783597d35284c374ec005044c112258135bd395a33671e8735a098195be1ef37

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 05:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_a5aefb30c38fb09606f0583212ede582_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Size 531KB
Sample260811-freh8awfmb
SHA256 783597d35284c374ec005044c112258135bd395a33671e8735a098195be1ef37
MD5 a5aefb30c38fb09606f0583212ede582
SHA1 a9ebf1d5dcbff1260e26db1449b157b0f8ec91fa
SHA512 2007f8b95994f1b918ec6a503b7679e446170b3fee7b1c23bbedc393a474b290f944176afca2b85c1fc63901635de9f3e71a729a0810ed0567c51205ba57830c
SSDEEP 12288:cdcAIffrC9fdm7na5pzbG57GJ20me2TkN7fn5nPmR:cdpInm9fdmu5pzbG542c2TkRn5PmR
TLSH
T140C4F05076D3D172C08615321B5BC7B22D3A79304B29ADCB76D07BBCBD30AC2A6B535A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1276	49F0.tmp

Executes dropped EXE 1 IoCs

pid	Process
1276	49F0.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_a5aefb30c38fb09606f0583212ede582_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	49F0.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1276	49F0.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 1276	4636	2026-08-11_a5aefb30c38fb09606f0583212ede582_amadey_elex_remcos_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-11_a5aefb30c38fb09606f0583212ede582_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_a5aefb30c38fb09606f0583212ede582_amadey_elex_remcos_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Users\Admin\AppData\Local\Temp\49F0.tmp
  "C:\Users\Admin\AppData\Local\Temp\49F0.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-11_a5aefb30c38fb09606f0583212ede582_amadey_elex_remcos_rhadamanthys_smoke-loader.exe 5A54CA6CD5F89187E18844FA7FE73E423639065DCC17C37D6DA36523FAB2370F957A2D46C7E27E194396D073E4F05E96295D7ED9E19BB93CF104192E656AF7D8
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

49F0.tmp

Path C:\Users\Admin\AppData\Local\Temp\49F0.tmp
Size 531KB
SHA256 58d15b6d770b9b688004f648007d546e98e00ae0e6013e41b7b2d2130df930f1
MD5 b4d1157026c5ecc228b710256e252342
SHA1 640f2c9e52f40faf5b28ab2159046b01a96a775a
SHA512 c408692076fd8de7a061830f1c4986eed25f284ed39361f639b03be5993f5d698f342fe0424961d8ddd1b37dfbd0cf1e29fc08806069409923eaaa98cf0d78b9
SSDEEP 12288:cdcAIffrC9fdm7naSLK3REij9vUc8PUbMfsN7fn5nPmR:cdpInm9fdmuS+3iijydUbssRn5PmR
TLSH
T1E2C4F16276D3D1B2D18614321B9ACBB22C3A39351B299DC772D0377D7D306C2A6B235B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads