a7d934530cc3f89ac3a897c6911ebcab65c2f1f12afb7e7e1b922a866653885a

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 23:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_2fd1bc894f07d6681d7dc7d64310f34c_amadey_elex_remcos_smoke-loader_vidar.exe
Size 10.8MB
Sample260804-269hsssgka
SHA256 a7d934530cc3f89ac3a897c6911ebcab65c2f1f12afb7e7e1b922a866653885a
MD5 2fd1bc894f07d6681d7dc7d64310f34c
SHA1 49a3d490f428f08f7f793e3dc195afece6c9387e
SHA512 2d2b65e55c0cf58dd99bb3af91fc0bc8bc357c611c9acb39670660966fa2a36e75a6eb859430c3de7e9b6bc7b7a01f4d660c96191c7a62d6f3797fa7c608f9d5
SSDEEP 24576:jjMa+f+Ym8zA9biKyRq9WmddjQW7m+ll3z0VdwmTRj9n5f:jjGm8obnyMWmddjZ7xlo5f
TLSH
T1BBB6D5197298C064D46A4334A9A4D19199B2BC605B2196FFED74B72DDF3F9F08A3CB30
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1492-0-0x0000000000400000-0x0000000000450000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1496	1492	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_2fd1bc894f07d6681d7dc7d64310f34c_amadey_elex_remcos_smoke-loader_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-04_2fd1bc894f07d6681d7dc7d64310f34c_amadey_elex_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_2fd1bc894f07d6681d7dc7d64310f34c_amadey_elex_remcos_smoke-loader_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1492
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 256
  2⤵
  - Program crash
  PID:1496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1492 -ip 1492
1⤵
PID:4796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1492-0-0x0000000000400000-0x0000000000450000-memory.dmp

Download