a8b052ccdfa187638c33c47f8ba65bcc8e712ee1cdb68ed6ca1d3f387384d4cd

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 22:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_ad66ddffe7a7d8e1e83ef20163eb155b_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Size 531KB
Sample260728-18wt2sxend
SHA256 a8b052ccdfa187638c33c47f8ba65bcc8e712ee1cdb68ed6ca1d3f387384d4cd
MD5 ad66ddffe7a7d8e1e83ef20163eb155b
SHA1 c2210ec43bac4a6708a0486700290a3275ec7523
SHA512 c46b45fade2d90b6b17d9243298cc4ced2f9bf73ac94afb35ba7f60c456f817e535d8ae3547080e176d1897070bdf7f0e47efe550ebf7edf744d94651e1a8047
SSDEEP 12288:KdcAIffrC9fdm7naycn75E70SSp6A46GzX56k9nroN7fn5nPmR:KdpInm9fdmuycOgSSF41zciroRn5PmR
TLSH
T11AC4F16171C2D1B2E19704331AABCBB22C7A39311B199DC772D07B7D6E316C2A6B1367
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3552	73A.tmp

Executes dropped EXE 1 IoCs

pid	Process
3552	73A.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_ad66ddffe7a7d8e1e83ef20163eb155b_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	73A.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3552	73A.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 3552	4660	2026-07-28_ad66ddffe7a7d8e1e83ef20163eb155b_amadey_elex_remcos_rhadamanthys_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-28_ad66ddffe7a7d8e1e83ef20163eb155b_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_ad66ddffe7a7d8e1e83ef20163eb155b_amadey_elex_remcos_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Users\Admin\AppData\Local\Temp\73A.tmp
  "C:\Users\Admin\AppData\Local\Temp\73A.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-28_ad66ddffe7a7d8e1e83ef20163eb155b_amadey_elex_remcos_rhadamanthys_smoke-loader.exe 1D67400F0E57CA5F40D795680E7A8CFFE683593344E4885AB8CFE02FB94EB141631AE6804FE691682A5CDCA807987FCA4D36535E4CF50C06974D10304FA906B8
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

73A.tmp

Path C:\Users\Admin\AppData\Local\Temp\73A.tmp
Size 531KB
SHA256 d97565f2686cfacc6f8e04ff0a71dcccb27634f09acdc7d5ea4e5417ff25105a
MD5 4462f0bad96f8befe146b67d81f50c0f
SHA1 e50267adca2d9add2b65861fb0f2b1d98b2c4649
SHA512 b64f7002b25a1466ee65ee695d0e3acd501abbd4741145c09b8be8c68214ff146a53f0327a67d453f734ea79a58d566c50dca549fda2d044ed1fc203931ba565
SSDEEP 12288:KdcAIffrC9fdm7namp1m3Aa49HMFy3UN7fn5nPmR:KdpInm9fdmumy38ZaRn5PmR
TLSH
T181C4F05172D381B2D0961432266BCBB12C3A39315B296DC772E477BDBE306C2B6B135B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads