095469df9ad47366fd6033f7c7af6f9f5afa1d21e99ae8efb5ef4fde147de839

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 01:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_308f319dcd02487a3f4f8f7cbd09512e_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Size 531KB
Sample260723-cc1lcsvsfw
SHA256 095469df9ad47366fd6033f7c7af6f9f5afa1d21e99ae8efb5ef4fde147de839
MD5 308f319dcd02487a3f4f8f7cbd09512e
SHA1 0221d64a0101a656a451494331c902741eddf8f4
SHA512 6d478234d086d1a6214040384cbfdda40565fd1dd76cc8369159f2a809fb669c4931a9dc3965d0782432cd121d3537e6e8adfbe82ccb43fd256be065e1d98730
SSDEEP 12288:KdcAIffrC9fdm7naR/RYRZoI5N7fn5nPmR:KdpInm9fdmuaZrRn5PmR
TLSH
T1B7C4F15171C3D1B2D08610322A6ACBB22C3A79354B296DCB76D077BD7D316C2B6B532B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5868	3D3E.tmp

Executes dropped EXE 1 IoCs

pid	Process
5868	3D3E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_308f319dcd02487a3f4f8f7cbd09512e_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3D3E.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5868	3D3E.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 5868	4100	2026-07-22_308f319dcd02487a3f4f8f7cbd09512e_amadey_elex_remcos_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-22_308f319dcd02487a3f4f8f7cbd09512e_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_308f319dcd02487a3f4f8f7cbd09512e_amadey_elex_remcos_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Users\Admin\AppData\Local\Temp\3D3E.tmp
  "C:\Users\Admin\AppData\Local\Temp\3D3E.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-22_308f319dcd02487a3f4f8f7cbd09512e_amadey_elex_remcos_rhadamanthys_smoke-loader.exe 0D1857A0922EAE85FE66BD1DA87FEF42E562EBB9CFD2E7B414E7079F8183A69D27630A55798F51C5F5E3F325575244C5527EEF3B7FA437A1C4EF42EB6502C3C8
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3D3E.tmp

Path C:\Users\Admin\AppData\Local\Temp\3D3E.tmp
Size 531KB
SHA256 37d7647c946a698fe8ebc99dda1645cce915c169ab74c8e0688b10a1be7f443d
MD5 bfee4f3f39e6badaaab22cb47dd89971
SHA1 b1cc3c017c2ea845adc56ee3862b3179051c7f0c
SHA512 2b843f19d6cc586b6a3bbd790b5c10ed6b97fdb8b87040c5d0bdd8b405c29f1a472695590b3d342f0db3b9a99062bac523743c229b5abed7071397d2a240ea44
SSDEEP 12288:KdcAIffrC9fdm7naQep9QqYkYaiWODdN7fn5nPmR:KdpInm9fdmuQep9CrRn5PmR
TLSH
T12DC4F05166C3C1B2D09614331AAADBB22C3A3A315B195DC772D4377DBE317C2A6B231B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads