0c0373760adc4934ef588771c7b4667527bdc9e079fc275aadfcc3c39fa9d698

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 04:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_7931d873483f959d77edef85d93de3a3_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Size 531KB
Sample260701-evv5psd18n
SHA256 0c0373760adc4934ef588771c7b4667527bdc9e079fc275aadfcc3c39fa9d698
MD5 7931d873483f959d77edef85d93de3a3
SHA1 7043466b0dc25a8d7505839761ea1141ac4639b8
SHA512 327104c67a46f3f0066ebd0b54fe1a2d80929bc603ce8387d7e9295f6cdce340828e9c6bd3bf49c2524a3b65014855adbfc88d8cc4950c848abd28a1d6057954
SSDEEP 12288:KdcAIffrC9fdm7na9gIRv+T9ZDiN7fn5nPmR:KdpInm9fdmuiIRv+THiRn5PmR
TLSH
T163C4F16136D2D1B2D18604331AAACBB22C7A79310F295DC736D4377DBE306C2A6B535B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1164	3B98.tmp

Executes dropped EXE 1 IoCs

pid	Process
1164	3B98.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3B98.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_7931d873483f959d77edef85d93de3a3_amadey_elex_remcos_rhadamanthys_smoke-loader.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1164	3B98.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 708 wrote to memory of 1164	708	2026-06-30_7931d873483f959d77edef85d93de3a3_amadey_elex_remcos_rhadamanthys_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-06-30_7931d873483f959d77edef85d93de3a3_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_7931d873483f959d77edef85d93de3a3_amadey_elex_remcos_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:708
- C:\Users\Admin\AppData\Local\Temp\3B98.tmp
  "C:\Users\Admin\AppData\Local\Temp\3B98.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-06-30_7931d873483f959d77edef85d93de3a3_amadey_elex_remcos_rhadamanthys_smoke-loader.exe EB690A09E77379E7C51D9D0CC977DEEE104AE3E6DF6DFE9F2309AE257522E9121029C218F6D8DB11C4F729D019BB0FC7E4BCAF6D7C1B9C8869342BACE60D2B20
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3B98.tmp

Path C:\Users\Admin\AppData\Local\Temp\3B98.tmp
Size 531KB
SHA256 d476e946ebf167da4b34b6726a7ac6551eea2878a229445e871abb392467a4d1
MD5 8f9e73a2402ada0b9ab4f5cd28dea400
SHA1 5e19716768a61425fc102ce608b840480968ca7f
SHA512 3f4d838371bdba77a6cae9948fc8487c620c929203ad876302509b54918b902e01e0749582f002b0bb9765da70d3d2ffedef2be7218d156401ff2de6ce757639
SSDEEP 12288:KdcAIffrC9fdm7naIHkiKkfL/fAtdBk4yN7fn5nPmR:KdpInm9fdmuUkJp3yRn5PmR
TLSH
T153C4F09066C3D1B2D19614331A5BC7A22D3A3A345B2A6EC772D4377CBD307C2A6B6317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads