66ac3b231bf5086c79963851df029b22c6ee6e6ea40e49528bdf41233681f975

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/08/2026, 22:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_c7ddbbb309e88419bb0272771ebac7e2_amadey_elex_rhadamanthys_smoke-loader.exe
Size 1.1MB
Sample260811-1682lashja
SHA256 66ac3b231bf5086c79963851df029b22c6ee6e6ea40e49528bdf41233681f975
MD5 c7ddbbb309e88419bb0272771ebac7e2
SHA1 d3fd64b2d175dadc51d1ecab75884aa62e43aa21
SHA512 b851411c28f968e9da3b00e8a15c64f61ac07b29c4147fcbe1f4e07dc04a407036c536d186b5500cdd86da07598a02686e9e5f5a90f89a55f8a370dbcd9416b8
SSDEEP 24576:5ooehoIa5NArZqUjqf/SWvG5Wh0Ma5RSlQRcTe0DETAIze3+0wES:5Rehe5NoZqqqfhGQh0LR01eaEo3NS
TLSH
T16A3512A4ADE1C2B2D84964354B49C7F66C6E3E380B23ADC337E61D7D2D241C266B6707
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2172	1F3B.tmp

Executes dropped EXE 1 IoCs

pid	Process
2172	1F3B.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_c7ddbbb309e88419bb0272771ebac7e2_amadey_elex_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1F3B.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2172	1F3B.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 2172	1736	2026-08-11_c7ddbbb309e88419bb0272771ebac7e2_amadey_elex_rhadamanthys_smoke-loader.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-08-11_c7ddbbb309e88419bb0272771ebac7e2_amadey_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_c7ddbbb309e88419bb0272771ebac7e2_amadey_elex_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Users\Admin\AppData\Local\Temp\1F3B.tmp
  "C:\Users\Admin\AppData\Local\Temp\1F3B.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-11_c7ddbbb309e88419bb0272771ebac7e2_amadey_elex_rhadamanthys_smoke-loader.exe 5E49F4A8D98E483951420F296881983150C2E61DEF9895BF8D7B15E04C838BB95133323538EBD8C5B890D83E4506A3A68992144F0570606BAC2D48D0D39531D0
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1F3B.tmp

Path C:\Users\Admin\AppData\Local\Temp\1F3B.tmp
Size 1.1MB
SHA256 0d425e7b3f6a9a2de60c7e0baa46fd28ab19cf8896575d165c73ebac72b24981
MD5 5ead662602326d333b518cda738c578a
SHA1 63f55be1585dd5baf6570cec737b3395b3f17e30
SHA512 516131beefe2e2f8a8caff326e54aae5b12d136e7065537045636224e4737716ac32ff017169898d230cebc619a171c87cdc2b9adc54699037ffa5a6bbf22695
SSDEEP 24576:5ooehoIa5NArZqUjqfvxEb25/p7YB+3agrHjKeBqK/Bd:5Rehe5NoZqqqfv6b2Td3aQL3
TLSH
T187351224AAE0C2B6D44961749B45CBF32D7E3C3447629EC337DA0E6D6D202C267B6763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads