34f89249da18e62223bacd37b906190db75fbbcf2ea8db38986b2f6601877147

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 04:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_9cc2bf7b2842e182c56c351848fde42b_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Size 612KB
Sample260813-enhk2a1epf
SHA256 34f89249da18e62223bacd37b906190db75fbbcf2ea8db38986b2f6601877147
MD5 9cc2bf7b2842e182c56c351848fde42b
SHA1 cf7a5f209ce5968e349c0af781ba498e55ea2093
SHA512 84c0d074365460de5a51d00ef349956d66f8b18bd6b68c37094156a29153f84fc0c0d5a60c35280b1ff42e8d731d7d0aa25c0db1b80efbecccc6b2688a6cea57
SSDEEP 12288:3wBhHmq7dq93QKqZwe/8HbT5XDEqTk1gpolNEsMaAZXHZ59tq:3YHI93Rq/cNTTkq0MnZJH
TLSH
T1B0D4F02571D0C073E19A04321E6AD7623C363D355B2A5CCB72D8367D6E353C2AAF936A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5164	6538.tmp

Executes dropped EXE 1 IoCs

pid	Process
5164	6538.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_9cc2bf7b2842e182c56c351848fde42b_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6538.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5164	6538.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 5164	3032	2026-08-13_9cc2bf7b2842e182c56c351848fde42b_amadey_elex_remcos_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-13_9cc2bf7b2842e182c56c351848fde42b_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_9cc2bf7b2842e182c56c351848fde42b_amadey_elex_remcos_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Users\Admin\AppData\Local\Temp\6538.tmp
  "C:\Users\Admin\AppData\Local\Temp\6538.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-13_9cc2bf7b2842e182c56c351848fde42b_amadey_elex_remcos_rhadamanthys_smoke-loader.exe AFFD86F6389023F1BD0C35F097DDCD1FEC0E5E2EFF6169A2DED12FA2ACEFC35FAEF52E00EBC6260F780952F41E9264BEC375AE6EB04C723173190F721B044905
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6538.tmp

Path C:\Users\Admin\AppData\Local\Temp\6538.tmp
Size 612KB
SHA256 164634cd0464e38850f668ddbf1495f0707f2728622d086992085af1c07784f5
MD5 80c7900b98f9cf6c6122a7fbd008da70
SHA1 482b3529496415bea24cd98f5a3b816b19a8842a
SHA512 20ae90d43791ef5a2e3b507df706d224b188d01d06d0754956896d8deaf009d84ce150f28ea49d3ede86f113c2e2fdcc1c8405fd05f936981108f782fa784be3
SSDEEP 12288:3wBhHmq7dq93QKqZwe/8Hv41OzLC55g4YL/qMLIBaOUt8/aq:3YHI93Rq/oUqq5e/qpBaV8
TLSH
T178D4F155B1C1C173E09610325A1BD7A63C3A3E315B2B99C772D4367DAE312C1AAFA327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads