a5e1a9b19bec207db243cada52d1e56c570d27dfe8f8d804df92204631bb429c

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 22:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_6e8fe201628207723c7fd46deb6c15f5_amadey_elex_rhadamanthys_smoke-loader.exe
Size 1.1MB
Sample260811-2mppaahb42
SHA256 a5e1a9b19bec207db243cada52d1e56c570d27dfe8f8d804df92204631bb429c
MD5 6e8fe201628207723c7fd46deb6c15f5
SHA1 0f6eac80d3c3075ed47d4f870e37e14a011a169d
SHA512 bc194864724c6f3c933f4881beb881da9754eafc564b4ab193665bd5ab7fb9688b8970a54218ca7164bf69d6f39ee5c3d69f0737a89d392168fc1b6976a25ddb
SSDEEP 24576:5ooehoIa5NArZqUjqfP9F0x2Awqs5RAp7x1KGGVG6pxec3aTDq:5Rehe5NoZqqqflF0x2A7yRBE6zec8m
TLSH
T1F73512A8AAA0C3F2C84954719B0AC7F27C793C341751EECB37D51B6C6E601C2A67A753
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4892	2C17.tmp

Executes dropped EXE 1 IoCs

pid	Process
4892	2C17.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_6e8fe201628207723c7fd46deb6c15f5_amadey_elex_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2C17.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4892	2C17.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 4892	1836	2026-08-11_6e8fe201628207723c7fd46deb6c15f5_amadey_elex_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-11_6e8fe201628207723c7fd46deb6c15f5_amadey_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_6e8fe201628207723c7fd46deb6c15f5_amadey_elex_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Users\Admin\AppData\Local\Temp\2C17.tmp
  "C:\Users\Admin\AppData\Local\Temp\2C17.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-11_6e8fe201628207723c7fd46deb6c15f5_amadey_elex_rhadamanthys_smoke-loader.exe D072DB2FE72D876016AEE6242C1154D860029D00162614242C314BA145F8F284F6834C328D53927E511A22B070A496AA758A78FE08510CDF4033A96E9B16445F
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2C17.tmp

Path C:\Users\Admin\AppData\Local\Temp\2C17.tmp
Size 1.1MB
SHA256 c1a553414ff42e3b1f97d8c895e69a7f67537dc1777d1c935b732f713308bc0d
MD5 5149bc866487854860aee7895643f8b8
SHA1 d96bad9e8bd37d3667410b8b0ed5e5a3eec8d3e9
SHA512 67594ef3977af8bdcc58f5625c10d617b50fe47fa288a65702d43e826ec42e4679c7da397ef28e257d5277b2ff8cf8655f4cd7575b8bf48b532d707623fa0b62
SSDEEP 24576:5ooehoIa5NArZqUjqfb4ycOXodXO4UX6Ga++qFjX0PO:5Rehe5NoZqqqfRck4k6Gv+qFjEPO
TLSH
T1733512A4AAA1C3B2C54914704B99CBF72C3978381B669DC337E50E6C7D202C3A77675B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads