a44ba60959831d650023fcbbb434bacca0fbaef3a54197136a00fa2d260b3e4b

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 17:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_943dd7fd8ae0ffb2001738f93b5de2f5_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Size 531KB
Sample260729-vy3xqa1vbv
SHA256 a44ba60959831d650023fcbbb434bacca0fbaef3a54197136a00fa2d260b3e4b
MD5 943dd7fd8ae0ffb2001738f93b5de2f5
SHA1 1fb9f7202ffaf77f11e0972fb93e10be864fc9aa
SHA512 6faad982e850b4a8051da67f84c225b039d501d4b7d9a8a964eb675b4c5f041676e86d4924342918e31ec1083b0a8c9b82fbfd846ae11786fcd818ad84ca1e1a
SSDEEP 12288:cdcAIffrC9fdm7naz8D6lNDdnvVfN7fn5nPmR:cdpInm9fdmu4D6lNhndfRn5PmR
TLSH
T1E8C4F16175C2C1B2D09604321BABCBB12C3A39315B296DC776D0767DAE317C2BAB135B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4608	DC2.tmp

Executes dropped EXE 1 IoCs

pid	Process
4608	DC2.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DC2.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_943dd7fd8ae0ffb2001738f93b5de2f5_amadey_elex_remcos_rhadamanthys_smoke-loader.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4608	DC2.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 4608	2272	2026-07-29_943dd7fd8ae0ffb2001738f93b5de2f5_amadey_elex_remcos_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-29_943dd7fd8ae0ffb2001738f93b5de2f5_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_943dd7fd8ae0ffb2001738f93b5de2f5_amadey_elex_remcos_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Users\Admin\AppData\Local\Temp\DC2.tmp
  "C:\Users\Admin\AppData\Local\Temp\DC2.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-29_943dd7fd8ae0ffb2001738f93b5de2f5_amadey_elex_remcos_rhadamanthys_smoke-loader.exe EE3C8F8052D52A6035BAE1DCF0C453734D8A9F6674C2B53EC6CBC0202E253C28E560A16BDE62489D21A27755BAADB13738102BD9AF680BFEEE6DA9E883505258
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DC2.tmp

Path C:\Users\Admin\AppData\Local\Temp\DC2.tmp
Size 531KB
SHA256 cc702a03c194e2d76fdb8d77bf041ffae150f49152167f3c47387dfd3cc5165b
MD5 5c74abcd360e9607eaab50fd97f122b6
SHA1 caa41fb218e79b1616449ba5eff2f71af9ea35c0
SHA512 78e6321299763de632c03fc37e621fc63c08ad8a94de70810584b8d59d5ef39b811a802c2887f61e244301db8718e9e708994f10392882bcaf217683d3f2305c
SSDEEP 12288:cdcAIffrC9fdm7na6t9ExT8r8a91gN7fn5nPmR:cdpInm9fdmu/t8rP9aRn5PmR
TLSH
T10BC4F05176C381B2D08714331AAACBB22C7A39314B299EC7B6D4377CBD716C2A6B5317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads