5ded9d1e7cd3c329268cf557386e443ea9550f4620ff2163e95879aa4963e3b6

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 02:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_75fe902557b102efcee59da8348df36b_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Size 531KB
Sample260811-dgkldathlf
SHA256 5ded9d1e7cd3c329268cf557386e443ea9550f4620ff2163e95879aa4963e3b6
MD5 75fe902557b102efcee59da8348df36b
SHA1 892342de262bd33b5b6af0c27cd0960d8cef1b9e
SHA512 127ebf0cfe2ce4f165fe0fc5171899b2e8011d52e9b15a412870a5e3fbddfe4d13d5760158e12ffde1d47f91acf74dcf5f7004db4dd0a5b0d519cb215fbf43b9
SSDEEP 12288:cdcAIffrC9fdm7na0scqMTcuIRFKqN7fn5nPmR:cdpInm9fdmufj9FKqRn5PmR
TLSH
T16DC4F15166C3D272D08A14331AABCBB22C7A39315B185DC776D0BB7D6D31BC2A6B131B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5908	50A7.tmp

Executes dropped EXE 1 IoCs

pid	Process
5908	50A7.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_75fe902557b102efcee59da8348df36b_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	50A7.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5908	50A7.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3820 wrote to memory of 5908	3820	2026-08-11_75fe902557b102efcee59da8348df36b_amadey_elex_remcos_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-11_75fe902557b102efcee59da8348df36b_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_75fe902557b102efcee59da8348df36b_amadey_elex_remcos_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3820
- C:\Users\Admin\AppData\Local\Temp\50A7.tmp
  "C:\Users\Admin\AppData\Local\Temp\50A7.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-11_75fe902557b102efcee59da8348df36b_amadey_elex_remcos_rhadamanthys_smoke-loader.exe F34FC18A9EC388A37565F68975015C3E6C448AF483B43F0D9F47309AE706EE54601C93B8CEB1D965178996D7F6A1BB985005E2DFB70CE4B3A5C6BD4C35FC4446
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

50A7.tmp

Path C:\Users\Admin\AppData\Local\Temp\50A7.tmp
Size 531KB
SHA256 e4a43d20d21411a827a0c5c7b3e71fa67e76081d77b83f2dca6f77e4585ed716
MD5 c216bad2fea043855c4a428b85db654a
SHA1 60d7f958a195fb2338f45eb43d579048ac51209d
SHA512 df3fa870e386da13053f9d7a239fef9ba10245a5cac9fd38dacd6518a087a0e02d94b89dbdc1552fc620b8eba91b2caebc072dd386ad881e5f82054739b5534a
SSDEEP 12288:cdcAIffrC9fdm7naWWeixVyBySZpJaN7fn5nPmR:cdpInm9fdmuWRiTdiaRn5PmR
TLSH
T1EFC4F15172C3D1B2E18614331AABCBA22C3A78355B196DC7B2D0777DBD316C2A6B131B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads