e6302e4aaa3125e6769d1ce5cc735febf001761714e8ee153a892bb49afb5d7b

Analysis

max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 08:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_179718e772bc93285e7cf3af298b656d_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Size 531KB
Sample260718-knnd6set2n
SHA256 e6302e4aaa3125e6769d1ce5cc735febf001761714e8ee153a892bb49afb5d7b
MD5 179718e772bc93285e7cf3af298b656d
SHA1 34a1aea481e938c90a01e7dfd26b209d809a37ef
SHA512 fb7992cac2a48fccba1b3c648970f8efbeba793a2cdb2e96b6e4e6180f5b6f9cc0f0ecf345aa6d3238e92f9b4ab15c72f220d3dbd3a8e43ab9725690b04f0619
SSDEEP 12288:KdcAIffrC9fdm7na9+Q2x/4PqZH0MqWX3IQZtByHN7fn5nPmR:KdpInm9fdmu9nWX3mRn5PmR
TLSH
T10CC4F15166C3C1B2D18714321A9BCBB26D3A39314B29ADC772D07ABD7D306C2B6B531B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4920	4982.tmp

Executes dropped EXE 1 IoCs

pid	Process
4920	4982.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_179718e772bc93285e7cf3af298b656d_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4982.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4920	4982.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 4920	4572	2026-07-18_179718e772bc93285e7cf3af298b656d_amadey_elex_remcos_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-18_179718e772bc93285e7cf3af298b656d_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_179718e772bc93285e7cf3af298b656d_amadey_elex_remcos_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Users\Admin\AppData\Local\Temp\4982.tmp
  "C:\Users\Admin\AppData\Local\Temp\4982.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-18_179718e772bc93285e7cf3af298b656d_amadey_elex_remcos_rhadamanthys_smoke-loader.exe AFFE74DEB8C772D492092243BEE24DB9F5656A77C28C933D8ADED0DE3AC24FAA7DBC361639AA1E313AB2E2E401FF912ADD2CA4D4BC1CBFA69081685B19209A9B
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4982.tmp

Path C:\Users\Admin\AppData\Local\Temp\4982.tmp
Size 531KB
SHA256 f4b752450acc071323a9be6f4b982bcf5ba057ec7f5b86b2380008ca1f0a060e
MD5 155458db6b7cf2f362c40fa7ea66c8bb
SHA1 cb8994501cc5dbaf3ab1fae71d2af597bc4675ba
SHA512 966bae5ea5b364342b0e7c6931f066423a1cd2c4555645dc99f7db97bed61d01f23a3e6b3b76f8216a92eb7f6e174abbbb841b1bc899922a5a32a5ca04cf7302
SSDEEP 12288:KdcAIffrC9fdm7na1fKBUzTW9iss+6SrOlN7fn5nPmR:KdpInm9fdmudSUsPZwRn5PmR
TLSH
T14BC4F05176C3D2B2D08A14321A5ACBB22C7A39315B299DC7B6D0777D7E317C2A2B1327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads