1613fe077c4f451d3bb3c3d248cc27aaeea03110dc0fc3300a9c15951fb65a0f

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-10_3510f1534c92dfe37bef766c2219cb27_elex_rhadamanthys_smoke-loader.exe
Size 687KB
Sample261011-vsazraea34
SHA256 1613fe077c4f451d3bb3c3d248cc27aaeea03110dc0fc3300a9c15951fb65a0f
MD5 3510f1534c92dfe37bef766c2219cb27
SHA1 9e67dad3bd7c63a4820e02bfe906b9d0cda37181
SHA512 a6127bc4bf8caac45cba88ef7f11442a0f18b9af5025d8eda919dd116d8a6d8813f7ae8c230c71d43e1d785013db2c64cb06ffbffe2c82ed4c716cd1670ed28c
SSDEEP 12288:3kIS6tXinRzsTW6uqKvrpwq49Fev7+0N1R9Dgec:3rXGpYOq0zkYvaKR97c
TLSH
T10DE4E05076C2C030E1E7063246AAEF66547EFD764BA09ECBB7C82A1D5D702D1A734B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5936	9919.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-10_3510f1534c92dfe37bef766c2219cb27_elex_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9919.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5936	9919.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5836 wrote to memory of 5936	5836	2026-10-10_3510f1534c92dfe37bef766c2219cb27_elex_rhadamanthys_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-10-10_3510f1534c92dfe37bef766c2219cb27_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-10_3510f1534c92dfe37bef766c2219cb27_elex_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5836
- C:\Users\Admin\AppData\Local\Temp\9919.tmp
  "C:\Users\Admin\AppData\Local\Temp\9919.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-10-10_3510f1534c92dfe37bef766c2219cb27_elex_rhadamanthys_smoke-loader.exe FF0DD0F9FB1E913F85655A9153931C09462489CE2C37D34C83D6825F5FF5846DA32C6E2DE43DFCA1EFD41030DD6FAACDC7CE469658CABD8344E54C45BCAFC30F
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9919.tmp

Path C:\Users\Admin\AppData\Local\Temp\9919.tmp
Size 687KB
SHA256 08a676b64b975fc7a55a64c2d216d7dd684d88d00df633193e20dada26d879e7
MD5 3dcbc50e67cbb9d6f5434fc89dc21106
SHA1 393a91985802288c2a01f722ca2c1b3205c063ba
SHA512 24964d105befdd34725756f521964e0536e77663816f2c5d0f8d6db0dfa0f03d4cc65bdd1c31f109cbeba56409898a36b8c06afe7c5312adb5ec425ac52f8d28
SSDEEP 12288:3kIS6tXu1safXeac4cyNibNrttv5CFev7+0N1R9Dgec:3rXWsU44cNr1CYvaKR97c
TLSH
T13FE4E01032C1C071E5A7063646AAEE66487EFD324F619ACBB7D82A1D5E746D0B730B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5836-4-0x0000000000890000-0x000000000093C000-memory.dmp

Download

memory/5936-6-0x0000000000E20000-0x0000000000ECC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads