6cc6afd4a0aa4c0c5482395fb21489a823cb840338e59644d06f646e83b96260

Analysis

max time kernel
150s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 16:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_ed51f146826801c3f0eb52a87c7e0f4d_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Size 531KB
Sample260802-tre2mswfnh
SHA256 6cc6afd4a0aa4c0c5482395fb21489a823cb840338e59644d06f646e83b96260
MD5 ed51f146826801c3f0eb52a87c7e0f4d
SHA1 1ed380c6e10baf86b55edd184fcb0f71f25a8933
SHA512 7543ce18b311d35b378ea92e3d699cd60101e46704564ae6e6f1aaf7713976a4c3d27634ab7f0b20c82bc5899ab72c7798e30bce77be5e5b5d3efcc719318aa2
SSDEEP 12288:KdcAIffrC9fdm7nadtdyUgtYUvR5eGjaN7fn5nPmR:KdpInm9fdmuhyfCGjaRn5PmR
TLSH
T16EC4F15136D3C172D08604331AAACBA22C7A39354B296EC772D4367DBE317C2B6B535B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5312	2E79.tmp

Executes dropped EXE 1 IoCs

pid	Process
5312	2E79.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_ed51f146826801c3f0eb52a87c7e0f4d_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2E79.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5312	2E79.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 5312	4364	2026-08-02_ed51f146826801c3f0eb52a87c7e0f4d_amadey_elex_remcos_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-02_ed51f146826801c3f0eb52a87c7e0f4d_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_ed51f146826801c3f0eb52a87c7e0f4d_amadey_elex_remcos_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Users\Admin\AppData\Local\Temp\2E79.tmp
  "C:\Users\Admin\AppData\Local\Temp\2E79.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-02_ed51f146826801c3f0eb52a87c7e0f4d_amadey_elex_remcos_rhadamanthys_smoke-loader.exe 44D56D3C7F98E5740B0461374879FA033DE6A9D33456D91ACFDA7AB36A5EF02CD92E4D536732D4D9486C2FF955B7DE19D7FD095FDF720A079C6F2F1A33F9C613
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2E79.tmp

Path C:\Users\Admin\AppData\Local\Temp\2E79.tmp
Size 531KB
SHA256 fbb55b96458bc1dd8c9891baeb84c3f8e9fd683083bdda3de053e95bcedc9181
MD5 7d104efb1d303639c92a75309f8c91f4
SHA1 5e80079541b72dce6ce8e7e92702401b95c50b99
SHA512 ff3a551795169a3bf526bb26a431a0f3626b13fcc56c23e9455d264c8b21744ec16545d08aeee9a30ae22a568d2b6eb6905c6445eeefe88266ffea3ced10ec7c
SSDEEP 12288:KdcAIffrC9fdm7naeZ2VMhkJyI329TVDjWuN7fn5nPmR:KdpInm9fdmuM2VMRI32XjWuRn5PmR
TLSH
T1A9C4F05162C3D1B2D0831432166BCBA22C3A3D3557295EC7B2E4777DBD306C2A6B632B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads