55c39db79146c0df24a72c767b6bb3a7abfbc84e3c505e506843db2f05c8c418

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 22:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_6a3ae9e56a1a8e1904cc4e5dab3b73ed_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Size 531KB
Sample260728-2sbplscc94
SHA256 55c39db79146c0df24a72c767b6bb3a7abfbc84e3c505e506843db2f05c8c418
MD5 6a3ae9e56a1a8e1904cc4e5dab3b73ed
SHA1 2d90e91aa96956ac6875a657b9725e8eb481dc16
SHA512 d90c952008fb2fbec0943c311e552ae4246aaf73594b490dbfdc95f1aa9089dd7a389e64424ad31bacb124bd10b00616eca8d5b631f90bddc895892f2b5d7b8b
SSDEEP 12288:cdcAIffrC9fdm7nafW46hTurJVS+N7fn5nPmR:cdpInm9fdmufx6hTurJVS+Rn5PmR
TLSH
T1F2C4F15172C3C2B3D19604321B5ACBA26C7A39355B295ECBB2C4777D6E312C2B6B131B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4132	5F4D.tmp

Executes dropped EXE 1 IoCs

pid	Process
4132	5F4D.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5F4D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_6a3ae9e56a1a8e1904cc4e5dab3b73ed_amadey_elex_remcos_rhadamanthys_smoke-loader.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4132	5F4D.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 4132	4140	2026-07-28_6a3ae9e56a1a8e1904cc4e5dab3b73ed_amadey_elex_remcos_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-28_6a3ae9e56a1a8e1904cc4e5dab3b73ed_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_6a3ae9e56a1a8e1904cc4e5dab3b73ed_amadey_elex_remcos_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Users\Admin\AppData\Local\Temp\5F4D.tmp
  "C:\Users\Admin\AppData\Local\Temp\5F4D.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-28_6a3ae9e56a1a8e1904cc4e5dab3b73ed_amadey_elex_remcos_rhadamanthys_smoke-loader.exe BB43F86FD5CB906E704775CD047A1DDF2711114801583221180F98F7F3825CCA0C67445D2954B215B0DE282FE6DCD5034C301927E416E2605B071904F628D007
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5F4D.tmp

Path C:\Users\Admin\AppData\Local\Temp\5F4D.tmp
Size 531KB
SHA256 09fa8aa5ae687d743a98a4a953e24497b6de796bd1b248e6ae11bfd0b71f2795
MD5 f86f2b44df88066e8c9b564d667ac693
SHA1 882ad71af061e8f862bde5b4e887b888bee7a9bd
SHA512 9ac1b3db5f199bc53cd7140f0612a854e81fb0e6f3230a37ea5992cf365b1c4d904ea500ee3f17c067d6e36f1b0f6d64803ea4ace214f859b5a4f4ef656f3ef9
SSDEEP 6144:c00GMcYNIZZoWDk2T/qp9fooNmTHnnaH8nWHwV4WYZ2gu+SH+9/vbf6UN2WfEjI8:cdcAIffrC9fdm7naOWg1coEN7fn5nPmR
TLSH
T1A5C4F19172D3D1B2D08204321AAACBB22D7A79344B1A5EC772D0777D7D317C2A6B631B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads