385e70b63d7684943e11aeb3471ddbbcba31f0cb52203a857d77ecfe20d9f61a

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_25c85c287106a3e10eca0722c200e045_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Size 531KB
Sample260803-xa61ksythx
SHA256 385e70b63d7684943e11aeb3471ddbbcba31f0cb52203a857d77ecfe20d9f61a
MD5 25c85c287106a3e10eca0722c200e045
SHA1 8840e9edac9dea89d018ee16939474f601ec3119
SHA512 669a2a463640b34fc25268950ef79e320c28c09266349e24248ffb26414cd343af7e78e0a2e3b42db8eb5621218a073165cb7d5b939387b2b2bb5c94ff8509c3
SSDEEP 12288:KdcAIffrC9fdm7naCwa7hRVQqcEth9G5aRiN7fn5nPmR:KdpInm9fdmuCwa9Qqx9GRRn5PmR
TLSH
T12DC4F06176C3C2B2D09614331A6ACBB2283A38355B296EC7B2D4377D7D317C2A6B1357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4620	931E.tmp

Executes dropped EXE 1 IoCs

pid	Process
4620	931E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	931E.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_25c85c287106a3e10eca0722c200e045_amadey_elex_remcos_rhadamanthys_smoke-loader.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4620	931E.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5180 wrote to memory of 4620	5180	2026-08-03_25c85c287106a3e10eca0722c200e045_amadey_elex_remcos_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-03_25c85c287106a3e10eca0722c200e045_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_25c85c287106a3e10eca0722c200e045_amadey_elex_remcos_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5180
- C:\Users\Admin\AppData\Local\Temp\931E.tmp
  "C:\Users\Admin\AppData\Local\Temp\931E.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-03_25c85c287106a3e10eca0722c200e045_amadey_elex_remcos_rhadamanthys_smoke-loader.exe 8DFD17EED9E5449945E57E07CAB84C12A181E31C71F8CC7F2C8A851AE0ECE977AC5D93D99573D89FD6EACD6D0F75853BC83CA11020EB79104687D4B9FF809D9A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

931E.tmp

Path C:\Users\Admin\AppData\Local\Temp\931E.tmp
Size 531KB
SHA256 883a02a03155f15c5c66ccc2b0a74185ead950d2e4108c09a656b74bf4a91609
MD5 68755e151c0670d07b76a88a13660910
SHA1 bfa4879eefd7abc677d2c30308b09b38c9244ca2
SHA512 9fd12fb54b36f4ecd334eda16bd8591790f38345600ac2f4cf45fdab684a7da791f43a9ec977e4eadcd0f9415e5c4778f0ead2d74b1fd039e6e4f15ad78cbdb1
SSDEEP 12288:KdcAIffrC9fdm7nav7w53kKDc1tJSxWN7fn5nPmR:KdpInm9fdmujwiBSgRn5PmR
TLSH
T1C7C4F06172C3C1B2D09614322BABCBA62C393D314B2A6DC776D0777DBD316C2A6B5316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads