7b81bf1298da3d5fc84dcabd2851308b2ebaac155d52d8455bbec66bb08107fe

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 20:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_b6cd424c67cb04e4ad38e0942e899fbf_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Size 531KB
Sample260731-zktjca1cja
SHA256 7b81bf1298da3d5fc84dcabd2851308b2ebaac155d52d8455bbec66bb08107fe
MD5 b6cd424c67cb04e4ad38e0942e899fbf
SHA1 0ee23e98489feb083025febc323ef9c7eb4e92e5
SHA512 277236408535bb24acc3088a0d8a4505cd10655c4a63ac12770df1e8320d03069ccf7692e59c7936b174919bed43adf37b56584d6a9d1de72e9e3333dcb40518
SSDEEP 12288:cdcAIffrC9fdm7naRrfTgMvrqSdv3npN7fn5nPmR:cdpInm9fdmudTJjqI3pRn5PmR
TLSH
T18AC4F15076C3C2B2D08715331AAACBA22D7A39315B295DC772D0777DAE31AC1A6B2317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1268	68B3.tmp

Executes dropped EXE 1 IoCs

pid	Process
1268	68B3.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_b6cd424c67cb04e4ad38e0942e899fbf_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	68B3.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1268	68B3.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 1268	4108	2026-07-31_b6cd424c67cb04e4ad38e0942e899fbf_amadey_elex_remcos_rhadamanthys_smoke-loader.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-31_b6cd424c67cb04e4ad38e0942e899fbf_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_b6cd424c67cb04e4ad38e0942e899fbf_amadey_elex_remcos_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Users\Admin\AppData\Local\Temp\68B3.tmp
  "C:\Users\Admin\AppData\Local\Temp\68B3.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-31_b6cd424c67cb04e4ad38e0942e899fbf_amadey_elex_remcos_rhadamanthys_smoke-loader.exe B9EAE54BE47153BE5E54BD2F01DC9119D5B44296592C2E6E0E96A1C64E0309E8DC09AAE6EDA341B2B12D2692BC07E8FB40384E2E62AD5B363D5960BAAC0B99B2
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

68B3.tmp

Path C:\Users\Admin\AppData\Local\Temp\68B3.tmp
Size 531KB
SHA256 50d9669bf3ab9f3971c2d0d1467ffc0e61327496475db9c2c958efc16c97bb80
MD5 5c6e261a31e3611289ec2dcbf18de064
SHA1 94e0d9504aae42a62662dad9a71013f33c40eca3
SHA512 b974d46120c1536436de0e32317cf3e744bc0d17654197a5fb9c3849199c2c979477b927da89b9a7b8ca9ccf0100692de1933de45fd7d50f74ed08d1d0c7b9be
SSDEEP 12288:cdcAIffrC9fdm7nagtzKPy9hl2GEoN7fn5nPmR:cdpInm9fdmuBy972VoRn5PmR
TLSH
T1CAC4F15172D381B2D08714331AABCBB22D3A39305B1A6DC7B6D0777DAE716C2A6B1317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads