c10d60b9204d1f1dbd9b88f2b40ad12404269e0b0d1898814198f213f6448f06

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/05/2026, 04:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-07_5996c6a4caaf93bee6b30995905cfb2c_amadey_elex_remcos_smoke-loader.exe
Size 1.3MB
Sample260507-ems1daex3z
SHA256 c10d60b9204d1f1dbd9b88f2b40ad12404269e0b0d1898814198f213f6448f06
MD5 5996c6a4caaf93bee6b30995905cfb2c
SHA1 1375b0e5dbafafbb009368fd73d02fc409567d87
SHA512 42cf0afda6417a8ca97caf482b3230112c37c3d4c6c3942c8230cbfed2c319b00cb8da17757cc43ebd8cbcddb21fa592c03645d25ad55b721ea1736a51d12870
SSDEEP 24576:8WBz95ndbgfx522FrBYdQgjTSW6BXqlZ8l61ycOD3zldw4KcBiT8X:8m95nZgfxvBY3jTSXq8Y1yN1dwFai
TLSH
T14F659D2175B9427DC6A33031CE2D6A36596DD472C72814C70360EB79E9602D2EE37BEE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2392	E9C4.tmp

Executes dropped EXE 1 IoCs

pid	Process
2392	E9C4.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-07_5996c6a4caaf93bee6b30995905cfb2c_amadey_elex_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E9C4.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2392	E9C4.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3100 wrote to memory of 2392	3100	2026-05-07_5996c6a4caaf93bee6b30995905cfb2c_amadey_elex_remcos_smoke-loader.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-05-07_5996c6a4caaf93bee6b30995905cfb2c_amadey_elex_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-07_5996c6a4caaf93bee6b30995905cfb2c_amadey_elex_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3100
- C:\Users\Admin\AppData\Local\Temp\E9C4.tmp
  "C:\Users\Admin\AppData\Local\Temp\E9C4.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-05-07_5996c6a4caaf93bee6b30995905cfb2c_amadey_elex_remcos_smoke-loader.exe E4D0160C8B5885BA15FE9DBF3DAB47523A44D5A40F5C3D20E4578512B80B92350096B4ED2BEF32280CC74CD16979A57E1F429AB67189C30AD4F348F6A3197B21
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E9C4.tmp

Path C:\Users\Admin\AppData\Local\Temp\E9C4.tmp
Size 1.3MB
SHA256 3ede478c3c1ef59c4460e1ac8d1ecb23a511a5471dcc209bb9410d0c9284f9b0
MD5 7a2003c8ce58eef9dc1c542e9cd1006a
SHA1 b1204d7a1f9231c20834c5e90f8e2e6b134aefbb
SHA512 412f852f20e97462b1321d3d59c11fbb36c8460b771fb4ea4d24a3f80755d40ddd5f76af7013f7cb94c9af56133036d59bc37897214a247d71e36efc16e81f98
SSDEEP 24576:8WBz95ndbgfx58zVdKSyqgjTSW6BXqlZ8l61ycOD3zldw4KcBiT8X:8m95nZgfxKaFTjTSXq8Y1yN1dwFai
TLSH
T187659D2171B8427DC6A33031CE2D6A36596DD472C72814C70364EB79E9642D2EE37BEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2392-7-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/2392-8-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/3100-0-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/3100-6-0x0000000000400000-0x0000000000486000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads