a18395720949f885a47cffb6711861ea37c7feb2dbb9b64914e53fc3fe32af52

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 18:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_540a90edfb13ae59beb4158ca7ccbb38_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Size 531KB
Sample260802-w8cc7avyfw
SHA256 a18395720949f885a47cffb6711861ea37c7feb2dbb9b64914e53fc3fe32af52
MD5 540a90edfb13ae59beb4158ca7ccbb38
SHA1 11d2fd98b88897e3668e19ab2cb14ac8da9ac13a
SHA512 3090305dfb63d8db0037ca26e9695586b62fbfaf40e1533f4f9eb21fa65a82c0ab2e31df36e5db1ca906873f914f5a499e378bba43121e706bb4ac2abd99096d
SSDEEP 12288:cdcAIffrC9fdm7na2VWJ3HNXG6OVEdRO0LCnN7fn5nPmR:cdpInm9fdmuvBVCnRn5PmR
TLSH
T1E3C4F09136D3C1B2D19610331AABCBB22C7A39354B1A5DC772D4377DAE70AC266B2317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3400	3AF.tmp

Executes dropped EXE 1 IoCs

pid	Process
3400	3AF.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_540a90edfb13ae59beb4158ca7ccbb38_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3AF.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3400	3AF.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 3400	4856	2026-08-02_540a90edfb13ae59beb4158ca7ccbb38_amadey_elex_remcos_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-02_540a90edfb13ae59beb4158ca7ccbb38_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_540a90edfb13ae59beb4158ca7ccbb38_amadey_elex_remcos_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Users\Admin\AppData\Local\Temp\3AF.tmp
  "C:\Users\Admin\AppData\Local\Temp\3AF.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-02_540a90edfb13ae59beb4158ca7ccbb38_amadey_elex_remcos_rhadamanthys_smoke-loader.exe D69219EF8CB0493021047B2C8CA0993D4E0EE9EB9DFA0DA00F50BACC67A7C194C6419CCAEEDD5B6957E34AF4635704368963C2FA2760689516F5FCAEAF688F22
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3AF.tmp

Path C:\Users\Admin\AppData\Local\Temp\3AF.tmp
Size 531KB
SHA256 0d11a951dcc49f7de6b66b7efd53d355ec98680b5a7336e2e6a074ab2d837bcc
MD5 d02348d6b3685135c785551f5d3d2d24
SHA1 969eea5a8cc685ef358ccdbeab6356ff35995f4c
SHA512 6d00d5ccf65dfff1d383fbaaf0f663b417f0b230d7c8b3765ec22f699c01aa57e1ae8c81ed016a4488021428ada393c93e51f431729fbe1f496d79427b5dfa43
SSDEEP 12288:cdcAIffrC9fdm7nazJ2PubUMtom2fN7fn5nPmR:cdpInm9fdmuUqUMARn5PmR
TLSH
T1EDC4F05172C3D1B2D08614330AABCBA26D3A39315B295DC7B6D033BDBE316C266B6357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads