6ad9ebccf4319f5d3a1fb889e599fca1157810bde1de4cd870ea61bf73c6031d

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 19:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_755480f3df2362ccdb8c6b7e08072a4b_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Size 532KB
Sample260804-yfc55acr8v
SHA256 6ad9ebccf4319f5d3a1fb889e599fca1157810bde1de4cd870ea61bf73c6031d
MD5 755480f3df2362ccdb8c6b7e08072a4b
SHA1 dcdb0ff3c90701eea7cd3cefc9035353c2a3e4c2
SHA512 19caf76385ab1b86767c27c067ab779d4bd6a0da095480de6386e22723609811e3d0b701de076a6b654d0d84adabb948c6deab49ce7e4bc19ee79f93e47fcfc0
SSDEEP 12288:KdcAIffrC9fdm7naH/90qj8wu443mnwzY/1rYN7fn5nPm:KdpInm9fdmuf9jj8Xj3mnwcNYRn5Pm
TLSH
T157C4E01172D3D1B2D09214331A9ACBB22D7A39345B196EC7B2D4377D6E30BC2A6B5327
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3152	678A.tmp

Executes dropped EXE 1 IoCs

pid	Process
3152	678A.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_755480f3df2362ccdb8c6b7e08072a4b_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	678A.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3152	678A.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5616 wrote to memory of 3152	5616	2026-08-04_755480f3df2362ccdb8c6b7e08072a4b_amadey_elex_remcos_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-04_755480f3df2362ccdb8c6b7e08072a4b_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_755480f3df2362ccdb8c6b7e08072a4b_amadey_elex_remcos_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5616
- C:\Users\Admin\AppData\Local\Temp\678A.tmp
  "C:\Users\Admin\AppData\Local\Temp\678A.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-04_755480f3df2362ccdb8c6b7e08072a4b_amadey_elex_remcos_rhadamanthys_smoke-loader.exe B8A9A8D8C8A6D4BF579B554BF1CB92EC5174E92EF05E2F9D506DEA3234DC770DEE9AAAA16AA26855929A7EA19D72E2E4A649073470910ECA004F2909837E3E14
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

678A.tmp

Path C:\Users\Admin\AppData\Local\Temp\678A.tmp
Size 532KB
SHA256 2bcfa60e97a090dc5c8c205386cd6fd3d8e2128711974cf674af7143ffa647c0
MD5 76e9fdc07a943939d69754f5e3bdc18a
SHA1 ef4705a83349696e7233df7b3b2869223d9dd8d2
SHA512 f87e74e3fe42255bcbde51adab337add122a1a262fb770048277cdbca909e97e413d174067edcf0abd81396daefb03c72f6db9187a6d2d2d8641f6c3dbfde748
SSDEEP 12288:KdcAIffrC9fdm7na3qDqq/urJIsUN7fn5nPm:KdpInm9fdmuMqqW9IsURn5Pm
TLSH
T180C4F15132C2C1B2D09600321AABCBB22D3A39355B295EC776D0777DBE317C2A6B535B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads