d23e02094c808b10cfbedc0994578d13506dc357a7e91b3b8d88084215b90a9e

Analysis

max time kernel
148s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 17:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_ab11bb57d2c476782ef15c7e276328b5_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Size 531KB
Sample260802-vtqrlaxdrc
SHA256 d23e02094c808b10cfbedc0994578d13506dc357a7e91b3b8d88084215b90a9e
MD5 ab11bb57d2c476782ef15c7e276328b5
SHA1 bd5c48f01d75381b1dc758c0695dd7bf3e5f9636
SHA512 fae7e891cbfe077adcee7e909e8a669c03e919186951049797020171366baec0bf7c38eb96ac00871fd905b8d854230db6c34bfd77e6b051ab09cde807890a2b
SSDEEP 12288:cdcAIffrC9fdm7na/ht+/xqCm1N7fn5nPmR:cdpInm9fdmu/6/gRn5PmR
TLSH
T161C4F16166D2C1B2D08604321A9BCBF26D3939315B256DC772E0777DBE317C2A6B132B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5740	85FF.tmp

Executes dropped EXE 1 IoCs

pid	Process
5740	85FF.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_ab11bb57d2c476782ef15c7e276328b5_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	85FF.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5740	85FF.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 5740	4828	2026-08-02_ab11bb57d2c476782ef15c7e276328b5_amadey_elex_remcos_rhadamanthys_smoke-loader.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-02_ab11bb57d2c476782ef15c7e276328b5_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_ab11bb57d2c476782ef15c7e276328b5_amadey_elex_remcos_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Users\Admin\AppData\Local\Temp\85FF.tmp
  "C:\Users\Admin\AppData\Local\Temp\85FF.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-02_ab11bb57d2c476782ef15c7e276328b5_amadey_elex_remcos_rhadamanthys_smoke-loader.exe 5E3817E5C5F7B83D7DAFF34A593D07EEABE25141189B5A241C133161CCF7E48F20AE61FDB2BDF3F9B75E78AEBC5BB017136738E310F774AE8728239803CACA18
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

85FF.tmp

Path C:\Users\Admin\AppData\Local\Temp\85FF.tmp
Size 531KB
SHA256 5256774bad907768d8c470a05e38fbe8fef81426f885a1c384719782722237b3
MD5 e8128eba63f2310834f50211cdf26254
SHA1 8ffc0d1fc609cf69ac9fe4d16a5e705bdddcab67
SHA512 1d28a48c28774f65753f9b7772ff83c5d1f1377fefa3c1ab4de41b1932ef898ee6d647547588a862b05a14f5c2868ba953f0db57fa69b89edeab26b2eb604c5a
SSDEEP 12288:cdcAIffrC9fdm7nazNSE7RuaF2XOeD9bdo5N7fn5nPmR:cdpInm9fdmuY4y/xbu5Rn5PmR
TLSH
T14FC4F15066D38172D197043316AADBB22D7A39318B1A6EC7B2D0377DBD302C2B6B5367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads