6f42baa22be5c32decd7302782b8b147687025e4ab5500b09378f10d70f0506d

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 14:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_38d82ab0f1d32454f057e6c1889a26aa_amadey_elex_rhadamanthys_smoke-loader.exe
Size 71KB
Sample260905-rcfcrawdmf
SHA256 6f42baa22be5c32decd7302782b8b147687025e4ab5500b09378f10d70f0506d
MD5 38d82ab0f1d32454f057e6c1889a26aa
SHA1 5ea7398b6d81018c39a5c1e79a129e4adba5dea7
SHA512 dc7e2a29d6f0f86f9b99d94a5ae8bc43743aa4b684b04bae46c746c726f7adf3209e15b93d0fdd24b4322b9a2c2a93f753f4b3697cb8a64ab96ecfe68b7a56f4
SSDEEP 1536:tmhihHf+UWr5kkjk/HhdPd1qvBXG9YX/ETBsNmjhao9dm:EMR+UW63Pd12A9YX/csNmjh3
TLSH
T142634A027390C8B6F47246340C69DA21561BBC6997F0858F3B8D72AE6FB17824DFA317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4720	3364	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_38d82ab0f1d32454f057e6c1889a26aa_amadey_elex_rhadamanthys_smoke-loader.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-04_38d82ab0f1d32454f057e6c1889a26aa_amadey_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_38d82ab0f1d32454f057e6c1889a26aa_amadey_elex_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3364
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3364 -s 288
  2⤵
  - Program crash
  PID:4720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3364 -ip 3364
1⤵
PID:1868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3364-0-0x0000000000408000-0x0000000000409000-memory.dmp

Download