35bd057d9161edbdb20642f06c38080a465cabb6891651e9e4e2895dbdece4d9

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 06:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_c5684332e69cb44415d7eea365d5ee82_elex_rhadamanthys_smoke-loader.exe
Size 687KB
Sample260814-hgpbsael21
SHA256 35bd057d9161edbdb20642f06c38080a465cabb6891651e9e4e2895dbdece4d9
MD5 c5684332e69cb44415d7eea365d5ee82
SHA1 02b792608f53867fc22b81dc6f851e728cc9115e
SHA512 cb929c4c9b8d5c729717d06a7d3997cfb1adea13d2fd3900bdc3507931fe27c46513ebce8aff0acb9664bd5c5104ea61ce64bd8acb6af1fa1d10981f99bb64d0
SSDEEP 12288:3kIS6tX4T2NfFM7Sq1cFWaFev7+0N1R9Dgec:3rX4a871NaYvaKR97c
TLSH
T123E4E01036C1C470E5A7023256AADF62547EFD724F94AACBB7C82A2D5E743D1A731B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3884	3DAB.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_c5684332e69cb44415d7eea365d5ee82_elex_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3DAB.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3884	3DAB.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3340 wrote to memory of 3884	3340	2026-08-14_c5684332e69cb44415d7eea365d5ee82_elex_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-14_c5684332e69cb44415d7eea365d5ee82_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_c5684332e69cb44415d7eea365d5ee82_elex_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3340
- C:\Users\Admin\AppData\Local\Temp\3DAB.tmp
  "C:\Users\Admin\AppData\Local\Temp\3DAB.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-14_c5684332e69cb44415d7eea365d5ee82_elex_rhadamanthys_smoke-loader.exe 87F90B9F4ABEDC874BE558A9987E7296AAB22679232487BE2BA74BDEB2DBD6081359B2A16C2816557B32BBD6EE671AA45350C136E12C625C0478EA0B1643CC04
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3DAB.tmp

Path C:\Users\Admin\AppData\Local\Temp\3DAB.tmp
Size 687KB
SHA256 ffc24eaaa7900ac1e9e6060bcaf38e40bdb37b28941ed493aea627d257f8b10c
MD5 5abf6873d57029f3aeece84aa6913cef
SHA1 b56a47920b8219338ede3f40be5d7bf27f5977b5
SHA512 65b89f7f9770b7ee950519707b0ebf8e23928df01598c0e42b456c183c158cf05032d64288cc8ac91a625cfb400ed1cdb1e8bf6d59ba8175c39bfc6e8031d99c
SSDEEP 12288:3kIS6tXsHzPl+/z7dZkbV0G3JDORFev7+0N1R9Dgec:3rXsH7cvkB6RYvaKR97c
TLSH
T1C2E4D02036C1C070E6A7463256A6DF62447EFD324FA4AACBB7C46A1D5DB02D1B734B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3340-5-0x0000000000AE0000-0x0000000000B8C000-memory.dmp

Download

memory/3884-6-0x0000000000F00000-0x0000000000FAC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads