7b81bf1298da3d5fc84dcabd2851308b2ebaac155d52d8455bbec66bb08107fe

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 20:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_b6cd424c67cb04e4ad38e0942e899fbf_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Size 531KB
Sample260731-zktjca1cja
SHA256 7b81bf1298da3d5fc84dcabd2851308b2ebaac155d52d8455bbec66bb08107fe
MD5 b6cd424c67cb04e4ad38e0942e899fbf
SHA1 0ee23e98489feb083025febc323ef9c7eb4e92e5
SHA512 277236408535bb24acc3088a0d8a4505cd10655c4a63ac12770df1e8320d03069ccf7692e59c7936b174919bed43adf37b56584d6a9d1de72e9e3333dcb40518
SSDEEP 12288:cdcAIffrC9fdm7naRrfTgMvrqSdv3npN7fn5nPmR:cdpInm9fdmudTJjqI3pRn5PmR
TLSH
T18AC4F15076C3C2B2D08715331AAACBA22D7A39315B295DC772D0777DAE31AC1A6B2317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2860	2AA5.tmp

Executes dropped EXE 1 IoCs

pid	Process
2860	2AA5.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_b6cd424c67cb04e4ad38e0942e899fbf_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2AA5.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2860	2AA5.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 448 wrote to memory of 2860	448	2026-07-31_b6cd424c67cb04e4ad38e0942e899fbf_amadey_elex_remcos_rhadamanthys_smoke-loader.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-07-31_b6cd424c67cb04e4ad38e0942e899fbf_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_b6cd424c67cb04e4ad38e0942e899fbf_amadey_elex_remcos_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:448
- C:\Users\Admin\AppData\Local\Temp\2AA5.tmp
  "C:\Users\Admin\AppData\Local\Temp\2AA5.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-31_b6cd424c67cb04e4ad38e0942e899fbf_amadey_elex_remcos_rhadamanthys_smoke-loader.exe 18766CB70329EE579AEBFA5D141F511EF421AFA79CFCDB7624AF51FE9F819D90A4D3A039930B893E9C132362BF1D9D35F0BE23F69790972913714C92B931B9BF
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2AA5.tmp

Path C:\Users\Admin\AppData\Local\Temp\2AA5.tmp
Size 531KB
SHA256 0a0952601c093a81a6af06819cf06a92f7dd04f7b5eda2d38f84ed5fbd9749b7
MD5 1489fad39d34f5ff4f99e172cedd58a4
SHA1 aa49a976372e97ea8791f3e7457d15c7ea2f3357
SHA512 705930025dcd606594571103489ecae7d5b4c1046e37d0ff2cdd41f668a969a0f1ee8af2368f3457a4a390f1792b3e41d3941d52cb0ba1f7ef99d1a02822ebe3
SSDEEP 12288:cdcAIffrC9fdm7naA9y2SA/3x1UvAWN7fn5nPmR:cdpInm9fdmu1JuxWRn5PmR
TLSH
T1F0C4F15276D3C1B2D08600331A5ACBB22C7A79355B296EC772D037BDBE316C2A6B5317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads