03e53bc8e7fff01f3c4d857dc4268fdad5817069e9f1ca6a327ba4191ac21aad

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 07:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_d315c1fc37f887830be7d231187a5ecc_amadey_elex_karagany_rhadamanthys_smoke-loader.exe
Size 606KB
Sample260930-jf6ecaydpa
SHA256 03e53bc8e7fff01f3c4d857dc4268fdad5817069e9f1ca6a327ba4191ac21aad
MD5 d315c1fc37f887830be7d231187a5ecc
SHA1 3c3ee93a49062bfd5a0d0091f5e6f414fc1f0dc7
SHA512 ffbd746fbc4173c74230b24a7a848cd60b036fad50d9f4f33e3ffcda9241f0c9232f5f670808ef6a65f782271448b16415e29becb7156249e4d36a3a21cabe08
SSDEEP 12288:G50dyoltrbcsOsbZ1ThG8DSVVUWc7yAa4OdMr5zkN/EMx0fVPG:mol9b0sbTldKcyAa4gkkNsMx7
TLSH
T1BFD4F110B7E0C035F6F322F949BA9379A92D7DB19B28C5CB63D116E666346E09C30397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1776	4912	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_d315c1fc37f887830be7d231187a5ecc_amadey_elex_karagany_rhadamanthys_smoke-loader.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-30_d315c1fc37f887830be7d231187a5ecc_amadey_elex_karagany_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_d315c1fc37f887830be7d231187a5ecc_amadey_elex_karagany_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4912
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 268
  2⤵
  - Program crash
  PID:1776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4912 -ip 4912
1⤵
PID:3540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4912-1-0x0000000002CF0000-0x0000000002DF0000-memory.dmp

Download

memory/4912-2-0x0000000002F50000-0x0000000002FBB000-memory.dmp