a618d31e854c576b5301782a0e4a4a70ad3cfb213fc52889a117c6c1d44da8f5

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/07/2026, 02:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_fa004481fcefd250c2c44ae531ff602d_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Size 532KB
Sample260701-ce1ddact7k
SHA256 a618d31e854c576b5301782a0e4a4a70ad3cfb213fc52889a117c6c1d44da8f5
MD5 fa004481fcefd250c2c44ae531ff602d
SHA1 eaa69a91fc295e9519460a1f52d9dc55b12200c0
SHA512 0548be39da0d3b510c531c5cc39a3416ff0b41880a9c7cba0ce4dc43fbe803a1554ac0127ddf14851f9c2003c25db2cff840126bc934b0b42ba64624546d7efd
SSDEEP 12288:KdcAIffrC9fdm7nag4qI02WaU8sITmdQ1js4N7fn5nPm:KdpInm9fdmuVtWDUmdqs4Rn5Pm
TLSH
T1F3C4F050B2D3C2B2E18614321BAACBA22C3A3D355B191DC772D4777D7D306C2A6B536B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1380	FDA9.tmp

Executes dropped EXE 1 IoCs

pid	Process
1380	FDA9.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_fa004481fcefd250c2c44ae531ff602d_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FDA9.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1380	FDA9.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 1380	1832	2026-06-30_fa004481fcefd250c2c44ae531ff602d_amadey_elex_remcos_rhadamanthys_smoke-loader.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-06-30_fa004481fcefd250c2c44ae531ff602d_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_fa004481fcefd250c2c44ae531ff602d_amadey_elex_remcos_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Users\Admin\AppData\Local\Temp\FDA9.tmp
  "C:\Users\Admin\AppData\Local\Temp\FDA9.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-06-30_fa004481fcefd250c2c44ae531ff602d_amadey_elex_remcos_rhadamanthys_smoke-loader.exe 0685FB1D1E122C397AE6394AB21212AE08AF192D29F993E9D633B86E20E4B4CDB321A2884EEFE16AA3BA9D5697702F5AB856B87C81C9C07F4A02DD6966CDF5CC
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FDA9.tmp

Path C:\Users\Admin\AppData\Local\Temp\FDA9.tmp
Size 532KB
SHA256 35de343c6147c1d86754137ab1a18cf474dad0bf8d1f8ad7e1c31d2344d1cd13
MD5 574c94ae1c4d5b95226fa70785d73943
SHA1 d571b6e07624dea5b0a2958ee9cd1d47d8b3cd09
SHA512 f2f950869367cebf0d6f759063165b76825bb7c06e30f6468d74e12d9e1488f565a8435303479447ac3555482469388daede58dbd9d8fe0ef7035c541f5c59a7
SSDEEP 12288:KdcAIffrC9fdm7nakVi48WRUCTrI+mfpN7fn5nPm:KdpInm9fdmuui48crI+mxRn5Pm
TLSH
T151C4F15172C2D1B2D19610321A9ACBB22C3A7D314B29ADC776D0B77DBE306C276B6317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads