c504ff612d69e80c4cf44818cad42f10acec7d94ab19dcacf3372a41142b424b

Analysis

max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_63bb9aa35659bd1b25527f6dbe9d4b84_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Size 531KB
Sample260701-e9wd1sgt8s
SHA256 c504ff612d69e80c4cf44818cad42f10acec7d94ab19dcacf3372a41142b424b
MD5 63bb9aa35659bd1b25527f6dbe9d4b84
SHA1 61b0d3bda06ec45e72cc48b8f961c03659af694b
SHA512 65a4b2c58f5a1457bfa3cb42355e8da3f9c17248c0d3963b26b04fda2f59a43fec48c2a7ce9ca2af8557a8bcc977c0c8524173bf6c6393fbb20e626ab8e39f9b
SSDEEP 12288:KdcAIffrC9fdm7naXthns9mYLIYq6qFxwt/eN7fn5nPmR:KdpInm9fdmuXtlsIaIVFO0Rn5PmR
TLSH
T12FC4E05176D282B2D04704332B6ACBB22C3A3D314B19ADCB76D4777DAD316C2A6B6317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1124	4EE1.tmp

Executes dropped EXE 1 IoCs

pid	Process
1124	4EE1.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_63bb9aa35659bd1b25527f6dbe9d4b84_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4EE1.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1124	4EE1.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3936 wrote to memory of 1124	3936	2026-06-30_63bb9aa35659bd1b25527f6dbe9d4b84_amadey_elex_remcos_rhadamanthys_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-06-30_63bb9aa35659bd1b25527f6dbe9d4b84_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_63bb9aa35659bd1b25527f6dbe9d4b84_amadey_elex_remcos_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Users\Admin\AppData\Local\Temp\4EE1.tmp
  "C:\Users\Admin\AppData\Local\Temp\4EE1.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-06-30_63bb9aa35659bd1b25527f6dbe9d4b84_amadey_elex_remcos_rhadamanthys_smoke-loader.exe 7D3C490FF5503FBD5CA5D39682955D81A93F05C7C480A1C33FC7A8D96BDE626A86AAD6F1CEF9AA9073E607C534975A75D6E92E38A316CD78D6DEC7E7ED46C889
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4EE1.tmp

Path C:\Users\Admin\AppData\Local\Temp\4EE1.tmp
Size 531KB
SHA256 752a1f5b72e7505f1a1c90ec6bf8eb1b22d179adb1b5928334277cc26525a99e
MD5 220ecf03f73e29b28045a7f03e038df2
SHA1 f5335fddfa61a8fbaefe79d1fc29dec08a767e67
SHA512 1ccc052fe0d6a1aa239a88a400adbb52b7ba76ce883287abccb7b749c8e461d8d02bf36fc4e237232348f1a95dfa3d5c18282b1429f6e35c8c6a8721a97850ac
SSDEEP 12288:KdcAIffrC9fdm7nasSeQjgDQETB91ngXhOtaN7fn5nPmR:KdpInm9fdmusS88ETZ4OtaRn5PmR
TLSH
T1FEC4F16166C3C1B2D08604332A9BCBA62D3A39354B196EC772D0777DBD316C2B6B135B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads