bf4efb51bb9e50956d3ddb16b8b2728ef2c947b87d3123f5d63286bb02d846a0

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 15:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_2c12fe7847d524b7432a1f564358196f_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Size 531KB
Sample260820-s87mjsec78
SHA256 bf4efb51bb9e50956d3ddb16b8b2728ef2c947b87d3123f5d63286bb02d846a0
MD5 2c12fe7847d524b7432a1f564358196f
SHA1 da988d6618364dbcb6abed1ff1cf20be35c4658e
SHA512 23b66e0cd5aa948140d8673454031641de7a6af7ee76de94da0d202e2fb3fb973dba38cff33e089d80ffa5f1d5dab6cf50731591527506760f6cbc966edbe899
SSDEEP 12288:cdcAIffrC9fdm7nacOtXFyq/C7q49CN7fn5nPmR:cdpInm9fdmuPryfW4IRn5PmR
TLSH
T15FC4F161B6D2C272D08A1433176ACBB22C3A39344B196EC772D4737DAE316C2B6B5357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4512	961C.tmp

Executes dropped EXE 1 IoCs

pid	Process
4512	961C.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_2c12fe7847d524b7432a1f564358196f_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	961C.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4512	961C.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3336 wrote to memory of 4512	3336	2026-08-20_2c12fe7847d524b7432a1f564358196f_amadey_elex_remcos_rhadamanthys_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-20_2c12fe7847d524b7432a1f564358196f_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_2c12fe7847d524b7432a1f564358196f_amadey_elex_remcos_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3336
- C:\Users\Admin\AppData\Local\Temp\961C.tmp
  "C:\Users\Admin\AppData\Local\Temp\961C.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-20_2c12fe7847d524b7432a1f564358196f_amadey_elex_remcos_rhadamanthys_smoke-loader.exe 8273CCC6E3CD854BC88816174CC535A41691CB4FBBC4BCAD2FBCEAA24F9F2E9503E7BE4BBFB4DC1C1993D13A7F5FF5D3857E341D3868A85CCE4C4BF3C3837CE4
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

961C.tmp

Path C:\Users\Admin\AppData\Local\Temp\961C.tmp
Size 531KB
SHA256 f7eec55e86a73b68ec74fb679351cdc275e112b28140be85d960fe85f0de162e
MD5 ea00a5c7280816d61a9a972f67c7852f
SHA1 3b98c751c82c81c5306abfa1278a5b4a1b574e26
SHA512 597e6875ed1bde7e686353f08dbd8aebeec123709da756ffa715ca438d932d4e965fbcad28ebba9ef31b02e3bc92ccb6f9971e9390a9c21c8c0915ffad0c8dce
SSDEEP 12288:cdcAIffrC9fdm7nazOIprwVwLN+N7fn5nPmR:cdpInm9fdmuPpkY+Rn5PmR
TLSH
T126C4F06171C2C2B2D08614331A9BCBB22C7A39359B299DC776D473BCBD316C266B5327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads