4ab2ba74b879b018d2d1de60d15bd9b2975f7d9aaab31ca838f42384bca0ab17

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 23:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_92adc36634c91485895066361d9c1586_elex_rhadamanthys_smoke-loader.exe
Size 687KB
Sample260816-3dadnsbr2x
SHA256 4ab2ba74b879b018d2d1de60d15bd9b2975f7d9aaab31ca838f42384bca0ab17
MD5 92adc36634c91485895066361d9c1586
SHA1 d47b66b75cb72949385a9bf98fbee21b0a937975
SHA512 83ce97b1adb22d0f6cfb92523b44757edb56d2f0b35e9ffb5edef231d75abc7c4be4cf836b472ccd1a2d6587613c832bf77be312fb0933eece50838c3f347c5d
SSDEEP 12288:3kIS6tXaaoi8WSUaq5rxN7wdzFev7+0N1R9Dgec:3rXlnaqp8dzYvaKR97c
TLSH
T1B0E4E01036C2C070E5A6063646A5DF62547EFD324FA09ACBB7D82A1D1EB42D1EB35B73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4948	ADCA.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_92adc36634c91485895066361d9c1586_elex_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ADCA.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4948	ADCA.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 924 wrote to memory of 4948	924	2026-08-16_92adc36634c91485895066361d9c1586_elex_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-16_92adc36634c91485895066361d9c1586_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_92adc36634c91485895066361d9c1586_elex_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:924
- C:\Users\Admin\AppData\Local\Temp\ADCA.tmp
  "C:\Users\Admin\AppData\Local\Temp\ADCA.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-16_92adc36634c91485895066361d9c1586_elex_rhadamanthys_smoke-loader.exe D8BD21BB4940B102FD3477BE16A177D2838C6C734C980820557A7BBC5227189AF4BEAB88B011F9F441E8B693425C0297BEB3DB65B815FEF6F3BB4AE42A4B5086
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ADCA.tmp

Path C:\Users\Admin\AppData\Local\Temp\ADCA.tmp
Size 687KB
SHA256 9b0b78c6b6269693503bf6067bbfe83e51ead27a2681b20c7fc09e4a3fdbfe9c
MD5 da4bcfdaaf7aef1ea9343286f661feb8
SHA1 3ce127ec131c4ea9b8e6ec3dfcc893b9dc037f51
SHA512 441073bf58e83ce2add44fc8bc3d81de9677abe6907845ddf5fab91b3c019851ad0c6aa2bebbd17cd43e747a8232ddf4062f30d0b5f16db9852fa7a638e3504e
SSDEEP 12288:3kIS6tX0mPUV+C7e2o/xXLCN5dgvLnFev7+0N1R9Dgec:3rXrcE2opXmNwvrYvaKR97c
TLSH
T1C0E4E06036C1C070E5A7023256AAEF62447EFD364FA09ECBB7C86A1D1D706D1A735B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/924-4-0x00000000007B0000-0x000000000085C000-memory.dmp

Download

memory/4948-6-0x00000000008C0000-0x000000000096C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads