c1304295cb6cef36c0df097bc727eee1916097c3356443ed729404336e0b0897

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_c8ae67e12e8d5a45fabc37c75e75639b_elex_rhadamanthys_smoke-loader.exe
Size 687KB
Sample260819-e1ckjswfqe
SHA256 c1304295cb6cef36c0df097bc727eee1916097c3356443ed729404336e0b0897
MD5 c8ae67e12e8d5a45fabc37c75e75639b
SHA1 a68001d735329fe69714a36f5e0a2cc18ffaa53b
SHA512 014e31c831ef4411907239ac86bca434dc84c96ee2f469e82c9f8aa9db75a78da8e471bd6f9c07c8fc7f356a24f24a876f76ea4a6c8161d2c299cb8e2e9bc824
SSDEEP 12288:3kIS6tXcDfW+9w0BoGeTvmyAv3Fev7+0N1R9Dgec:3rX1+q0BZAv63YvaKR97c
TLSH
T1F0E4E02035C1C070E6A7063256AADF22547EFD364F609ECBBBC82A1D5E706D1A735A73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3856	C05D.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_c8ae67e12e8d5a45fabc37c75e75639b_elex_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C05D.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3856	C05D.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 3856	800	2026-08-19_c8ae67e12e8d5a45fabc37c75e75639b_elex_rhadamanthys_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-19_c8ae67e12e8d5a45fabc37c75e75639b_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_c8ae67e12e8d5a45fabc37c75e75639b_elex_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:800
- C:\Users\Admin\AppData\Local\Temp\C05D.tmp
  "C:\Users\Admin\AppData\Local\Temp\C05D.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-19_c8ae67e12e8d5a45fabc37c75e75639b_elex_rhadamanthys_smoke-loader.exe E08EAA3F7BF3195C2A2960A3EAA1B496EC9FF237AFEB0FC708C95F492B9387B584154759792A7ED0334DF0996BDE216BFE289B102BC4C59E687BB1A5B822CE4D
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C05D.tmp

Path C:\Users\Admin\AppData\Local\Temp\C05D.tmp
Size 687KB
SHA256 b811103c38f8e4beb384f197b93b2310e39e43f55f8456a9757c2d52fc0700e3
MD5 833199fef37a234d4b02ec57b951d57d
SHA1 87bb4b09d1f9ba0b94dc614c0a80724440c6e0e4
SHA512 fc6a6792625e326c535e1995e7645641b2561693c7bf28cd1b10d9bd272d3c573af0b5e68dffc9b573d0cfb8e3af431c8dfe9701c7d1ea05f8111a2501a0b06e
SSDEEP 12288:3kIS6tXvmIkkP6NhlDIAVPWOZFev7+0N1R9Dgec:3rXvmNa6TRzNZYvaKR97c
TLSH
T16FE4D02176C1C070E5A6063296AADF62447EFC364FA09ECBB7C82A1D5D707D1A734B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/800-5-0x0000000000210000-0x00000000002BC000-memory.dmp

Download

memory/3856-6-0x0000000000130000-0x00000000001DC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads