2a7286b607934e64c980350a9b265b6e2f0da2586737e6d38d955a0c775b155f

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 12:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_787f4de092cb3da295b8313d7770b56c_elex_rhadamanthys_smoke-loader.exe
Size 687KB
Sample260820-pl4etsxamh
SHA256 2a7286b607934e64c980350a9b265b6e2f0da2586737e6d38d955a0c775b155f
MD5 787f4de092cb3da295b8313d7770b56c
SHA1 16cc6efebba5bd9cc35b07a1573f6b239d6821f2
SHA512 d1808709fdf6675bd9c470aaa9960198cf0c35a3592f64ef0555391d0b83231010dba65e4f36f4d3fc74ff491937a12280521615b66c46b3583bb1fd422d0ac9
SSDEEP 12288:3kIS6tXopu9X5pjTKtx4rX7MuCqUFev7+0N1R9Dgec:3rXx9bGQ/DUYvaKR97c
TLSH
T137E4E02036C1C070E1A7463256A6DF62547EFD764FA4AECBA7C82A1D4D707D1AB30B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4928	F0B4.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_787f4de092cb3da295b8313d7770b56c_elex_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F0B4.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4928	F0B4.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 4928	3116	2026-08-20_787f4de092cb3da295b8313d7770b56c_elex_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-20_787f4de092cb3da295b8313d7770b56c_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_787f4de092cb3da295b8313d7770b56c_elex_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Users\Admin\AppData\Local\Temp\F0B4.tmp
  "C:\Users\Admin\AppData\Local\Temp\F0B4.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-20_787f4de092cb3da295b8313d7770b56c_elex_rhadamanthys_smoke-loader.exe 81A89CAC5404AEE9C7ED813D757197ABDCD61B2B5CE84A0FF7864183D0C81EDDD079FBC58B8030272EFC966C20215BC7E97A78F0D839655FCE752D4DC41C89EA
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F0B4.tmp

Path C:\Users\Admin\AppData\Local\Temp\F0B4.tmp
Size 687KB
SHA256 76407d50ba02474e48345d73df86ae9a58f06d742a6490946bc1ec69b10db988
MD5 ee70d9ccf95dd183b55900fd9983447c
SHA1 7e92faf1ff3fa59a02612157553904f32d5fb3d4
SHA512 fbb8e028857d1831d426fb97d2ac223417480601a3aec46fbab45c2eb401838f6868c7e21798315f8967ece3aa9ba513a5c06978764b7ec0958f8219cc9e60fb
SSDEEP 12288:3kIS6tX6zCpf8TWrkLJjnH7Fev7+0N1R9Dgec:3rXzEC0jnbYvaKR97c
TLSH
T109E4DF6036C1C070E6A7063246A9DF6354BEFD714B609ECBB7C82A5E5A742D1A730B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3116-5-0x0000000000D20000-0x0000000000DCC000-memory.dmp

Download

memory/4928-6-0x0000000000820000-0x00000000008CC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads