0e4dd55b895b3d657dcda6e35b04717d8a49873ef16541b75bc2a3e11aef4e97

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 09:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-24_7b1741940949c52226d285dec98d5360_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Size 531KB
Sample260825-lsajjsgn8s
SHA256 0e4dd55b895b3d657dcda6e35b04717d8a49873ef16541b75bc2a3e11aef4e97
MD5 7b1741940949c52226d285dec98d5360
SHA1 9f0867167e6163fdaf476592bf9039539b7d3ccd
SHA512 0a6c3971c6ce5d21871571979bf756e8c639c4c1722d2517397bd73195b008e58c0e65ee9f40d677330b6dca3b7657e711b4159e999a66633f845cddb8324621
SSDEEP 12288:KdcAIffrC9fdm7naudxIvs23YZMx5zlN7fn5nPmR:KdpInm9fdmuuDBAVx5zlRn5PmR
TLSH
T13AC4F15121C3C1B2D19614332AABCBB62C3A78355B29ADC776D43B7DBE306C262B5317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5752	BF01.tmp

Executes dropped EXE 1 IoCs

pid	Process
5752	BF01.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-24_7b1741940949c52226d285dec98d5360_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BF01.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5752	BF01.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5864 wrote to memory of 5752	5864	2026-08-24_7b1741940949c52226d285dec98d5360_amadey_elex_remcos_rhadamanthys_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-24_7b1741940949c52226d285dec98d5360_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_7b1741940949c52226d285dec98d5360_amadey_elex_remcos_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5864
- C:\Users\Admin\AppData\Local\Temp\BF01.tmp
  "C:\Users\Admin\AppData\Local\Temp\BF01.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-24_7b1741940949c52226d285dec98d5360_amadey_elex_remcos_rhadamanthys_smoke-loader.exe 65EE864568189AE6D82D4A8236D4C472A263B896726C1ED613C26F918E1D1B98D3D43E42A0381FB6423F29E4A5FA02D851986BEAAB8690252448AA16315BF528
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BF01.tmp

Path C:\Users\Admin\AppData\Local\Temp\BF01.tmp
Size 531KB
SHA256 76e215e92c75e270a64631ae40fdcde94a5abb1e6bd8b279d7e7bd7380b0a39e
MD5 004913a4c332ee55e96816c140c75961
SHA1 0a4fe16b0a2bb3a03e9026aadb4d833a3935ab19
SHA512 bb8bdbde81b2be39e59624eb0f80a79034731571bb539cb73e8367a6acd2d9f3d2032416ed2080d972caf5b63d0299096650448537bd7939b4970aee48d9886d
SSDEEP 12288:KdcAIffrC9fdm7na7dgLlRgV2z7M5wnN7fn5nPmR:KdpInm9fdmu7ivz7M5eRn5PmR
TLSH
T1F8C4F15162C3D1B2D18704321A9ACBB22D3A3D314B196EC776D0377DAE317C2A6B536B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads