9c48699624c2dfda7224fe31f8230e8b6c0dc6c4a0ab7d6785037ad072b24638

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 17:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_ef2755fac12fdf1d3988e78a3bb294fc_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Size 531KB
Sample260805-vntajacf68
SHA256 9c48699624c2dfda7224fe31f8230e8b6c0dc6c4a0ab7d6785037ad072b24638
MD5 ef2755fac12fdf1d3988e78a3bb294fc
SHA1 ca8f4f0f9c57a6fe426128e99c32d864d086b129
SHA512 c5d20ad10f4340fce686afe3eecbc3b93ee19b48d81bb51c22f2c118a27c0775444518c39c7d5afb990e579f48a4461b2eef2e17f4ad330e5f887daaf47571ea
SSDEEP 12288:KdcAIffrC9fdm7naHPKNde5okY0LPzEIN7fn5nPmR:KdpInm9fdmuudc/9LPznRn5PmR
TLSH
T1F4C4F05126D3C2B2D19604331A5BCBB26D3979304B299DC7B2D4B77CAE307C2A6B135B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2096	25CE.tmp

Executes dropped EXE 1 IoCs

pid	Process
2096	25CE.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	25CE.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_ef2755fac12fdf1d3988e78a3bb294fc_amadey_elex_remcos_rhadamanthys_smoke-loader.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2096	25CE.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 2096	5108	2026-08-05_ef2755fac12fdf1d3988e78a3bb294fc_amadey_elex_remcos_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-05_ef2755fac12fdf1d3988e78a3bb294fc_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_ef2755fac12fdf1d3988e78a3bb294fc_amadey_elex_remcos_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Users\Admin\AppData\Local\Temp\25CE.tmp
  "C:\Users\Admin\AppData\Local\Temp\25CE.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-05_ef2755fac12fdf1d3988e78a3bb294fc_amadey_elex_remcos_rhadamanthys_smoke-loader.exe 4A078F1C6DDF978F1A6CF2CBD424FA903DECB1C9C7EF073E439F9219342CC890ADE1C879ECBBF773B2A08ABC660AE0F4C7AFB8087317EC04AEC4641486CFC911
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

25CE.tmp

Path C:\Users\Admin\AppData\Local\Temp\25CE.tmp
Size 531KB
SHA256 1955b2a6bbcb0b9d0aff6f2ccdad1ff19c620cdbe898b757e3e6accc2c2ea150
MD5 eb050ec2b76e53fbecfc08355003bcff
SHA1 ac7c1eab83c7345c826a85de984f19cc99e38907
SHA512 9f814b86c1025f38876d20e86b4730540dfb7a8488973faa25729b868946f39c2793795cd8831d0c9af282fa749d08f8fae34f80fef0953590441a033014167d
SSDEEP 12288:KdcAIffrC9fdm7naPst6Pns3yVCb09dN7fn5nPmR:KdpInm9fdmuW6PnszidRn5PmR
TLSH
T1A0C4F05176C382B2D086143256ABCBB22D3A39354B196DCB76D0777D7E307C2AAB1327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads