4043a5385251ef0fb0ca6cac95d7ad651ecad4bb104ef4850754bd8d81b00aa3

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 16:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_0958ae7683afd6c6ec0cf0e1144b4871_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Size 664KB
Sample260805-tx2gts1crf
SHA256 4043a5385251ef0fb0ca6cac95d7ad651ecad4bb104ef4850754bd8d81b00aa3
MD5 0958ae7683afd6c6ec0cf0e1144b4871
SHA1 bcc42b302118da10878a095906250e8ff8583899
SHA512 070534435a998d99083ba1b87c6859813de9975f6be38c1b64e26b8344fe9df86bcb0fe036d32b6264f0cdc1dfa10ccf39eae4579c2210cb25e106a7a597419a
SSDEEP 12288:2Jkqpbzc1wJy9NmQyss8oeaHCH8eaUqGfJbo83pwtrvwWy5qqhq:2V1gwJyLmeMveaSB083pqrfa
TLSH
T114E4F05571C1C172D09A04324F5BE7A66C363E3A5B6699CB32C4773CAE312C16AF632B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
6932	B05B.tmp

Executes dropped EXE 1 IoCs

pid	Process
6932	B05B.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_0958ae7683afd6c6ec0cf0e1144b4871_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B05B.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
6932	B05B.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 984 wrote to memory of 6932	984	2026-08-05_0958ae7683afd6c6ec0cf0e1144b4871_amadey_elex_remcos_rhadamanthys_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-05_0958ae7683afd6c6ec0cf0e1144b4871_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_0958ae7683afd6c6ec0cf0e1144b4871_amadey_elex_remcos_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:984
- C:\Users\Admin\AppData\Local\Temp\B05B.tmp
  "C:\Users\Admin\AppData\Local\Temp\B05B.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-05_0958ae7683afd6c6ec0cf0e1144b4871_amadey_elex_remcos_rhadamanthys_smoke-loader.exe 66F22BCEF9C12FC8F10328F278BB42EA294F5899ED56181BB5192DD4E220E854860284ACFF69D454E900BD44DC70321ADF4F367339A79147F7D5795B5E4D752A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:6932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

B05B.tmp

Path C:\Users\Admin\AppData\Local\Temp\B05B.tmp
Size 664KB
SHA256 2c99e68725404ed421e9cde680ce49f653f76fe05287eaead63fcf049c23df43
MD5 8a068c41fbb634164a51ffc9bbd522d4
SHA1 3ab7e1c060188e8c807a1a18b7d49908d561f3bd
SHA512 f006370e9202315d7ec9269b5bc91fc15e3161870ea95bee9edead3319b2de431054c52140a418ef8bb93c68ccd6711c9308dc3b195d0cdc6d44d1335834922a
SSDEEP 12288:2Jkqpbzc1wJy9NmQyss89S0bZ0EMDaUDq6izxbr8m2iiztv9dbsqhq:2V1gwJyLmek0VtMDxO6iFH8Kizh9db
TLSH
T1C7E4E05171C28173D09A00324E4BD7A26C367D355B66AECB32D4367DAE712C1AAF633B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads