daaedb1e3be8318c91cfdb5d56172d6812cb181fa5c41fc4c9d9b72dfcec86af

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 22:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_6f3abc95ad357c32bad9efdd6ec4df10_amadey_elex_loda_rhadamanthys_smoke-loader.exe
Size 2.3MB
Sample260813-2k5bysy1e1
SHA256 daaedb1e3be8318c91cfdb5d56172d6812cb181fa5c41fc4c9d9b72dfcec86af
MD5 6f3abc95ad357c32bad9efdd6ec4df10
SHA1 ddaf73cdda826fa21ba1432608b5e86162d42ca6
SHA512 93dbdfa0cd276dd09b279837f8dc2b8c5c8c40508d6d08c2f9acc1d38efa7251c3bb88de192a168b561a66d84339b781b1a91dc6bcba37b6d0070004d7010026
SSDEEP 49152:BtrqOMudxX668iCKmEmSiLHU+1EDhp0vtQKhG:DWOBdxX66QKVkHUP0lQs
TLSH
T1CCB5AF92F245ACE9E80325B59C7DCA2124477E7D4AB9560E358F722995B338330B7E0F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5544	AC73.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_6f3abc95ad357c32bad9efdd6ec4df10_amadey_elex_loda_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AC73.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5544	AC73.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 5544	2160	2026-08-13_6f3abc95ad357c32bad9efdd6ec4df10_amadey_elex_loda_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-13_6f3abc95ad357c32bad9efdd6ec4df10_amadey_elex_loda_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_6f3abc95ad357c32bad9efdd6ec4df10_amadey_elex_loda_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Users\Admin\AppData\Local\Temp\AC73.tmp
  "C:\Users\Admin\AppData\Local\Temp\AC73.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-13_6f3abc95ad357c32bad9efdd6ec4df10_amadey_elex_loda_rhadamanthys_smoke-loader.exe 8213C0507A6D7223E8A9F44AAFC69FCDDF8DBF0FE0D1C0F6020B3FB08A2AD309044F035B1D591287AACB8F00DBD3749DE26599B5E94BE83F7407B83B05091568
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AC73.tmp

Path C:\Users\Admin\AppData\Local\Temp\AC73.tmp
Size 2.3MB
SHA256 4c57fbfa0d73e961c75f57e2384b297175203cb96e7efbff0629623b038b79b1
MD5 59b15df0e506e8407210a81f8f8cfe31
SHA1 989ddf80b2279a0df6f2f8e7109afce3b8f8cb0f
SHA512 61202d844995bd2faa07fe26d396d9113503ab04fc25a47d1636a7444e7d257cf72a495fd7f13c4951b2ab9c9b7ad4ae923b0e3422f9e6c4d8762981759f8768
SSDEEP 49152:BtrqOMudxX6X9SX5z3PsvnWElSL1W8I2UoKhG:DWOBdxX6W7s+ElSxE2Ns
TLSH
T169B5AF92F245ACE9E80725B59C7DCA2114077E7D4AB9560E358F722A95B338330B7E0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads