e51f5010151161c4656251b960011108a3c88138b6655f109e9b132862ce0f17

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 02:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_a05e5666f5fbe0f2112ccf6bdc34018f_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Size 664KB
Sample260715-csptsshx7n
SHA256 e51f5010151161c4656251b960011108a3c88138b6655f109e9b132862ce0f17
MD5 a05e5666f5fbe0f2112ccf6bdc34018f
SHA1 a3d3aee3e09dac9013f1f7d1ec4e8e3ce4165a4f
SHA512 72c9e126847aab78bad731fa3dce70abe2a416ee17746f1ae9d5413c36b402c5bf10a6ad9d5b2912fd4379e74146d88e2140c663b0858f73298e1df0a2497fb9
SSDEEP 12288:2Jkqpbzc1wJy9NmQyss8CNmBB47rqG8UCfrew4qhq:2V1gwJyLmeGNmB6rqG83f
TLSH
T103E4F15671C19172E05600325F0BDBA63C363D351B2A9DCB72D8373DAEB52C1A9F932A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5168	B685.tmp

Executes dropped EXE 1 IoCs

pid	Process
5168	B685.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_a05e5666f5fbe0f2112ccf6bdc34018f_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B685.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5168	B685.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 5168	1784	2026-07-15_a05e5666f5fbe0f2112ccf6bdc34018f_amadey_elex_remcos_rhadamanthys_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-15_a05e5666f5fbe0f2112ccf6bdc34018f_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_a05e5666f5fbe0f2112ccf6bdc34018f_amadey_elex_remcos_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Users\Admin\AppData\Local\Temp\B685.tmp
  "C:\Users\Admin\AppData\Local\Temp\B685.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-15_a05e5666f5fbe0f2112ccf6bdc34018f_amadey_elex_remcos_rhadamanthys_smoke-loader.exe 296562C6CE99E156475A23726ABE01BBBDFF66AC0AF2A07AB84D418F45A4D3936939D3FE8B696F04548535C4D3F46429EF9721FADF8897AF52DC9DE36C1CD1BC
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

B685.tmp

Path C:\Users\Admin\AppData\Local\Temp\B685.tmp
Size 664KB
SHA256 499f6905590cef10287e306d6fd957152e0d1e14e59264a9566e35a83530db54
MD5 4d1050b0dfbc55e51827dae82712db2a
SHA1 34fec1ee997a87183fa4b0664721921d20829d5c
SHA512 ba9139597188b5f620197616b3343191fef86e2cc0753de56fdf5ae222c0a51659a73bb600a91b56fa5e86efee9fb1b16af5930d5c20763d1051a2c8e37df278
SSDEEP 12288:2Jkqpbzc1wJy9NmQyss831/HIioLXFumitrDpRNjFb92ARwpv/qhq:2V1gwJyLmex/uLXLWBRp2AG
TLSH
T13BE4E055B1C1D133D05A10325E4BDBA629323E355B669DCB72C8373DAE312C1AAF632B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads