784851f4cf075769658d4923cb09b90ace2bbe12f3b09f386e31e194ddb90876

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 13:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_5c67111b0d5cff1e137dc3d0184f8b7d_elex_rhadamanthys_smoke-loader.exe
Size 687KB
Sample261002-q7qljaybpg
SHA256 784851f4cf075769658d4923cb09b90ace2bbe12f3b09f386e31e194ddb90876
MD5 5c67111b0d5cff1e137dc3d0184f8b7d
SHA1 9f724700ca1a3c22039462a2e0276078cd024346
SHA512 44a0e05a0339fcf9c0a37e09f37d0b629d76069480eb62ea48c9316ccd117192fea31e9b4f1c1b5894d20005c371aee1333fd4ec37c3e36a9ea31a3f9240cca5
SSDEEP 12288:3kIS6tX7Sm9WpD28yE+5eJH4c0xR2zmOFev7+0N1R9Dgec:3rXVDc6OYvaKR97c
TLSH
T1B2E4E01176C1C030E5A702325AA5DE23887EFD764F649ECBBBC42A1D5E702D1AB31B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4336	9D40.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-01_5c67111b0d5cff1e137dc3d0184f8b7d_elex_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9D40.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4336	9D40.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6124 wrote to memory of 4336	6124	2026-10-01_5c67111b0d5cff1e137dc3d0184f8b7d_elex_rhadamanthys_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-10-01_5c67111b0d5cff1e137dc3d0184f8b7d_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_5c67111b0d5cff1e137dc3d0184f8b7d_elex_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6124
- C:\Users\Admin\AppData\Local\Temp\9D40.tmp
  "C:\Users\Admin\AppData\Local\Temp\9D40.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-10-01_5c67111b0d5cff1e137dc3d0184f8b7d_elex_rhadamanthys_smoke-loader.exe 438A52B5D9E546FC25583252506EC5410FF7D8A711D9D3329CBCBF9B4DB6070DC2588FEFDC226B0A7B1F1138494CE10937CA81DA96E312CDA68527153E36EE57
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9D40.tmp

Path C:\Users\Admin\AppData\Local\Temp\9D40.tmp
Size 687KB
SHA256 1e5db36665e78ce5a36e029360d187e752790bbd97323e9122f5bdeeaabfc7f7
MD5 af469aa3e37f66753c006ce03d9a748a
SHA1 c33f789d74a5214fddc49abf58c7ba0163fdd11b
SHA512 7616a5ea44339ed8e2ef2a3e41bbf9ff2eb46913faeb2f7518c537ca0dd449aa5a0ae974430af57ca16fb37b72881c27af04803b3ef2715fc4031c1309e72c6c
SSDEEP 12288:3kIS6tXKA0wF0nsEsGU+BaI3cPFev7+0N1R9Dgec:3rXKf8Y0GUc2YvaKR97c
TLSH
T1F0E4D01436C1C070E6A6063246A6DF6348BEFD724F609ECBB7C86A1D5A713D1A731B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4336-6-0x0000000000B90000-0x0000000000C3C000-memory.dmp

Download

memory/6124-5-0x00000000005F0000-0x000000000069C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads