9d92ed364e359fda0f1ce827bc2d18e29fac613bb6ffcb8bf0bd715f7b7370d4

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 01:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-02_244fec7b6d4c6bb908569f2b8814b5b2_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Size 603KB
Sample260602-bprnjsav3w
SHA256 9d92ed364e359fda0f1ce827bc2d18e29fac613bb6ffcb8bf0bd715f7b7370d4
MD5 244fec7b6d4c6bb908569f2b8814b5b2
SHA1 f9588cc3a69583c955e0911de1ccbedab6f67f60
SHA512 bf5c0302bd192c6c41bc5ca42f4b9b6b3145d87ee017e9fb6edec50e76fb7c2c2da6cbaaddfa038d498e0fb2dd8ec1e548fe1dec00f7071da9758cbea82e176c
SSDEEP 12288:y7IRWDvFa+nhmuF3Y0scoeDuUlX6Dp15FEaNY:y7GUo+F3YlRi6FtEI
TLSH
T1A2D4082167F48035F5F37AB05AB856315B7ABC625F34C9EF1280168E49B2AC1F930B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1072	SqlExpressChk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-02_244fec7b6d4c6bb908569f2b8814b5b2_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SqlExpressChk.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 1072	4904	2026-06-02_244fec7b6d4c6bb908569f2b8814b5b2_amadey_elex_remcos_rhadamanthys_smoke-loader.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-06-02_244fec7b6d4c6bb908569f2b8814b5b2_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_244fec7b6d4c6bb908569f2b8814b5b2_amadey_elex_remcos_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Users\Admin\AppData\Local\Temp\VSD79C.tmp\SqlExpress2008\SqlExpressChk.exe
  "C:\Users\Admin\AppData\Local\Temp\VSD79C.tmp\SqlExpress2008\SqlExpressChk.exe" 10.0.1600 1033
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SqlExpressChk.exe

Path C:\Users\Admin\AppData\Local\Temp\VSD79C.tmp\SqlExpress2008\SqlExpressChk.exe
Size 108KB
SHA256 f4ab3f247ed2302367a6163f0269b3bf2b143848c3401e88aa2031ae23c8fe26
MD5 3a77ddc12bb01b6b48fc60ac4e8c46aa
SHA1 76c95f6d9b23b19241b95df7543d7d465ed553c8
SHA512 9fd6be9a9ee8188947f854751d5fa5ca3505fcf44d92a881418ea5471dfe468a93cd88ac3dac4a44691411e331b76808cf9fc9cf846f1b696961ab7422083a81
SSDEEP 1536:xUVj3JvQVhhLn+gFwMz8Z8BTouSBkWJznW29XoEBEQfaze5/QgH0Lb19rHUOF:xU+VnTFwM5FSbW294E2Ri5/TH0X19oY
TLSH
T1E7B37C203550D13AE8A741B905AEEB25A73DA9920B24E2C733C55FDECEB17D17B3118B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download