Dgec:3rXck6d4UYvaKR97c
TLSH
T14EE4E02076D1C030E5A6063646A6DF6254BEFD724FA19ECBB7C82A1D09707E1A734B73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4544	83.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_1a614b64cc3028315b7c1f60e52799b2_elex_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	83.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4544	83.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6076 wrote to memory of 4544	6076	2026-08-09_1a614b64cc3028315b7c1f60e52799b2_elex_rhadamanthys_smoke-loader.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-09_1a614b64cc3028315b7c1f60e52799b2_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_1a614b64cc3028315b7c1f60e52799b2_elex_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6076
- C:\Users\Admin\AppData\Local\Temp\83.tmp
  "C:\Users\Admin\AppData\Local\Temp\83.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-09_1a614b64cc3028315b7c1f60e52799b2_elex_rhadamanthys_smoke-loader.exe 278E46135BBFED399A9CF5DC835AE468D72C66B142A6AFA8861FCF65959ADEFCC711512C257A1527B60B4007CD8DEBC4425CD21D8D23F24AB8F2CC03933D8E56
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

83.tmp

Path C:\Users\Admin\AppData\Local\Temp\83.tmp
Size 687KB
SHA256 c1b0cb825fc48633d01ab8fc1d7b58e315075a751a9b8198e0845ccd8a8344bb
MD5 637c5c7fe8eb175a9a82478b2c39a4a5
SHA1 4a2cde85bc456babb0b5bc095d75d2f1a72fbc70
SHA512 547fe75cee8765e263ca8af18786ef9ff62b577451ccbd00e8c5b29f6d8c4d2595e7649d958a6acf85f39199c80f88eaadeaaa57e3dbeb299d164f75dfe1116c
SSDEEP 12288:3kIS6tXTndEwiUAXnHFev7+0N1R9Dgec:3rX0UA3YvaKR97c
TLSH
T150E4E02036C1C030E6E7063256A6DE22547EFD724FA19ECBB7C82A5D5E706D0A735B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4544-6-0x0000000000770000-0x000000000081C000-memory.dmp

Download

memory/6076-4-0x00000000007C0000-0x000000000086C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads