5a47afb0bb10a037cde7b5edd5088306d8fb2e84eb1b864c63d436cdf78f6907

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 23:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_2b1c1d79ccc9c41f755593815deca543_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Size 612KB
Sample260819-247lesbl41
SHA256 5a47afb0bb10a037cde7b5edd5088306d8fb2e84eb1b864c63d436cdf78f6907
MD5 2b1c1d79ccc9c41f755593815deca543
SHA1 2c3064b2daf85fa27f5d3a4b7b419680c68957ea
SHA512 ea29328021145a93fa599a45519d7fb1d129ae922604dd823993139e4e0c5a9c323e4a822b9fe4c98a95b6f5dd847b283451ab00d496858d56165a67e1a9074d
SSDEEP 12288:3wBhHmq7dq93QKqZwe/8mlHmcGkYIqL27mqtSDalTAmIs6+q:3YHI93Rq/DllGv1qVtSD2T1r
TLSH
T131D4F15671C1C173E05610325A1BE7A22D363D365B2A9DCB72D4367C2E712C2AAF933B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3224	9FC1.tmp

Executes dropped EXE 1 IoCs

pid	Process
3224	9FC1.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_2b1c1d79ccc9c41f755593815deca543_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9FC1.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3224	9FC1.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 3224	1152	2026-08-19_2b1c1d79ccc9c41f755593815deca543_amadey_elex_remcos_rhadamanthys_smoke-loader.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-19_2b1c1d79ccc9c41f755593815deca543_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_2b1c1d79ccc9c41f755593815deca543_amadey_elex_remcos_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Users\Admin\AppData\Local\Temp\9FC1.tmp
  "C:\Users\Admin\AppData\Local\Temp\9FC1.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-19_2b1c1d79ccc9c41f755593815deca543_amadey_elex_remcos_rhadamanthys_smoke-loader.exe 452AC0227D58E6B8E679A7492A3973CA6056838E747301ADF2A04DE6F41A727497BFE8CC8A505380E1589C215EDB438F59C1267FBEAFF0E9E71338782A11C83E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9FC1.tmp

Path C:\Users\Admin\AppData\Local\Temp\9FC1.tmp
Size 612KB
SHA256 75a81dffcc7011d04cd0940ae99fc0bf46b70cb3ae6926700e21b35eb41134b1
MD5 900586f41e5806815c9abf2940ecc3b5
SHA1 d27db60bfab53c734a6b0a679d57f35dd59abce7
SHA512 7a0b419525d078e3fd0b176d2111b8c778b658f37e6e9ad1012d8a5837277f9482913577a70f52ac159e065c68a859bb3773180d568def623dfd41702f4da845
SSDEEP 12288:3wBhHmq7dq93QKqZwe/8lU40pijYt94dD71wPS7q:3YHI93Rq/6zMuYTI1wa
TLSH
T19AD4F024A1918173E09714325E5BD3B22D3A3E351B266DC772D4377D6E312C2AAF532B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads