7ddb3f1e5ff2b66a6ad057f4b4f4acce5ef06127b197bfee03afe006929d435f

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 09:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_e40ec5912e75b6727fa9815dee97b4c8_amadey_elex_rhadamanthys_smoke-loader.exe
Size 1.1MB
Sample260814-lfnweazfre
SHA256 7ddb3f1e5ff2b66a6ad057f4b4f4acce5ef06127b197bfee03afe006929d435f
MD5 e40ec5912e75b6727fa9815dee97b4c8
SHA1 d4ece655cd8f1efd23d3df8d007a39303f12344b
SHA512 4045ebf70444dc7ec944a80424304a3c5af82f9a45bb3a41dba7851b61507f69c741529ed92d9fd57792f45335f7ab7722f76838b80423ddfba15e3835f3383a
SSDEEP 24576:S1A45BWLpBoMYl9tLbPtGU+NJcqCLtZJG0rU/vocEw:S115UdBoMYPtLbPtGlNJcpBZ3U/LF
TLSH
T177351274E28182F2E54604344A9ECBF76C397D7413669EC333EA0A793D612C2A736B57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2588	78B1.tmp

Executes dropped EXE 1 IoCs

pid	Process
2588	78B1.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_e40ec5912e75b6727fa9815dee97b4c8_amadey_elex_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	78B1.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2588	78B1.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 2588	3312	2026-08-14_e40ec5912e75b6727fa9815dee97b4c8_amadey_elex_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-14_e40ec5912e75b6727fa9815dee97b4c8_amadey_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_e40ec5912e75b6727fa9815dee97b4c8_amadey_elex_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Users\Admin\AppData\Local\Temp\78B1.tmp
  "C:\Users\Admin\AppData\Local\Temp\78B1.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-14_e40ec5912e75b6727fa9815dee97b4c8_amadey_elex_rhadamanthys_smoke-loader.exe 15ECBD425D744DC2CA944007E635673279BF8AE0C66FB516EC7B94F0B5593AE4EF6BD376E2AF1CA5A4CF2E63988A133C5101351AE58426C9D723C4BCF06C211D
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

78B1.tmp

Path C:\Users\Admin\AppData\Local\Temp\78B1.tmp
Size 1.1MB
SHA256 c7b3ebaac096991107b5f55c11f1378ffc9b0ea0de32a9da8481b89bf2cbe169
MD5 66a62bc6fdf21a93e272ff4136b4245d
SHA1 d88a0106589cfa126dabe72c7062a1ea5a3de604
SHA512 649ac138addd1759512576feb57a88928d51a076bb0e78260101e6c54932a3dba84ed56a3cb6b60a970d02aa6b71c2c1215c6fb33b9edb08733100dc1c0701ef
SSDEEP 12288:S1A45BwC8NhpGOjQ7yTENCoMLy7kbWoU7/XRfFMY4a0dFdIZ3f+M2zvtROW0NDpn:S1A45BWLpBoMYtoMkFdIQMmuFKoIRU
TLSH
T1CB3512A4E2D0C2F3D54244702A69CBF7AC397D7567664EC732E90AAD2D212C1F632367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads