1e6d1522284eea24c8fc59e3bed5c843457094501d2f399bb966804cd639d6fc

Analysis

max time kernel
149s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/06/2026, 06:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-05_147ff714fa3e8261a69c3dd455f0b75f_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Size 531KB
Sample260605-grfa7acx6m
SHA256 1e6d1522284eea24c8fc59e3bed5c843457094501d2f399bb966804cd639d6fc
MD5 147ff714fa3e8261a69c3dd455f0b75f
SHA1 ad599377fbbdfd232018e6ad06bfade13cc0bced
SHA512 e5ec1b447148b3c49b029fe24f42be8f1dad31a658e91509531617201798f951a6e7d82e5b47561f5a6c2b61eaed739fa67ca5fb341ff209eb18a3266d36eacc
SSDEEP 12288:cdcAIffrC9fdm7napuTapE0dBny9tN7fn5nPmR:cdpInm9fdmupaaVdURn5PmR
TLSH
T117C4F09172C381B2E19204331B6ACBA22C3A3D355B296EC772D4777DBD306C2A6B5357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
8	C5FF.tmp

Executes dropped EXE 1 IoCs

pid	Process
8	C5FF.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-05_147ff714fa3e8261a69c3dd455f0b75f_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C5FF.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
8	C5FF.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 8	4592	2026-06-05_147ff714fa3e8261a69c3dd455f0b75f_amadey_elex_remcos_rhadamanthys_smoke-loader.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-06-05_147ff714fa3e8261a69c3dd455f0b75f_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-05_147ff714fa3e8261a69c3dd455f0b75f_amadey_elex_remcos_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Users\Admin\AppData\Local\Temp\C5FF.tmp
  "C:\Users\Admin\AppData\Local\Temp\C5FF.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-06-05_147ff714fa3e8261a69c3dd455f0b75f_amadey_elex_remcos_rhadamanthys_smoke-loader.exe DC70EA99CCF79A0397DBA4E5FE215C2B52CAF809954F049AFDF42B4DC5C60BB8F158E879DF0C7282118C7CA737982591CFE6A5BC4E8D1FF6012BE1671AE5355F
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:8

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C5FF.tmp

Path C:\Users\Admin\AppData\Local\Temp\C5FF.tmp
Size 531KB
SHA256 431540b48fd9d69a7fe190feee30a037f71e03561501ed31f1e77707540766cc
MD5 621678fbd523ce67b711edfa0f670a88
SHA1 aa57b58fbffb22ce089812610bc26f34733e54d1
SHA512 9de96f46ce34a7e4ce5cb1b9fda4781468d77859bfed5f95d898588b298711fcf03bada988cb2bd7c7e3bf2b3e9565708bb70ab3b3f1a33c5fc7b5f52fff3e96
SSDEEP 12288:cdcAIffrC9fdm7nacQ8T8YQB2j3S0PPLN7fn5nPmR:cdpInm9fdmuwLjS0XLRn5PmR
TLSH
T1C6C4F16176C3D1B2D19615321AABCBB22C3A38314B296EC772D0777DAD317C2A67131B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads