b7eb65954ab3830cf595a26c0be14266a0a0d43aeb481246a9549eb510b1692c

Analysis

max time kernel
148s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 17:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_83fd5db79ec4bb660e6f3cc6a2f7cb50_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Size 531KB
Sample260802-wflfdstzhs
SHA256 b7eb65954ab3830cf595a26c0be14266a0a0d43aeb481246a9549eb510b1692c
MD5 83fd5db79ec4bb660e6f3cc6a2f7cb50
SHA1 33c123826aa24484adc0ef0d4316af6900a78be1
SHA512 21470fd69e25c3ac0b347c41d666cebd4ede9787e67e3d9d3f2f5c1ab7ee91eb1aaf081e22a09b871fce5a964e1c70ceb63b4ca9d5e3b75ae9049a507f0adecb
SSDEEP 12288:cdcAIffrC9fdm7naUXKNAbA6rfO3M1e+N7fn5nPmR:cdpInm9fdmuYKNAbJrfO81xRn5PmR
TLSH
T1C0C4F19176E2C1B2D09604335A6BC7B12C7A39314B196EC772D0377DBE316C2A6B532B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4212	3AEC.tmp

Executes dropped EXE 1 IoCs

pid	Process
4212	3AEC.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_83fd5db79ec4bb660e6f3cc6a2f7cb50_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3AEC.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4212	3AEC.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 4212	2260	2026-08-02_83fd5db79ec4bb660e6f3cc6a2f7cb50_amadey_elex_remcos_rhadamanthys_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-02_83fd5db79ec4bb660e6f3cc6a2f7cb50_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_83fd5db79ec4bb660e6f3cc6a2f7cb50_amadey_elex_remcos_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Users\Admin\AppData\Local\Temp\3AEC.tmp
  "C:\Users\Admin\AppData\Local\Temp\3AEC.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-02_83fd5db79ec4bb660e6f3cc6a2f7cb50_amadey_elex_remcos_rhadamanthys_smoke-loader.exe C00B423801328782CC2D515DF582AA8DA7FBB70CF2C1214AA085E718E394DB766F8EE6DE61D1223B6DEADD680651A68A69098BA8721AF46738177247315A0F26
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3AEC.tmp

Path C:\Users\Admin\AppData\Local\Temp\3AEC.tmp
Size 531KB
SHA256 5bd138d6f126f47cedfdb6e402ac7f1e4a19cdf2167d9ca647efde664fe7729f
MD5 a7f5f0fd8beccc8697e5787410573197
SHA1 9b6820f2d2025eb70b1b3fbd79015c25cce93691
SHA512 9b7406f41f7f797296c1c6e9bacbf215264a5ca77814896e06916206f1512baea4acfe3bc1cc69db6c755e6d09a6ec19ad67c7ab42194b8e159d68f22c72633b
SSDEEP 12288:cdcAIffrC9fdm7naorrXtNN94CGVKN7fn5nPmR:cdpInm9fdmuorrdKCGARn5PmR
TLSH
T151C4F06172D382B2D082143216ABDBB22D3A39315B29ADC776D077BDBD317C166B131B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads