9d1f16e01d7771d499751daeff99773512803af4d61a2a94fb4a6666e5b93642

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 01:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_211758b47c35cc81dd7b35b9fcc98359_amadey_elex_loda_rhadamanthys_smoke-loader.exe
Size 2.0MB
Sample260812-bc9ctswcne
SHA256 9d1f16e01d7771d499751daeff99773512803af4d61a2a94fb4a6666e5b93642
MD5 211758b47c35cc81dd7b35b9fcc98359
SHA1 76a37439f425ba167f1a8d0644cd0ce0f570147b
SHA512 a75b7dcb832b3a622c0ec05c063e18f1f31c690fcf8182452a40575a4fb5514d50e4e2727694d844c4a64021231c789e23ee60941728aff7207879fa89b16bb4
SSDEEP 49152:gtrGEQDdEqHF1s1a82okOh+md+8c1eK6jOLFZ/DWmSzVjme:+aEAdEqHF1s89Oh+F8c1eB03/6mSzVjm
TLSH
T16895E091E245A8F9E40725B59C3ECA2624077E7C0AB9564F35CF722959B338231B7E0F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5352	EEA.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_211758b47c35cc81dd7b35b9fcc98359_amadey_elex_loda_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EEA.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5352	EEA.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 5352	2912	2026-08-11_211758b47c35cc81dd7b35b9fcc98359_amadey_elex_loda_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-11_211758b47c35cc81dd7b35b9fcc98359_amadey_elex_loda_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_211758b47c35cc81dd7b35b9fcc98359_amadey_elex_loda_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Users\Admin\AppData\Local\Temp\EEA.tmp
  "C:\Users\Admin\AppData\Local\Temp\EEA.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-11_211758b47c35cc81dd7b35b9fcc98359_amadey_elex_loda_rhadamanthys_smoke-loader.exe 8D912D479F31C99245E098A1F7D3F027C8BA968712E27A17964D9954E51B90F3AE796A222A41E741CB16DDFED55F9C3792ED30EDC0CA92815CD408DC2590036B
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EEA.tmp

Path C:\Users\Admin\AppData\Local\Temp\EEA.tmp
Size 2.0MB
SHA256 5062e54eb406c8eb9ace2d6e33ab3b126b7294cc72cf74f0160d2bfa921318c9
MD5 79b91f80d8ab208ebf6a9efdb7251d3e
SHA1 89877eb4081d7f16041f91dcd634b414da67cb11
SHA512 a9ca58b6b633e401e4f505fda004f0dc4d8dc49b4b2c58a8edee749373712b2b2f083e519c72b124c793c31b7759ff4d4ef4e8a8f4d8e9d1049442a3f4c68d52
SSDEEP 49152:gtrGEQDdEqHweyhLL2lVvgXiPt8svhk+4TzM611uzXe:+aEAdEqHq/2lVvgXgt8svhkh3M611OX
TLSH
T1B495E192F245ACE9D80311B55C79CA2224477E7D46B9564E36CF722989B338331B7E0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads