78dfb186aaf0885739e4e451d0115e9b212697a410954519e8ab19694de13b07

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 03:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_65349e58c433b0cfc9bacdb5ffade397_elex_rhadamanthys_smoke-loader.exe
Size 687KB
Sample261030-dm23lsvxfs
SHA256 78dfb186aaf0885739e4e451d0115e9b212697a410954519e8ab19694de13b07
MD5 65349e58c433b0cfc9bacdb5ffade397
SHA1 aaebd1b9f5a2a7d3238f65a75cddef5b68734732
SHA512 9bd1b6f9255f9743f6b53c3bc13d675b4a7819c765cbfe24aee6db450d361a2ec5bd8ad59a6d526dbc2963552bde7f69743cfa8c588e23e2f14431e856282d65
SSDEEP 12288:3kIS6tXvAeRCdueB4gWakICrE7Fev7+0N1R9Dgec:3rX/CEY4gWaRYvaKR97c
TLSH
T1F4E4E06076C1C030E5A7063246AADF62447EFD314F61AACBBBC86A5D1E742D1B734B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4500	576D.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-28_65349e58c433b0cfc9bacdb5ffade397_elex_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	576D.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4500	576D.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5240 wrote to memory of 4500	5240	2026-10-28_65349e58c433b0cfc9bacdb5ffade397_elex_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-10-28_65349e58c433b0cfc9bacdb5ffade397_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_65349e58c433b0cfc9bacdb5ffade397_elex_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5240
- C:\Users\Admin\AppData\Local\Temp\576D.tmp
  "C:\Users\Admin\AppData\Local\Temp\576D.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-10-28_65349e58c433b0cfc9bacdb5ffade397_elex_rhadamanthys_smoke-loader.exe D29D11F5E2C8BFC02388683CD900B463419C5710031179B1C5CB6694F9540BB216DF419F4D518E02906787BE0B3C3F3E44F6A748CF05FA4F0316113EED834329
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

576D.tmp

Path C:\Users\Admin\AppData\Local\Temp\576D.tmp
Size 687KB
SHA256 880102d6805cfa968287ec0c39ffe2586e2e8a6212e85ffaba4280ed7870b792
MD5 754f5ed1d2a72b0d0211d5163888a6ed
SHA1 4f578a7fe063d83a3603316b799aa2b9ad6b44dd
SHA512 7c459909cae5f9cf1eb51b7b900386c0a019cb38b97218be39cd8ea2c5f1a38c7ac48622c50aa40246fe365d50e93066f8926c21545d75da24755b6d5996ff6a
SSDEEP 12288:3kIS6tXknLSHOO4snPErxcrQnHuIZlJFev7+0N1R9Dgec:3rXcLSHOzxcMHZJYvaKR97c
TLSH
T198E4E01032D1C070E5B7063256AADF66487EFD324F60AACBB7C82A5D1E742D1A735B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4500-6-0x0000000000EF0000-0x0000000000F9C000-memory.dmp

Download

memory/5240-4-0x0000000000840000-0x00000000008EC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads