9ecf80d8917cae5ce1d68973374cf787372aaf8f10608706278569ddc4ef1b2e

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 01:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_5f54892fe617df7495795d9f2f708172_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Size 531KB
Sample260729-bhnnbaszew
SHA256 9ecf80d8917cae5ce1d68973374cf787372aaf8f10608706278569ddc4ef1b2e
MD5 5f54892fe617df7495795d9f2f708172
SHA1 3a27be0f204b8507958c118cb3a70f96584fa1d2
SHA512 c943a67180516b34211c89da748974d10d3a4e8fc2fe83a98816d258cf2bb285aea9ffe29946fd86f42976637b422ec91757a211b3b91f2d451660e0967c7c84
SSDEEP 12288:KdcAIffrC9fdm7nanD5oeEpPDgSub02kx9GN7fn5nPmR:KdpInm9fdmuDsprqb028GRn5PmR
TLSH
T1FAC4F01162C3C2B2D08614331AABCBA22C3A3D354B1A9DC776D4777DBE316C2A6B5357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2172	1B2F.tmp

Executes dropped EXE 1 IoCs

pid	Process
2172	1B2F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_5f54892fe617df7495795d9f2f708172_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1B2F.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2172	1B2F.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 2172	4856	2026-07-28_5f54892fe617df7495795d9f2f708172_amadey_elex_remcos_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-28_5f54892fe617df7495795d9f2f708172_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_5f54892fe617df7495795d9f2f708172_amadey_elex_remcos_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Users\Admin\AppData\Local\Temp\1B2F.tmp
  "C:\Users\Admin\AppData\Local\Temp\1B2F.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-28_5f54892fe617df7495795d9f2f708172_amadey_elex_remcos_rhadamanthys_smoke-loader.exe FC34964E760F6F3D07B52332A5DAD2679DC3FC06EB29C51ED118133E66479B24008435740F8D6EA05BBD66D3BEA95BB128972AD45890CE7170B2E21F5880F79E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1B2F.tmp

Path C:\Users\Admin\AppData\Local\Temp\1B2F.tmp
Size 531KB
SHA256 6df5998a6c5aae7db38080e217e35311faa4173f1732b423ac3704456a037006
MD5 8c8ad193b81aa78219af68ff40de0056
SHA1 6c1f14c8dd6aa1b3e16844e75e3582fcbebe0214
SHA512 0821da0c593a6f10400b39577640d9afcb8e993ea3049cd7f2da6538a9936712ee6d29566bfba5825043fb0adfe393a020950b639de2b8567c1213221c3f4bc1
SSDEEP 12288:KdcAIffrC9fdm7nagv+d9cpXZO93AYF3JStN7fn5nPmR:KdpInm9fdmuggcxZOd93qRn5PmR
TLSH
T1F1C4F05176C3C172E09614331AAACBB22D3A79314B295EC772C07BBD6E316C2B6B1317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads