35198a5ec78b6b56830e903f57b6c3d858f5c7f9e4c3d06aa0e37b25b39ba2b8

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 19:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_983da2b71ad04b4694dad742cebce5d7_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Size 532KB
Sample260804-xvcbpswtay
SHA256 35198a5ec78b6b56830e903f57b6c3d858f5c7f9e4c3d06aa0e37b25b39ba2b8
MD5 983da2b71ad04b4694dad742cebce5d7
SHA1 e3c6173bf072194aedb485f41f23a72560cd4e1d
SHA512 810ebd02e90bd6e786df0489a8a397c63fdc5a481454ad0098524152fdd558d9ca6e0a0caf332257292c45d13bf870b2c3d549e169a851f1f21e53564a93348c
SSDEEP 12288:KdcAIffrC9fdm7naqKst5HYW9plDjZuJ1UK1quN7fn5nPm:KdpInm9fdmuqK4LlcAiRn5Pm
TLSH
T1E8C4F04166C3C2B2D08210331AABCBB6697A39314B196DC776D0777DAE306C2B6B5367
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4444	5FFD.tmp

Executes dropped EXE 1 IoCs

pid	Process
4444	5FFD.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_983da2b71ad04b4694dad742cebce5d7_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5FFD.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4444	5FFD.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3784 wrote to memory of 4444	3784	2026-08-04_983da2b71ad04b4694dad742cebce5d7_amadey_elex_remcos_rhadamanthys_smoke-loader.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-08-04_983da2b71ad04b4694dad742cebce5d7_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_983da2b71ad04b4694dad742cebce5d7_amadey_elex_remcos_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3784
- C:\Users\Admin\AppData\Local\Temp\5FFD.tmp
  "C:\Users\Admin\AppData\Local\Temp\5FFD.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-04_983da2b71ad04b4694dad742cebce5d7_amadey_elex_remcos_rhadamanthys_smoke-loader.exe 44F142E08B2F23583DF5566716F523385DD47295C0506EF9A6D39E15E9F8A65410EB7E3ABE4EF2CA78369C39A9E04CBE24DE9D4308522B6A7A1CCF26D4DB7475
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5FFD.tmp

Path C:\Users\Admin\AppData\Local\Temp\5FFD.tmp
Size 532KB
SHA256 71bb110aa610747df4870f839db7372e5bdf547ba05c95119d2b6089e6f4d757
MD5 7e47f63c3a4dcd7f3fd8992dd90875e0
SHA1 ed44495d469e144afe60a1344c653ae1de89d8d1
SHA512 059324a75bc5d643c51aa8d5318720580eea6365793451f126b6e7e8e3f8abe943f748f33316837375c726ec4d842b811cc980bd5fc482925ad1aeaa2e5635b2
SSDEEP 12288:KdcAIffrC9fdm7naUVi1T1SricdujuL6GN7fn5nPm:KdpInm9fdmupTzPbGRn5Pm
TLSH
T16FC4F05172C2C1B2D19605331AAACBB22C3A39350B295EC776D077BDBD316C2B6B2357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads