5609a69323ca4e1d5d6f2cb018d63b2dc71a4a8def52c4a2d35ded0307fbe83c

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 18:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_3029ec5ff6ffe22b7fbdddde7dda92a4_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Size 612KB
Sample260803-w7z3vsdg96
SHA256 5609a69323ca4e1d5d6f2cb018d63b2dc71a4a8def52c4a2d35ded0307fbe83c
MD5 3029ec5ff6ffe22b7fbdddde7dda92a4
SHA1 d2044e7129cecf272f8207fe7490012ab1bd078b
SHA512 e84383295eda4f67a2e6a5e7b1ea5e3963a9c9367fe1f9209dca9321898b376aecd581d9dbab8806c1af0fe18553dadaa85edbf78abc310ab16a279f044fdfb0
SSDEEP 12288:3wBhHmq7dq93QKqZwe/8cwgapbspo3bZlsRwcpKQ8tfIuVg9HVmucq:3YHI93Rq/LXgZlsRr8tAui91
TLSH
T13BD4F05571C1D173D19710720A5AE7A63C3A3E350F2AA9C772D43A7D2E312C2A9F932B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
6036	1207.tmp

Executes dropped EXE 1 IoCs

pid	Process
6036	1207.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_3029ec5ff6ffe22b7fbdddde7dda92a4_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1207.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
6036	1207.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 6036	1312	2026-08-03_3029ec5ff6ffe22b7fbdddde7dda92a4_amadey_elex_remcos_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-03_3029ec5ff6ffe22b7fbdddde7dda92a4_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_3029ec5ff6ffe22b7fbdddde7dda92a4_amadey_elex_remcos_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Users\Admin\AppData\Local\Temp\1207.tmp
  "C:\Users\Admin\AppData\Local\Temp\1207.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-03_3029ec5ff6ffe22b7fbdddde7dda92a4_amadey_elex_remcos_rhadamanthys_smoke-loader.exe 28BA271DBF4E9404AE2EDEB7E03E77D8C0C489A35EEF1A597B6E544D705C71FBC5FFA0A55F77827BB002A82C829208D783CD504A1844991A2F9B81479B78A400
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:6036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1207.tmp

Path C:\Users\Admin\AppData\Local\Temp\1207.tmp
Size 612KB
SHA256 afffd46c276aefc32a9584dc55fcb050e0ebbdfe073f234fb468b2b4e3882375
MD5 de59b77ea04289cc6d26143f345217b1
SHA1 6cba794ae576547ba63d9b70141f0867153dd8c7
SHA512 f69c793e6e565b3baffb64fdf130d205e62edb7679a48587e686785c10899f6eacb6f77aacf0da3be7488aa2401ff08cd38e59d06e7b022c188e929ce07b16e0
SSDEEP 12288:3wBhHmq7dq93QKqZwe/84hh+u4U33NMuQimcn4pEhmmKVx1S5k8wAHj+Gxuq:3YHI93Rq/4+96cEgED1tAHj3
TLSH
T1C4D4F11561D0D173E09610325E1BE7A23C363D355B2A9DC772D83A7CAE722C1AAF9327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads