0e0285a27fa6020c559aff3cd43ae35a42b2b20d9449c636645e8f0029c50419

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 23:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_333257f532c36f953a42a6871b638e93_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Size 531KB
Sample260806-3a76jack6y
SHA256 0e0285a27fa6020c559aff3cd43ae35a42b2b20d9449c636645e8f0029c50419
MD5 333257f532c36f953a42a6871b638e93
SHA1 1bed140de2ab90eec88535db2c599bd81ecddae1
SHA512 b280035973bdcbf00e2fd62065531d0008de58914c4a333379a26d0c792a497f0ba7df9796d3bb7dfb2a6cebc5b15f51885d52d524780a6f390c3df7145641d7
SSDEEP 12288:cdcAIffrC9fdm7naIT8q27PhBRX9TmzN7fn5nPmR:cdpInm9fdmuU8Jj9T+Rn5PmR
TLSH
T149C4F06076C3C2B2D08604331AABCBA2287A79315B196EC776D4777C7D31BC1A6B2317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
352	57AB.tmp

Executes dropped EXE 1 IoCs

pid	Process
352	57AB.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_333257f532c36f953a42a6871b638e93_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	57AB.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
352	57AB.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 352	1780	2026-08-06_333257f532c36f953a42a6871b638e93_amadey_elex_remcos_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-06_333257f532c36f953a42a6871b638e93_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_333257f532c36f953a42a6871b638e93_amadey_elex_remcos_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Users\Admin\AppData\Local\Temp\57AB.tmp
  "C:\Users\Admin\AppData\Local\Temp\57AB.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-06_333257f532c36f953a42a6871b638e93_amadey_elex_remcos_rhadamanthys_smoke-loader.exe FF92A91FD75C4795AD1B6A917BC9450DFAE3035276206F7A518057A3E7656A42855B360EE086AE13248F0240B52DE55AA0D4C2A9ED924F0BFCC18020CD787C63
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

57AB.tmp

Path C:\Users\Admin\AppData\Local\Temp\57AB.tmp
Size 531KB
SHA256 e5d2a60468790ae88874f91d578656c67c10026281be39191d61128107323e17
MD5 9893008dcf2a3661769083c02bebb708
SHA1 6b681f53a8a6e9fb2109eba0b0ae374d8c840f07
SHA512 8b9720299d6f065b7f5717504bbfc8ceeee929f7cb0c30a268d9259b91cd91451a71c8d193f3c0946231352decbd1660e1dfca80b8da1859874c40eb7279343d
SSDEEP 12288:cdcAIffrC9fdm7naAiZbItHzHp+7ifyNyTN7fn5nPmR:cdpInm9fdmul8HzJ6TQTRn5PmR
TLSH
T110C4F15165D3C1B2D08714331AABCBA22C3A39314B296EC772D0777EBE706C2A6B5357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads