94fe4193a8cec5605917f07d9bd1ce19829fb208788a025b7a307d821910fa21

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 23:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_c6d3e0936372ff282657d818e09dc331_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Size 673KB
Sample260820-3c619ack2y
SHA256 94fe4193a8cec5605917f07d9bd1ce19829fb208788a025b7a307d821910fa21
MD5 c6d3e0936372ff282657d818e09dc331
SHA1 0355d9b1c5d40aeed58d665cda25dc595dc627fb
SHA512 06f8521db63a0eb93b0b4e294154f2b380f3024862297b28aa197c1a2cd170ec3f67c3d200576751f1faf76e5904710aead682bb57934b84306350f1df19f3cb
SSDEEP 12288:hfNzTW2Qz9H4vROWO8SnUvAquu2q3EiYHkwwDSAifrj1fksLDVh/ON7fn5nPmI:hfhw9H4vROWO8Snj73KE7HkuAO6sfV43
TLSH
T1FCE401617585C172E18708324A5BD7712C367E322B366EC732E02ABDBD712C1B6B139B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1908	D2CC.tmp

Executes dropped EXE 1 IoCs

pid	Process
1908	D2CC.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_c6d3e0936372ff282657d818e09dc331_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D2CC.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1908	D2CC.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 1908	4816	2026-08-20_c6d3e0936372ff282657d818e09dc331_amadey_elex_remcos_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-20_c6d3e0936372ff282657d818e09dc331_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_c6d3e0936372ff282657d818e09dc331_amadey_elex_remcos_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Users\Admin\AppData\Local\Temp\D2CC.tmp
  "C:\Users\Admin\AppData\Local\Temp\D2CC.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-20_c6d3e0936372ff282657d818e09dc331_amadey_elex_remcos_rhadamanthys_smoke-loader.exe A7FD4CD627567DDDD4AFC6B7A08C6039DB96414E8E8FDA0F346EE30A7BBBD3F76E658F22667B9D5CFC9DB9F681EE944AD4A11B3A3ACC28FBD296277277DE0F0B
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

D2CC.tmp

Path C:\Users\Admin\AppData\Local\Temp\D2CC.tmp
Size 673KB
SHA256 654907682fedb5e807865159da6e6df5632aba0e9fe9815c3ca21e8c1b52ff7b
MD5 ff8c5d0fd4505402c53ac57715edb935
SHA1 9e59df08e989dc5e32af064d710a879acb79ec6b
SHA512 0f21b145abe9e7e03c6828d2aff80cdc0b287344b7ee8358c8a1ab760eee524a533c5d6bde95753c2bc7b31d31917f0eb871be4520c9cb3dbf4e482874bae45a
SSDEEP 12288:hfNzTW2Qz9H4vROWO8SnUvAq8QcO1N7/BAheTdKz0e9z2301QQ8yOhN7fn5nPmI:hfhw9H4vROWO8SnjaNieTdeR9z2E1Q1V
TLSH
T1ABE4016271D6D1B3E18204324A67D7611C7A3A311F296EC772D03ABCBD716C27AB2397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads