6e480408a48e73e74b296482b7383dc9896fcd3f97f478550d5110345088d6b6

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/05/2026, 14:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-06_079cded21b3d0d98be022a87c57af969_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Size 531KB
Sample260506-r5csbsc151
SHA256 6e480408a48e73e74b296482b7383dc9896fcd3f97f478550d5110345088d6b6
MD5 079cded21b3d0d98be022a87c57af969
SHA1 4541ff7e9a152ca2460be8adfee1f2616ce4afee
SHA512 d34dc483c6e184af97257ff6de2abaf64af0008fdbecc7ed6177f2a98843b9e15de4369b18b447e6af12b2c24519597bdba6276478487f04e61fdae27a52f90d
SSDEEP 12288:KdcAIffrC9fdm7naaaXwQlcGXunPZYFAMxsON7fn5nPmR:KdpInm9fdmuaagQlcGgPZYxRn5PmR
TLSH
T177C4E051A2D3C1B2D18B10321A6BCBB22C3A39355B196DC776D0777DBD316C2A6B231B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2788	D64B.tmp

Executes dropped EXE 1 IoCs

pid	Process
2788	D64B.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D64B.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-06_079cded21b3d0d98be022a87c57af969_amadey_elex_remcos_rhadamanthys_smoke-loader.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2788	D64B.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 2788	4760	2026-05-06_079cded21b3d0d98be022a87c57af969_amadey_elex_remcos_rhadamanthys_smoke-loader.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-05-06_079cded21b3d0d98be022a87c57af969_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-06_079cded21b3d0d98be022a87c57af969_amadey_elex_remcos_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Users\Admin\AppData\Local\Temp\D64B.tmp
  "C:\Users\Admin\AppData\Local\Temp\D64B.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-05-06_079cded21b3d0d98be022a87c57af969_amadey_elex_remcos_rhadamanthys_smoke-loader.exe B3E51F89441716E6607E2D3B824EF4DAFD9D3DE9FED5901938732E26BD5AFDED3805AFCD89347E818423805DDA104623DD906F476025ED024DE4170EADCE76E4
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

D64B.tmp

Path C:\Users\Admin\AppData\Local\Temp\D64B.tmp
Size 531KB
SHA256 28c47bff29eb1049e1200675a08ce52256907208e13d38a1779a5b45bcd1ddda
MD5 124df585510599ee5663a93dd9e6d161
SHA1 9442b4f5a6667254f96e7d1075fea44051bc4fea
SHA512 743ad0a1b18248d4dce2c34f9f39c700cd762f50ccea3747ce056d71df76dc666ca9a5198898ffada2e2a6e9c7fe1c11ef8360f04f8b7c334ce52229daa3bd43
SSDEEP 12288:KdcAIffrC9fdm7naSvT3YhZ6sll1pN7fn5nPmR:KdpInm9fdmuSLIhMsT7Rn5PmR
TLSH
T136C4F051B2C3C1B2D18614331A6BCBB12D3A39345B296EC776D0777DAE306C266B136B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads