d45f789d9a3179a108f4cc6666ea483b0036b861db4fcbb45cc48ab2c4099bff

Analysis

max time kernel
149s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/04/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-24_62a907884644d1c5024d57641daf3cbd_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Size 612KB
Sample260424-e7tseaez7y
SHA256 d45f789d9a3179a108f4cc6666ea483b0036b861db4fcbb45cc48ab2c4099bff
MD5 62a907884644d1c5024d57641daf3cbd
SHA1 7bdfa5bc1b6f4b0521618f3e45c70125a3e5f332
SHA512 3ce091c5263e08a3920f8390babc5d28201ba9d26d3932bebaf5291271e8d63ca6c5b5024e586696c0b78f4caa6d64573de283b99eaf2ef57c505861e356b286
SSDEEP 12288:3wBhHmq7dq93QKqZwe/84RtjPkmZJ03/TmTb8Ose+sTYWjZ/q:3YHI93Rq//B36TNOsTM
TLSH
T16BD4F1657191C273E09610321E1BD7A23D3A3D351B26ADC736D43A7D6E312C1AAF632B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3292	4FC.tmp

Executes dropped EXE 1 IoCs

pid	Process
3292	4FC.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-24_62a907884644d1c5024d57641daf3cbd_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4FC.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3292	4FC.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3252 wrote to memory of 3292	3252	2026-04-24_62a907884644d1c5024d57641daf3cbd_amadey_elex_remcos_rhadamanthys_smoke-loader.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-04-24_62a907884644d1c5024d57641daf3cbd_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-24_62a907884644d1c5024d57641daf3cbd_amadey_elex_remcos_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3252
- C:\Users\Admin\AppData\Local\Temp\4FC.tmp
  "C:\Users\Admin\AppData\Local\Temp\4FC.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-04-24_62a907884644d1c5024d57641daf3cbd_amadey_elex_remcos_rhadamanthys_smoke-loader.exe 94D81C272328CABF52B4ABCD587FF77217F7091EACC232E02B2C61A57370BEE7ABE29C5DAD890B6602BE17EE2C2E0AD7B3C411F4F99DAC9F3A7A6734810198B6
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4FC.tmp

Path C:\Users\Admin\AppData\Local\Temp\4FC.tmp
Size 612KB
SHA256 99062203ab2bf6a0b9d0ebb7b591ac336fb88490d191d56ccd52ca99909d6fbf
MD5 f10d5fef7302a0196498ca83e562e740
SHA1 564c6c8c34bd3792e2d8ad67e201137fbe84456d
SHA512 4131efe9940593ec836a82bc0330d9df419f477c65a724d6725cbbe901ddf8edbe0e19593833a3b166b8654560c713f57e8885c694655516b30b31b544bb6604
SSDEEP 12288:3wBhHmq7dq93QKqZwe/8L96W5II7Ww5g14ChCgyM2HJzlU6PC/An+u6v0bbpoYbW:3YHI93Rq/E4MF5g1f0pzlfVTb
TLSH
T1A7D4E02921C1D133E05A10325E1BD7A2383A3D355B2B5DCB76D4367DAE712C2AAF9327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads