7a6c8500fa0912481fa1e485eaa2082845f5dd37f3ec6a69df27230916286c97

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 06:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_73c74fa930a8420adfb8d8df28891ca2_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Size 932KB
Sample260629-gt99caev7t
SHA256 7a6c8500fa0912481fa1e485eaa2082845f5dd37f3ec6a69df27230916286c97
MD5 73c74fa930a8420adfb8d8df28891ca2
SHA1 01a759ea381f74f0cf100f6a27da071a4c36302f
SHA512 765b7ddee9b3361de24220cd081dc84038a5f7119fdfb528476a0894a40ff5437d85bfb8f88fc0a0c301c4328674184a55d83ca2d9f38409cfe783c00d1689e2
SSDEEP 24576:1fxg9WbdROWOT8ZGMpEBFkPk78vOPtssh9LZm+UZm:1pg9b8ZGMpEBF78vQ+qZmRZm
TLSH
T1CD15D052E98041B6D1DA68325CBA86110DB23E6756EABEC321C43B453C37D82E7357EF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5460	B987.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_73c74fa930a8420adfb8d8df28891ca2_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B987.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5460	B987.tmp

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000_Classes\Local Settings	B987.tmp

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
428	WINWORD.EXE
428	WINWORD.EXE

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5460	B987.tmp

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
428	WINWORD.EXE
428	WINWORD.EXE
428	WINWORD.EXE
428	WINWORD.EXE
428	WINWORD.EXE
428	WINWORD.EXE
428	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 5460	1308	2026-06-27_73c74fa930a8420adfb8d8df28891ca2_amadey_elex_remcos_rhadamanthys_smoke-loader.exe	89
PID 5460 wrote to memory of 428	5460	B987.tmp	90

C:\Users\Admin\AppData\Local\Temp\2026-06-27_73c74fa930a8420adfb8d8df28891ca2_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_73c74fa930a8420adfb8d8df28891ca2_amadey_elex_remcos_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Users\Admin\AppData\Local\Temp\B987.tmp
  "C:\Users\Admin\AppData\Local\Temp\B987.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-06-27_73c74fa930a8420adfb8d8df28891ca2_amadey_elex_remcos_rhadamanthys_smoke-loader.exe 6E62B7A853E372A6390C21C9CBE8D3B86629D3C7CBDFB308B18F76487854DCD9B7FAEE4C29B58259C1027C7BC4DBA7BD69966D43F14E6770C531F79A303423D7
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Modifies registry class
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:5460
- - C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2026-06-27_73c74fa930a8420adfb8d8df28891ca2_amadey_elex_remcos_rhadamanthys_smoke-loader.docx" /o ""
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    PID:428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-06-27_73c74fa930a8420adfb8d8df28891ca2_amadey_elex_remcos_rhadamanthys_smoke-loader.docx

Path C:\Users\Admin\AppData\Local\Temp\2026-06-27_73c74fa930a8420adfb8d8df28891ca2_amadey_elex_remcos_rhadamanthys_smoke-loader.docx
Size 7KB
SHA256 28b81d48fffa24da7b1eb559b10145d7c44edcd14a5d54445c1f47c2e1ad72fc
MD5 e7021e4c27c94051e12cf5099f4c93b3
SHA1 7b32ed590a36992c6efd46e101304c01d6ac2428
SHA512 79d71038eac2dd6505cee3f56aa4b8603b71bc4f1d78b0bbbf507d2b051df4b0774543c6163d47fb4d3fb505e8c3144a0f7226229d17604f3134aef193c6935c
SSDEEP 192:+ngR6vHldQpadBY19jqhVztp60W2M5yK/TJxSD7:ggU7BYPqrzmJxO7
TLSH
T1A8F15C29BC50F067C29385B6986C47C0708F140FA70EE6E329712ADD68D5D4C5B63FD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B987.tmp

Path C:\Users\Admin\AppData\Local\Temp\B987.tmp
Size 932KB
SHA256 0737e1e0cf6655a93b48fb503f553ec1881a00ce6127a22124877cb212bcd217
MD5 89ba6e3f6b2590a101b9cdd4fa8875d1
SHA1 569de9881259e1853ebe49bbc11519128b18f7ae
SHA512 961f9dd184a104dfb972eeabc46480e06e3335230e37a5da421db11efd5dc8fbd313c11ea6657616c3a55de31086efda7a880aa6e96c225323c0158c1b4019f1
SSDEEP 24576:1fxg9WbdROWOT8ZGHz/sD8VATiaOLZm+UZm:1pg9b8ZGHz0D86ZaZmRZm
TLSH
T12315D052E98081B5D4D669324CBA86010DB23E7746EAADC721C43B453C73D82E736BEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iso690.xsl

Path C:\Users\Admin\AppData\Local\Temp\TCD627A.tmp\iso690.xsl
Size 263KB
SHA256 3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
MD5 ff0e07eff1333cdf9fc2523d323dd654
SHA1 77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA512 b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
SSDEEP 6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
TLSH
T1094469A5E6D9CF144BB1F23FD8A53092EA1DC87B29341D41F1DC733717AE948822B662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fb3b0dbfee58fac8.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Size 2KB
SHA256 1a2525581c4de26e69410c6b4993c5df431442ad19e43139e75813b551c8e25a
MD5 8c7d11d8fbeb7692ce9086006871e74d
SHA1 6a2c6898955cb533ddea264e8e5ddcbfe945947d
SHA512 143830e83e2437ff8a04591b2eb8b1a01dc8781ea17b1a5dca903e570f75ddc9eb905a37f7560ddfd3f1de9f20c7d83cd6e203972346d4ae0bbf4c8901ed19ea
TLSH
T1AC513302168B6F1BD05147719B364719DBB1BC07D704EB0E4685716B7C61C11BFDAB2D
MD5 SHA1 SHA512 TLSH

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads