484f69244185687504da38a1404e4f9670e97768d054513b3aa034d1ac9de9f6

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 19:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_11a88f1d87faf24d3c3afc150f88b197_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Size 532KB
Sample260722-yn5v4stemd
SHA256 484f69244185687504da38a1404e4f9670e97768d054513b3aa034d1ac9de9f6
MD5 11a88f1d87faf24d3c3afc150f88b197
SHA1 14ffb03626b085fca3e99714479b5685a64666e8
SHA512 ae1577d95b9a4a350a4e1929c1bac20b3dc0129af9ca9d7c4701af7168178d2cccaae3cef8392ca4661bd4a55dca7e87fbb143354cd7b4f27003089f0ec953a1
SSDEEP 12288:KdcAIffrC9fdm7naDkSyqlNQYEAYbQN7fn5nPm:KdpInm9fdmuDVyqlNQIRn5Pm
TLSH
T156C4F06176D3C272D08615321AABCBB21C3A3A315B295DCB72E47B7D7D316C2A2B1317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1116	2D11.tmp

Executes dropped EXE 1 IoCs

pid	Process
1116	2D11.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_11a88f1d87faf24d3c3afc150f88b197_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2D11.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1116	2D11.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 1116	4900	2026-07-22_11a88f1d87faf24d3c3afc150f88b197_amadey_elex_remcos_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-22_11a88f1d87faf24d3c3afc150f88b197_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_11a88f1d87faf24d3c3afc150f88b197_amadey_elex_remcos_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Users\Admin\AppData\Local\Temp\2D11.tmp
  "C:\Users\Admin\AppData\Local\Temp\2D11.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-22_11a88f1d87faf24d3c3afc150f88b197_amadey_elex_remcos_rhadamanthys_smoke-loader.exe 624FFC3BCE4D63BA2709608F884A82CB5DB39A82C56747D9CAAD1DB8149766F9F0153F4323B8C1082CADDDD06DBC397DE23C78D2EF635A54B31E5C02BAA863BE
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2D11.tmp

Path C:\Users\Admin\AppData\Local\Temp\2D11.tmp
Size 532KB
SHA256 8f795abb32cee2c99f8cc3e3828d0a561024dd55a2f93902a68fa5010b0f2a98
MD5 51344965840ac76726424a352fb86b42
SHA1 6a15be15e680936133fb07b480ed0337ac052d25
SHA512 4a828225d5e0ee1fda34c07b8d341c64afda5042bdec5cbbfef90b2188a0fb2cfb6bbff574dff784b34bf7bd41b323088f6e8abacf492c5f1b8bad4ef6192c2d
SSDEEP 12288:KdcAIffrC9fdm7naWXw05ZbI97iuN7fn5nPm:KdpInm9fdmuWXX87xRn5Pm
TLSH
T11BC4E05176D3C272D18605331A9ACBB22C3A79305B28AEC772D0777D6D706C2B6B631B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads