c1852d0faf099f137183715bbab916cb730cd727e763773efd6f896986dada70

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 10:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_69314e0e8a8289ceb96b8356b69e8f4e_amadey_elex_rhadamanthys_smoke-loader.exe
Size 1.1MB
Sample261024-l455lahs21
SHA256 c1852d0faf099f137183715bbab916cb730cd727e763773efd6f896986dada70
MD5 69314e0e8a8289ceb96b8356b69e8f4e
SHA1 618da767f556292867be15d66768095b87fc36e1
SHA512 ee7ce1e5aa3116eede623a3419fae10a218c5cdcc7df905682c4b07a26e6ef07cbfc60cc1a2a60471165512ebaf6dd6e4cf4a727a818abcfe9ae5fcfcaaf06c8
SSDEEP 24576:S1A45BWLpBoMYv2Lh2wyHB4QrP92oIT9l+pHm+YfDaN44JQSnh:S115UdBoMYeLh2Hmc92oKl+pG+Pu4JQm
TLSH
T1E4351278E590C2F3E04110344A9ACBF76C7A7D745B665EC733E91AAD2C612C2A732367
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
3980	E8A6.tmp

Executes dropped EXE 1 IoCs

pid	Process
3980	E8A6.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E8A6.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_69314e0e8a8289ceb96b8356b69e8f4e_amadey_elex_rhadamanthys_smoke-loader.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3980	E8A6.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 3980	4324	2026-10-22_69314e0e8a8289ceb96b8356b69e8f4e_amadey_elex_rhadamanthys_smoke-loader.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-10-22_69314e0e8a8289ceb96b8356b69e8f4e_amadey_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_69314e0e8a8289ceb96b8356b69e8f4e_amadey_elex_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Users\Admin\AppData\Local\Temp\E8A6.tmp
  "C:\Users\Admin\AppData\Local\Temp\E8A6.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-10-22_69314e0e8a8289ceb96b8356b69e8f4e_amadey_elex_rhadamanthys_smoke-loader.exe F3AC9110792A6005933A052F45A7C6A7DF6B7138ACFE65E4649D09716381614F4C3C96173D33DAEA895B1F44C4ADD9D9B2DE94E149DE7075E27972DA69A49714
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E8A6.tmp

Path C:\Users\Admin\AppData\Local\Temp\E8A6.tmp
Size 1.1MB
SHA256 39b09ac3af5d0fa00c3d1ad0f01eae117027a839a5e4f525474451cdf3532aa1
MD5 00add47528afb48497165fabe4323610
SHA1 f0c6dd0fab43692af2827c5f46857955ca72317b
SHA512 9c2639a890452a23cc1bdf1535e4a07eba99783fd893e37ab7becf64275f44c70880e5d77ffcca93094368e36757ede62a40896f18eba5fdc0f6fc67ce97a008
SSDEEP 24576:S1A45BWLpBoMY2NuPh9pl7DzxaFuE8JZWD0F9PF/82rHQEy6voTnzgBtQ7eT:S115UdBoMY2oPzwSLhBJDrQ72tQyT
TLSH
T1683512A4E59192F3D14614704B6ECBF36C793E741B639DC332D91AAC6D602C2AB36327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download