037b1c73866f3c145059c13b1e9a51c9e36ba9f24b5c076694109e34636c22a1

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/09/2026, 05:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-07_28703966b7f61f99a6dbec01cef761b3_elex_rhadamanthys_smoke-loader.exe
Size 687KB
Sample260909-frnf5aah79
SHA256 037b1c73866f3c145059c13b1e9a51c9e36ba9f24b5c076694109e34636c22a1
MD5 28703966b7f61f99a6dbec01cef761b3
SHA1 5078952e914d4154b4a086cd2ef4f1ec7ec45b42
SHA512 f3d42f0e9332f4d76bf5dbcfeab5fcdbec2f8487bb5e5ec26bd85a6b887776cd695983b213c2733e0bf5d2e7822bed31de79625b13d87a912522a957bbf58767
SSDEEP 12288:3kIS6tXbjIfYAf/A5eU9ezIdS8Fev7+0N1R9Dgec:3rXHIgoAwU9ezIdS8YvaKR97c
TLSH
T1A6E4E01076C1C030E5A7063256AADF66487EFD724F60AACBB7C82A5C5E743D1A731B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5700	F865.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-07_28703966b7f61f99a6dbec01cef761b3_elex_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F865.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5700	F865.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4488 wrote to memory of 5700	4488	2026-09-07_28703966b7f61f99a6dbec01cef761b3_elex_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-09-07_28703966b7f61f99a6dbec01cef761b3_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-07_28703966b7f61f99a6dbec01cef761b3_elex_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4488
- C:\Users\Admin\AppData\Local\Temp\F865.tmp
  "C:\Users\Admin\AppData\Local\Temp\F865.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-09-07_28703966b7f61f99a6dbec01cef761b3_elex_rhadamanthys_smoke-loader.exe B78EC6AD942C2AA67EF80AF778842FD58374D261DA22941227653FB7D79ABF71129351CF2D68C0FC084410F4C7989A1315678643FB9D69A89AD2E73E40079BB9
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F865.tmp

Path C:\Users\Admin\AppData\Local\Temp\F865.tmp
Size 687KB
SHA256 58ef46c6ae194702167fefbec9ef3da028b27fadd5f7ab052af93b58deec1e2e
MD5 5077ef073f02be681bc0dfd7f9b2652c
SHA1 eac7239317d4332203c22b6e00b49ed12b879db1
SHA512 61092914abb22f5abcc1afab82ba6136888b3efc444031354814a0120bab744c76226b8d50116ef41de269a8fbf9846b6ed48060d6afc3c377770e6f43a1b6dc
SSDEEP 12288:3kIS6tXc7784+T5Xtl9VdjT0MmmSFev7+0N1R9Dgec:3rXc7CJPdM1YvaKR97c
TLSH
T142E4E02036D1C030E2E706324AAADE62547EFD714FA09ACBB7C86A1D59707D1E774B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4488-5-0x0000000000350000-0x00000000003FC000-memory.dmp

Download

memory/5700-6-0x00000000005A0000-0x000000000064C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads