6e8e340bf78d98b7948aae4474e13179ae65d497a408f398162c4f410f008f47

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/08/2026, 01:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_ce88945d9277515abe104701634a1f14_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Size 696KB
Sample260801-bd3xfabc85
SHA256 6e8e340bf78d98b7948aae4474e13179ae65d497a408f398162c4f410f008f47
MD5 ce88945d9277515abe104701634a1f14
SHA1 0f73061e48e628d1c0bfad2bd7b48cca913883d6
SHA512 cbcc1bdb1804f415f2f2722ca0e3bd23d36aaa8074fdfa8810a06987bf9565e0a96ba5aecebb605fb0e8a7d784838aec4ddb05155888d16d4e9a913ea5416113
SSDEEP 12288:OwBhHmq7dq93QKqZwe/8Qa5pUE9DnkOdWL0FI7CfrYq:OYHI93Rq/jg9lkf4
TLSH
T146E4F116B1809273D18605725E1BD7B63D3B3D341B2A5DC732D8767C2A722C1AAFA327
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4080	8373.tmp

Executes dropped EXE 1 IoCs

pid	Process
4080	8373.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_ce88945d9277515abe104701634a1f14_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8373.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4080	8373.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 4080	2340	2026-08-01_ce88945d9277515abe104701634a1f14_amadey_elex_remcos_rhadamanthys_smoke-loader.exe	82

C:\Users\Admin\AppData\Local\Temp\2026-08-01_ce88945d9277515abe104701634a1f14_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_ce88945d9277515abe104701634a1f14_amadey_elex_remcos_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Users\Admin\AppData\Local\Temp\8373.tmp
  "C:\Users\Admin\AppData\Local\Temp\8373.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-01_ce88945d9277515abe104701634a1f14_amadey_elex_remcos_rhadamanthys_smoke-loader.exe 7591183D3071A5D62CAB40723B66E35EEAA06D11B56F23E71188B3EB6C25E6BC6BE0B6F6E286B376D105E98CFEA9076E2DFF7D50CFF317D44F9D3CAE5E3C7797
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8373.tmp

Path C:\Users\Admin\AppData\Local\Temp\8373.tmp
Size 696KB
SHA256 040570cddaacda142c0469475675214acdc2f22ca48b506acf0ba04555963535
MD5 b5e75afe660ffde8304f121c010ba501
SHA1 16c7b0fce6ee1b55fe7733359e33c5b7dd69126f
SHA512 7147c805bdf3fde394fcde4f22af81672659429ade68502980a96110e17b1f590ed20117a1839795561968440fd2114df6b0d4c3536ca6ce395dd3e34b004eb8
SSDEEP 12288:OwBhHmq7dq93QKqZwe/8xiPGhm3ljp+WyXQHhl+T3I5KqQAdq:OYHI93Rq/Z+mD+jQHc45EA
TLSH
T18EE4E12571C19233D09701325E5BC7A27D3A3E356B2A9DC731D8363D2E712C1AAF932A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads