66ac3b231bf5086c79963851df029b22c6ee6e6ea40e49528bdf41233681f975

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 22:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_c7ddbbb309e88419bb0272771ebac7e2_amadey_elex_rhadamanthys_smoke-loader.exe
Size 1.1MB
Sample260811-1682lashja
SHA256 66ac3b231bf5086c79963851df029b22c6ee6e6ea40e49528bdf41233681f975
MD5 c7ddbbb309e88419bb0272771ebac7e2
SHA1 d3fd64b2d175dadc51d1ecab75884aa62e43aa21
SHA512 b851411c28f968e9da3b00e8a15c64f61ac07b29c4147fcbe1f4e07dc04a407036c536d186b5500cdd86da07598a02686e9e5f5a90f89a55f8a370dbcd9416b8
SSDEEP 24576:5ooehoIa5NArZqUjqf/SWvG5Wh0Ma5RSlQRcTe0DETAIze3+0wES:5Rehe5NoZqqqfhGQh0LR01eaEo3NS
TLSH
T16A3512A4ADE1C2B2D84964354B49C7F66C6E3E380B23ADC337E61D7D2D241C266B6707
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5860	BCE.tmp

Executes dropped EXE 1 IoCs

pid	Process
5860	BCE.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BCE.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_c7ddbbb309e88419bb0272771ebac7e2_amadey_elex_rhadamanthys_smoke-loader.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5860	BCE.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4320 wrote to memory of 5860	4320	2026-08-11_c7ddbbb309e88419bb0272771ebac7e2_amadey_elex_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-11_c7ddbbb309e88419bb0272771ebac7e2_amadey_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_c7ddbbb309e88419bb0272771ebac7e2_amadey_elex_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4320
- C:\Users\Admin\AppData\Local\Temp\BCE.tmp
  "C:\Users\Admin\AppData\Local\Temp\BCE.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-11_c7ddbbb309e88419bb0272771ebac7e2_amadey_elex_rhadamanthys_smoke-loader.exe 5D40BDD5580C6302248A3E3B1F3A8F38F1F484BB1C153DA906233DEB0672FC4C761735EE5548FA24E005B91250B3794565AD94129D6BA79A39FE57FBB0A624A9
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BCE.tmp

Path C:\Users\Admin\AppData\Local\Temp\BCE.tmp
Size 1.1MB
SHA256 30cc2d86c58be9bd6e7fd64877373233218d67224347df6f3196d78aa3af285a
MD5 5201d8844f1e3b884f6c84bed0f9e5ae
SHA1 e9e1a63f2b4e5e8959e2b13873610a2a77c2376b
SHA512 cba048f0829649e4096f4fd28231f518f4b6ab9c09aaf1fb2a37272b13637a0c813cec9a97ce43b94fdc3fd2d57f759a8def9c16d770720765fd5a72c2c7ef24
SSDEEP 24576:5ooehoIa5NArZqUjqfeFIOZmB7gNU+XYchr9iRH:5Rehe5NoZqqqfnOUBENUUhruH
TLSH
T192351254BAA0C2B6C94950715F54CBF23CAA3C391B625DC737E02E6D6D202C2B7B6793
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads