89dab4d8e1d8387308978fa3afe7fdbac0009d1791e11b543d4f83676117b53e

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 02:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_f5df894827990cf3d6a799901b0d9fef_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 596KB
Sample261027-cffqcsax8p
SHA256 89dab4d8e1d8387308978fa3afe7fdbac0009d1791e11b543d4f83676117b53e
MD5 f5df894827990cf3d6a799901b0d9fef
SHA1 04e3fffb721bf604d3df0f0ed2e31138df1a47e1
SHA512 749de3fa8f1d6b3c961de0e2bbf8bbd391294395e7d3a85bc7a9f5970993693d0985aaf8aa1dacbcd804ce793fe37ba2bd7cdcb7d6ebe4361404438107e21e19
SSDEEP 6144:/cH18qj7oMpijlt5xuLUcSrVcKTEQg2xf+B9QpI:/cH1JHowclTIfS/QQg2xfQ91
TLSH
T127D48C2076808071E35A07350567E6A10A79AE3917A9E5CFF3787E362E722D3573728F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-26_f5df894827990cf3d6a799901b0d9fef_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-26_f5df894827990cf3d6a799901b0d9fef_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_f5df894827990cf3d6a799901b0d9fef_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4896-0-0x00000000001A0000-0x0000000000239000-memory.dmp

Download