bd193a36864da2c14da9b2df4dfd1e2d93271c5aaf7a99338d4f79c783e99905

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 14:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_9ea0cb99ee67bfee592c87437e251508_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Size 611KB
Sample260721-sa296swwht
SHA256 bd193a36864da2c14da9b2df4dfd1e2d93271c5aaf7a99338d4f79c783e99905
MD5 9ea0cb99ee67bfee592c87437e251508
SHA1 23e448ec52379bd77d1760c5118cd271f394df9d
SHA512 fd7217604bea3663b57a17066a9cdc8cc3acda58c3f1860d469327c3dd7b5d8183d32a3d09873061aacba380621d72a5e84eac9a01f87b05700aa16600476dda
SSDEEP 12288:3wBhHmq7dq93QKqZwe/84mu6jRoJSwJrLwVz+WxHabSOMM/qU:3YHI93Rq/q/j+JLJrLUz+WxHutMY
TLSH
T1CED4F11971C1D173E08A14325A5BD7A22C3A3D351B266DDB73E4367C6E312C1AAFA327
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3160	5308.tmp

Executes dropped EXE 1 IoCs

pid	Process
3160	5308.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_9ea0cb99ee67bfee592c87437e251508_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5308.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3160	5308.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 3160	4376	2026-07-21_9ea0cb99ee67bfee592c87437e251508_amadey_elex_remcos_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-21_9ea0cb99ee67bfee592c87437e251508_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_9ea0cb99ee67bfee592c87437e251508_amadey_elex_remcos_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Users\Admin\AppData\Local\Temp\5308.tmp
  "C:\Users\Admin\AppData\Local\Temp\5308.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-21_9ea0cb99ee67bfee592c87437e251508_amadey_elex_remcos_rhadamanthys_smoke-loader.exe 059AC6A041223FADCD136C3BA23F5169EE506A92CD5BCE5B9DEF8DA9D60CDC595BF4F5AB06F2F37BC6E4E1DB19E3F135C48AA35E0FC61390644DE8D1E2AC5482
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5308.tmp

Path C:\Users\Admin\AppData\Local\Temp\5308.tmp
Size 611KB
SHA256 01d0a42c7cc9a64f3b16f554e6cac26f7840e7b202f8c174262ac5d51e810000
MD5 a32b6d4d9b9b8bc88890e2bb3695c524
SHA1 b8c3f4d617746f1789df4560f8f1c76bba7065ed
SHA512 1795a29b1e4a3a388093469f68250eca768eed651272649696976372747df23d2c424918beca4b2ae7259ad6023158b8a58798f74fb1cf4c7f340211edfec482
SSDEEP 12288:3wBhHmq7dq93QKqZwe/8tHAvF4yuuPY2vyIEqU:3YHI93Rq/6yFnuiYrIm
TLSH
T1C3D4F11561C2D1B3E09610324A1BD7A23D3A3E361B2B5DCB76D4367D6D312C2AAF9327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads