a5e1a9b19bec207db243cada52d1e56c570d27dfe8f8d804df92204631bb429c

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/08/2026, 22:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_6e8fe201628207723c7fd46deb6c15f5_amadey_elex_rhadamanthys_smoke-loader.exe
Size 1.1MB
Sample260811-2mppaahb42
SHA256 a5e1a9b19bec207db243cada52d1e56c570d27dfe8f8d804df92204631bb429c
MD5 6e8fe201628207723c7fd46deb6c15f5
SHA1 0f6eac80d3c3075ed47d4f870e37e14a011a169d
SHA512 bc194864724c6f3c933f4881beb881da9754eafc564b4ab193665bd5ab7fb9688b8970a54218ca7164bf69d6f39ee5c3d69f0737a89d392168fc1b6976a25ddb
SSDEEP 24576:5ooehoIa5NArZqUjqfP9F0x2Awqs5RAp7x1KGGVG6pxec3aTDq:5Rehe5NoZqqqflF0x2A7yRBE6zec8m
TLSH
T1F73512A8AAA0C3F2C84954719B0AC7F27C793C341751EECB37D51B6C6E601C2A67A753
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3752	AA35.tmp

Executes dropped EXE 1 IoCs

pid	Process
3752	AA35.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AA35.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_6e8fe201628207723c7fd46deb6c15f5_amadey_elex_rhadamanthys_smoke-loader.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3752	AA35.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 3752	1700	2026-08-11_6e8fe201628207723c7fd46deb6c15f5_amadey_elex_rhadamanthys_smoke-loader.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-08-11_6e8fe201628207723c7fd46deb6c15f5_amadey_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_6e8fe201628207723c7fd46deb6c15f5_amadey_elex_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Users\Admin\AppData\Local\Temp\AA35.tmp
  "C:\Users\Admin\AppData\Local\Temp\AA35.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-11_6e8fe201628207723c7fd46deb6c15f5_amadey_elex_rhadamanthys_smoke-loader.exe 33A60DF5681A0ABB22A6B1F38FF95B06D237EE6A70033AC14FDC98B1EE1F78949DD467AA2C3909B26BCE4B770D8BDB0B2E604171CA4EAD69A83B9EFD3BDAB71C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AA35.tmp

Path C:\Users\Admin\AppData\Local\Temp\AA35.tmp
Size 1.1MB
SHA256 558ad79d1598c26e479c8f99a93d6611b6725a9a96dfd5275038b2b9d659ef1d
MD5 e476f1c5c3a05bed5355cb153543390f
SHA1 616fe46b603e14d74f52dcd04f25ddd243b73f50
SHA512 7f51b52ced4c056c02a78312c37d015a4594d35560286ed4101d80d1682c6f0b9bc3191dfdb7bd7847d5f22d20fe80b00531614f242daf526fa6f6bae2bbf191
SSDEEP 24576:5ooehoIa5NArZqUjqf0FD+J8MEiGOFpLW6Hxe/aedqYkefV:5Rehe5NoZqqqfdJ9pLW6H+TPV
TLSH
T1FE351268BA90C2B2D44854705B09C7F76C2A7D3507619EC333E91B6D6E202C3AA777A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads