2ce49a6be77bf7b4aab08f4509a79172509bfe6e69fd88784378dba1d38b582c

Analysis

max time kernel
148s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 11:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-09_a57f635855d34e69cc99cf5e80902c8e_elex_rhadamanthys_smoke-loader.exe
Size 687KB
Sample261110-n23b2axt2r
SHA256 2ce49a6be77bf7b4aab08f4509a79172509bfe6e69fd88784378dba1d38b582c
MD5 a57f635855d34e69cc99cf5e80902c8e
SHA1 b2a9adf501ed13a94b0a2b456571e13d8c50af62
SHA512 213a26076ac1f93590f662b20a9cb8afc3647977f7bebbcec173cf68850525bf709b42dd86335454775df073afe28e6f5980e1af5b27dd1318cd26d6d8e1482d
SSDEEP 12288:3kIS6tX0Becde8r+SRWXl/TJhFev7+0N1R9Dgec:3rX0Bec5aS0Xl/TTYvaKR97c
TLSH
T136E4E01036C1C030E5A7063246A6EF62587EFD724F64AADBB7C82B1E1D706D1A735B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4976	7565.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-09_a57f635855d34e69cc99cf5e80902c8e_elex_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7565.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4976	7565.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 4976	3212	2026-11-09_a57f635855d34e69cc99cf5e80902c8e_elex_rhadamanthys_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-11-09_a57f635855d34e69cc99cf5e80902c8e_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-09_a57f635855d34e69cc99cf5e80902c8e_elex_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Users\Admin\AppData\Local\Temp\7565.tmp
  "C:\Users\Admin\AppData\Local\Temp\7565.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-11-09_a57f635855d34e69cc99cf5e80902c8e_elex_rhadamanthys_smoke-loader.exe 3A6735C6BC8BBF29AA6042842EBBB85CC652C8E2BFCA2CFE3D7376651BDBA1B6E1C6E0EEC90FCBF04F684EE97F73B2C874AEC3A98B1CFF51C2F6BEF5DF621394
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7565.tmp

Path C:\Users\Admin\AppData\Local\Temp\7565.tmp
Size 687KB
SHA256 e7579d4411ef16eda2fada526ce6f5840ad2741a3e8dbb329de0004f785c4a9b
MD5 ec72918f9d2da8d00f57d2891459740a
SHA1 d91f1b3257d87940369a5a436c92987daf002f85
SHA512 1689be79266d358dc4d0b0370ab6547091cc8795a47ad602274713bdc79f3cc923897ba1f48ea0ccb0ecbb1994ac0cffb0d0fa9e88cdb4263730556547f075c1
SSDEEP 12288:3kIS6tX+2ik9fefQPSH/Fev7+0N1R9Dgec:3rXHikD+YvaKR97c
TLSH
T1D5E4E02076C1C070E5A7063286A9EF62547EFD364FA09ECBA7C42A5D5E703D1A735B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3212-4-0x0000000000FC0000-0x000000000106C000-memory.dmp

Download

memory/4976-6-0x0000000000440000-0x00000000004EC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads