1d049d228238ee82e97948cfa2374e64272d78c3c89ca2fd1f6668880c44cf8f

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 23:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-03_3c2686bf8b823d24bcc5d0a4749f9d22_elex_rhadamanthys_smoke-loader.exe
Size 687KB
Sample261104-27e1ksd15x
SHA256 1d049d228238ee82e97948cfa2374e64272d78c3c89ca2fd1f6668880c44cf8f
MD5 3c2686bf8b823d24bcc5d0a4749f9d22
SHA1 10cdada4a5dad6b4059f48e097ec0b6b3fc1ce97
SHA512 a172899b68eace40307869bf3c337fe7801cc63618e511eb35f1c373ecd19826012695764367c42a2da96f4ebafb73181712226cd914d6299a52ed8c54857097
SSDEEP 12288:3kIS6tXZ/qpNtZE0cG2KP3EdylFev7+0N1R9Dgec:3rXZ/0NtXN2uEdeYvaKR97c
TLSH
T159E4E02036C1C070E5A7063656A6DF62187EFD724F609ECBB7C82A5D1E706D1AB34B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1420	D47D.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-03_3c2686bf8b823d24bcc5d0a4749f9d22_elex_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D47D.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1420	D47D.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 1420	3452	2026-11-03_3c2686bf8b823d24bcc5d0a4749f9d22_elex_rhadamanthys_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-11-03_3c2686bf8b823d24bcc5d0a4749f9d22_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-03_3c2686bf8b823d24bcc5d0a4749f9d22_elex_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Users\Admin\AppData\Local\Temp\D47D.tmp
  "C:\Users\Admin\AppData\Local\Temp\D47D.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-11-03_3c2686bf8b823d24bcc5d0a4749f9d22_elex_rhadamanthys_smoke-loader.exe B1C88068EDEDD2FA37B5843184EF247EFC4CBA7B9E9B1BFEA28D2E8AF15DB9EA7F18FBAFF8F9F0CD117984DEC5D9809A1C7C00692D4D566115E995B2B771BFF6
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

D47D.tmp

Path C:\Users\Admin\AppData\Local\Temp\D47D.tmp
Size 687KB
SHA256 be90524a43f99a022d75c7cb2e108b2cd6237781c75ee3278f9bb6a77d78f719
MD5 7a9b8002ba0e44ba33821729be69f701
SHA1 73f31367115629404ea2852fba59ef42946774de
SHA512 6b6409176695760e997eabf27d52798841ef7c925706aa721eeb078a74941edeeb5e4ad323611e61a99414d3722ae56c00c65cf299ea001b6a3bb8c3710d322f
SSDEEP 12288:3kIS6tXHQbQODtfXDy+gwBdk74uq2E10YhFev7+0N1R9Dgec:3rXBODxDJ62NYvaKR97c
TLSH
T1BDE4E02136D1C030E1A746325AA5EF62447EFD714F60AACBB7C82A1D5A703D1BB35B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1420-6-0x00000000000C0000-0x000000000016C000-memory.dmp

Download

memory/3452-4-0x0000000000B90000-0x0000000000C3C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads