9f2c5fdb15ac0fd4ccaa6a1edddf5c9a322c6d7a8514bfd912b896180f58bb95

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_1bfd1d9f0e50fa445b82818718631692_elex_rhadamanthys_smoke-loader.exe
Size 687KB
Sample260811-eav9zavfnd
SHA256 9f2c5fdb15ac0fd4ccaa6a1edddf5c9a322c6d7a8514bfd912b896180f58bb95
MD5 1bfd1d9f0e50fa445b82818718631692
SHA1 e4c1b4a06a3e6df06a4e43f8148715d4ea578f48
SHA512 f4bfac428b95b58fcefbfdc6b28be4d6ba1ac06eb98471b074af7a1a4207299f45ce19588e61901e9c8bfbb9fb31161bd068fa7e2c9915600158f2c927550df2
SSDEEP 12288:3kIS6tXQqd0nSzgOa5eZaJ1LhYQfaFev7+0N1R9Dgec:3rXf0SsOfONYOaYvaKR97c
TLSH
T19DE4E01436C1C030E6B7463246A9DE6255BEFD360F909ECBB7C86A5D1A703D1AB30A73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1044	7CA8.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_1bfd1d9f0e50fa445b82818718631692_elex_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7CA8.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1044	7CA8.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 616 wrote to memory of 1044	616	2026-08-11_1bfd1d9f0e50fa445b82818718631692_elex_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-11_1bfd1d9f0e50fa445b82818718631692_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_1bfd1d9f0e50fa445b82818718631692_elex_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:616
- C:\Users\Admin\AppData\Local\Temp\7CA8.tmp
  "C:\Users\Admin\AppData\Local\Temp\7CA8.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-11_1bfd1d9f0e50fa445b82818718631692_elex_rhadamanthys_smoke-loader.exe 961FFBDCA6C7B15C3749E6DEAA9218DDFBF4E1B7065220077A7D34EC60F07E9A8EFDAF033E0FC8983746737034E94DD54662B23B69BAD58D3F9AE3E4348D1666
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7CA8.tmp

Path C:\Users\Admin\AppData\Local\Temp\7CA8.tmp
Size 687KB
SHA256 411c1ad052740323037848bb0febd53c78bc0eec76801892f8ea79ddc78b8a48
MD5 b489c3bbf3094a00af788b36bc90793d
SHA1 51a149b354938b1b71cd075d90eef37c99e25a88
SHA512 200a0999924d098ea762ee94c76dfaddee6276eab02346b1a050bbe8fbc7a7404e6a5954451a1fab4fdd653dcdf7094efdffb9fd655b59b1c195408535886797
SSDEEP 12288:3kIS6tXQm2mjHnoFlHaFev7+0N1R9Dgec:3rXXulHaYvaKR97c
TLSH
T117E4E01035C1C430E6A7063246A6EF66547EFD724F60AECBB7C42A1D5AB03D1AB35B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/616-4-0x0000000000CC0000-0x0000000000D6C000-memory.dmp

Download

memory/1044-6-0x0000000000880000-0x000000000092C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads