c1852d0faf099f137183715bbab916cb730cd727e763773efd6f896986dada70

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 10:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_69314e0e8a8289ceb96b8356b69e8f4e_amadey_elex_rhadamanthys_smoke-loader.exe
Size 1.1MB
Sample261024-l455lahs21
SHA256 c1852d0faf099f137183715bbab916cb730cd727e763773efd6f896986dada70
MD5 69314e0e8a8289ceb96b8356b69e8f4e
SHA1 618da767f556292867be15d66768095b87fc36e1
SHA512 ee7ce1e5aa3116eede623a3419fae10a218c5cdcc7df905682c4b07a26e6ef07cbfc60cc1a2a60471165512ebaf6dd6e4cf4a727a818abcfe9ae5fcfcaaf06c8
SSDEEP 24576:S1A45BWLpBoMYv2Lh2wyHB4QrP92oIT9l+pHm+YfDaN44JQSnh:S115UdBoMYeLh2Hmc92oKl+pG+Pu4JQm
TLSH
T1E4351278E590C2F3E04110344A9ACBF76C7A7D745B665EC733E91AAD2C612C2A732367
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
868	5450.tmp

Executes dropped EXE 1 IoCs

pid	Process
868	5450.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_69314e0e8a8289ceb96b8356b69e8f4e_amadey_elex_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5450.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
868	5450.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6072 wrote to memory of 868	6072	2026-10-22_69314e0e8a8289ceb96b8356b69e8f4e_amadey_elex_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-10-22_69314e0e8a8289ceb96b8356b69e8f4e_amadey_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_69314e0e8a8289ceb96b8356b69e8f4e_amadey_elex_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6072
- C:\Users\Admin\AppData\Local\Temp\5450.tmp
  "C:\Users\Admin\AppData\Local\Temp\5450.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-10-22_69314e0e8a8289ceb96b8356b69e8f4e_amadey_elex_rhadamanthys_smoke-loader.exe 3604EE27DBE9C9B3FB5AF0464612BC9ACC5E7A67637AC77C68D14B144DE5EBB71472271DCC8861FC456367BC8B24CB38D6F15550B715FD733AE4DDF94041EEBC
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5450.tmp

Path C:\Users\Admin\AppData\Local\Temp\5450.tmp
Size 1.1MB
SHA256 5b211a6db2d0a0ba44b06aeb26f2e2d27e400199b845409cc6e82ca2a3d5d817
MD5 64031dfae026af90d328e05fc6f040c2
SHA1 c2f763ca678bf3bd785976b518df5d11319dd670
SHA512 4ee34ea57ad82a2aa323bfbbb499355068a323d1ad1383229c40ec5199ede719049225f2e8d61ba71352c81c9721139cd75ea3b5df879f33c7709f7a717ebb03
SSDEEP 24576:S1A45BWLpBoMYYHLaHJ+QinZt4F2nlIQ6CmGn7v4Es0:S115UdBoMYYr6J+tflIpCmYv4b0
TLSH
T1C9351268E5A092F2D10604305A9DEBF36C397C7527769EC732D90A6E7D212C2EB36317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download