c7e7de3afd55aa661d5a9895cd3b6f51ceaf804b15a270b7b6242154bcf4a6c0

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 06:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_f919b0dcbeeb7e625294e02247497a5e_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Size 531KB
Sample260803-g45fvazeqd
SHA256 c7e7de3afd55aa661d5a9895cd3b6f51ceaf804b15a270b7b6242154bcf4a6c0
MD5 f919b0dcbeeb7e625294e02247497a5e
SHA1 46de0654f9c4cd7e4de3d1229b73812f8108c473
SHA512 5762f5a9e8239984b07dab514b4e2eb57a7bf2abd0d15b4769b6bdc107ac05939ebadec36391a52aabdbbbedcd5686bc28fe0880dc2e0bd48f5e0c33f9abd0aa
SSDEEP 12288:KdcAIffrC9fdm7naZ/4bB0fW5oWzfCy+mWUwjN7fn5nPmR:KdpInm9fdmuZ/SkW7KySUwjRn5PmR
TLSH
T1AAC4F16075C3C2B2D08614321A9BCBB12D7A79311B2A5DC776D077BDBE316C1A6B132B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5544	AC63.tmp

Executes dropped EXE 1 IoCs

pid	Process
5544	AC63.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_f919b0dcbeeb7e625294e02247497a5e_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AC63.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5544	AC63.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4160 wrote to memory of 5544	4160	2026-08-03_f919b0dcbeeb7e625294e02247497a5e_amadey_elex_remcos_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-03_f919b0dcbeeb7e625294e02247497a5e_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_f919b0dcbeeb7e625294e02247497a5e_amadey_elex_remcos_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4160
- C:\Users\Admin\AppData\Local\Temp\AC63.tmp
  "C:\Users\Admin\AppData\Local\Temp\AC63.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-03_f919b0dcbeeb7e625294e02247497a5e_amadey_elex_remcos_rhadamanthys_smoke-loader.exe 5E4109D2BDE40359D3CF7459CE4DCF780437D5E6F1D5F7161DE81540FD731F0080EA4DCDD96F1DC7837755FE8B71F2F1E081E166716050E43B2C1FB70BC56DD2
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AC63.tmp

Path C:\Users\Admin\AppData\Local\Temp\AC63.tmp
Size 531KB
SHA256 f40628088a42baa1b01012def6dd35c1de131a70ca9a83bbfd00354d051f45b0
MD5 e0908f316318bcbb994af06fa9526c66
SHA1 5a3ee2458dbb7f5293a55c8f6e9f8782f96c84c0
SHA512 dc2028d87a96a102870c321e68b115d069b81c8216a2edef802fc30d11115f533b816bfe2ae6290b2c7ac178b9da145f2d76ffc2fca44d5173f02e4b62061209
SSDEEP 12288:KdcAIffrC9fdm7naId0UJIKUfxflngzJtN7fn5nPmR:KdpInm9fdmucr1UZflngzJtRn5PmR
TLSH
T1ADC4F15176D2C1B2D19610331A6BCBB22D3A3D314B1A9EC772E0777DAE306C2A6B1357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads