07adec1256d3df9d7ba0eec941d3ac6deb5ed910231f4bbd924e94db561e5635

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 16:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_fbbef6554b8630e879380e78aca4dcd7_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Size 531KB
Sample260729-t7ee2sbe64
SHA256 07adec1256d3df9d7ba0eec941d3ac6deb5ed910231f4bbd924e94db561e5635
MD5 fbbef6554b8630e879380e78aca4dcd7
SHA1 b6bcdbaed758ab6c13a5227bb0e6b0fbbbe108f2
SHA512 98e4a9072ca93c13d476f3b418b5d9c65d027a06a20f315fc9f341c2272b8787594fe95a739884da3edf9405b6e67c629533c51525db9bedca9608e95e178c78
SSDEEP 12288:cdcAIffrC9fdm7naK/P6DwqhfCSu9NT8N7fn5nPmR:cdpInm9fdmuTDwofCSu3YRn5PmR
TLSH
T10FC4F06172D3C2B2D18614325AAACBF2283A39315B196DCB73D0777DBE306C266B1357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4760	FA3A.tmp

Executes dropped EXE 1 IoCs

pid	Process
4760	FA3A.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_fbbef6554b8630e879380e78aca4dcd7_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FA3A.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4760	FA3A.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 4760	3368	2026-07-29_fbbef6554b8630e879380e78aca4dcd7_amadey_elex_remcos_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-29_fbbef6554b8630e879380e78aca4dcd7_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_fbbef6554b8630e879380e78aca4dcd7_amadey_elex_remcos_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Users\Admin\AppData\Local\Temp\FA3A.tmp
  "C:\Users\Admin\AppData\Local\Temp\FA3A.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-29_fbbef6554b8630e879380e78aca4dcd7_amadey_elex_remcos_rhadamanthys_smoke-loader.exe 30AFB0336A9F18E0A9D092CB31920387A4C6E81BF010AA23E2F9CDC03AE9B9BA4609846AA09ABFF45F7D4367BFC9CDD6D53441512056314187CA589089769C1D
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FA3A.tmp

Path C:\Users\Admin\AppData\Local\Temp\FA3A.tmp
Size 531KB
SHA256 dbf73db1fef52addba25be5b0f6ec10258a0df53ba05c59e66c70ab90a873a79
MD5 f67f948418eab692a62a357d70baf505
SHA1 a44a879dc28ceecb90a163d79f685fa5b9102cb5
SHA512 ef9faf94a86e40a2494d42ddb24f7f0e5d427e9f6d571716904092f75e7f9a683d36728fe62ac207dacaaa4edc5f2fb969bb09383f6963cc0197b1473a8c25b5
SSDEEP 12288:cdcAIffrC9fdm7naqu2tVC+jGN7fn5nPmR:cdpInm9fdmuqu2jhKRn5PmR
TLSH
T174C4F05166C3C1B2D08610321BABCBA22C3A39355B299DC772D4377DBE317C1A6B6367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads