9ac956543442ab3162f92836afc4ae00f2d55fab303d1241b354b580b78cc3a9

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 14:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_c1b4c78bbb8ef04f7e55ac29b0041756_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Size 612KB
Sample260803-rc3s2ssvbx
SHA256 9ac956543442ab3162f92836afc4ae00f2d55fab303d1241b354b580b78cc3a9
MD5 c1b4c78bbb8ef04f7e55ac29b0041756
SHA1 d22991307fc71155c73c04d77185927391bb1901
SHA512 6890cd94837d78a3aafad919301e4a1ec674ae34452a7bd6b09603e0037957666d872ac2decc7250de395c42144982018d497ed3a43b6cce90e14ea54ca5a32d
SSDEEP 12288:3wBhHmq7dq93QKqZwe/8/mkefIib/4Wuk3SHyp5/G7h/LxedUmxRZq:3YHI93Rq/us0WF3R/G7hLAf
TLSH
T155D4F11471C1C173E09A24321A1BD7A23C3A3D3A5B6A6DC772D4367C6E712C1AAF9367
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5972	2FA1.tmp

Executes dropped EXE 1 IoCs

pid	Process
5972	2FA1.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_c1b4c78bbb8ef04f7e55ac29b0041756_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2FA1.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5972	2FA1.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 5972	5016	2026-08-03_c1b4c78bbb8ef04f7e55ac29b0041756_amadey_elex_remcos_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-03_c1b4c78bbb8ef04f7e55ac29b0041756_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_c1b4c78bbb8ef04f7e55ac29b0041756_amadey_elex_remcos_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Users\Admin\AppData\Local\Temp\2FA1.tmp
  "C:\Users\Admin\AppData\Local\Temp\2FA1.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-03_c1b4c78bbb8ef04f7e55ac29b0041756_amadey_elex_remcos_rhadamanthys_smoke-loader.exe CA33D5E1192E9A38E30CC018203F9FFCB3DE7B85F75DEA3115AF799CA94997FA01C0E9287DB2DF7D257C2FDD013557D7AE69C45E71E2255CBFFE160C45FC0F72
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2FA1.tmp

Path C:\Users\Admin\AppData\Local\Temp\2FA1.tmp
Size 612KB
SHA256 206201fe00b6388e91bb98d75d6523b6447c2b9eff0e44a8c8b3c280925ae0d6
MD5 afba7fba0fcfe8b8fcbe37f6ec5556fd
SHA1 1d9ff27fe8d439997b18b4fc44048d1600f22ae5
SHA512 799df54001e2f64721d681844ba30cf718b297460b2512f5c2c5e5553ec95591ced820a0cb1b8717264d3fb3083902d74a64953186593c31026e9592518508b5
SSDEEP 12288:3wBhHmq7dq93QKqZwe/8w3JT3nn0yfzWf+m5yKZiEGUGbQ028Jq:3YHI93Rq/l3JT30yafVyI9IQ02
TLSH
T12BD4F0147181C133E09A24325B5BD7A63D363E361B2A5ECB72D436BC5E712C1A6F932B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads