3b9f5da8b90c0cd4376d641658208e434f12db00f3450bb54989d0a81623683f

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 03:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_8affa47ef71c989e1065b8d2e88de971_amadey_elex_loda_rhadamanthys_smoke-loader.exe
Size 2.3MB
Sample260815-d45j3adf56
SHA256 3b9f5da8b90c0cd4376d641658208e434f12db00f3450bb54989d0a81623683f
MD5 8affa47ef71c989e1065b8d2e88de971
SHA1 575b119a2e261ac5a881f1f9a571f1641c93698a
SHA512 bb77376bbad666300230b324a586430f0bde92da713fb075ca53af28e52cd281d49ff0fb1a4630be3cad572744018069bfbd8c4cde03005710270f553f5c6b18
SSDEEP 24576:BUarjXeXhAiLT27D+Yd9t3J/WG6rtjBtWcVgkXWH4xiQB4/ulo5mm84Qj1EIzS8D:BtrqOMudxX6rtZVFDjmPQpEKhG
TLSH
T145B5AEA2F245ACEDE80715B59C7DCA2124477E7D4AB9560E358F722985B338230B7E0F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4812	FB6.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_8affa47ef71c989e1065b8d2e88de971_amadey_elex_loda_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FB6.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4812	FB6.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 4812	2892	2026-08-15_8affa47ef71c989e1065b8d2e88de971_amadey_elex_loda_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-15_8affa47ef71c989e1065b8d2e88de971_amadey_elex_loda_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_8affa47ef71c989e1065b8d2e88de971_amadey_elex_loda_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Users\Admin\AppData\Local\Temp\FB6.tmp
  "C:\Users\Admin\AppData\Local\Temp\FB6.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-15_8affa47ef71c989e1065b8d2e88de971_amadey_elex_loda_rhadamanthys_smoke-loader.exe D1DE7D77292016330B737C5CD706FDD75B08256A3AE21B1F095591940F70197C72A5D52323D305DF107D16BF5A38162A769CCE03A647AAD558A2DA633E53C017
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FB6.tmp

Path C:\Users\Admin\AppData\Local\Temp\FB6.tmp
Size 2.3MB
SHA256 8fcc0ad0a3e2ed2a6898d20cb51f4df4e48fb88ed16ac49706ae3915500827e1
MD5 7139deba3dfe42d31b29ed6e42cf49aa
SHA1 9141bc256cfd0f66e60ca04e2da3f07551bbde19
SHA512 44fc0a5b1c813ad4eef34da325b8a7daa37be0fce1aa8cb8aa0316a26ceb0f15c7319dde2c1d8a0e4a9449eabbfcbe154c80841d39bde36d05c6cda950b5c570
SSDEEP 49152:BtrqOMudxX6rfTJVRuaoyooGd0LKbsCtKhG:DWOBdxX6rbJVYLP0LKJts
TLSH
T1C2B5AF92F245ACE9E80715B59C7DCA2124477E7D4AB9560E358F722A85B338330B7E0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads