90c31ad06069285932f23bf5ae94dae53c04ac21a2819c12877dba1f557175c8

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/10/2026, 21:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-15_fd736f00f5d3ecdd6c71c2d300a50155_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Size 531KB
Sample261015-1jd8psed62
SHA256 90c31ad06069285932f23bf5ae94dae53c04ac21a2819c12877dba1f557175c8
MD5 fd736f00f5d3ecdd6c71c2d300a50155
SHA1 f82df68b9c5b740b21bebcaeed20644dbcf3b2f3
SHA512 fb8af3b2c4bddc7dc69b734fc78dab811d17679a19738b043396d2b42120c9aa54a9f8151756bffa54b8a07f3c0290d1c2a15eb29a1f7e982ca60d54546d9b42
SSDEEP 12288:KdcAIffrC9fdm7naoKB0NgdNSHAA+QL5Q9AN7fn5nPmR:KdpInm9fdmu3GNg6HAA+w5IARn5PmR
TLSH
T137C4F15162C3C172D0921433169BCBA22C3A3A314B2A5DC772E47B7DBD316C2B6B635B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
5408	15D0.tmp

Executes dropped EXE 1 IoCs

pid	Process
5408	15D0.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-15_fd736f00f5d3ecdd6c71c2d300a50155_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	15D0.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5408	15D0.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3712 wrote to memory of 5408	3712	2026-10-15_fd736f00f5d3ecdd6c71c2d300a50155_amadey_elex_remcos_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-10-15_fd736f00f5d3ecdd6c71c2d300a50155_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-15_fd736f00f5d3ecdd6c71c2d300a50155_amadey_elex_remcos_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3712
- C:\Users\Admin\AppData\Local\Temp\15D0.tmp
  "C:\Users\Admin\AppData\Local\Temp\15D0.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-10-15_fd736f00f5d3ecdd6c71c2d300a50155_amadey_elex_remcos_rhadamanthys_smoke-loader.exe 06D2D5AF4D628CE2E94B444A98F486B30BC2FCDF6C223601F6BE3CAA84E57A378068E374DEF35200D192B1D4FF1CF69173C96C2B41095070364C26FC2B703DF2
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

15D0.tmp

Path C:\Users\Admin\AppData\Local\Temp\15D0.tmp
Size 531KB
SHA256 9e404e3aaaf3dde389a010b8028866554a798581e386610467032aae4039f871
MD5 520a65691d08b7652dcb43d8978eb40b
SHA1 02bfbc39dd6f70e5a0a386e8109ec29d70706441
SHA512 e3b5d69624f340ca64af767ac5b2139323b14b2cf2a27455351b0e656e68b8bab04a4618df5c6fac443d80fd3e72e70c3cd26ef7b3cb5c17d20fc16f4b5e1247
SSDEEP 12288:KdcAIffrC9fdm7navKYgLfu3cEN7fn5nPmR:KdpInm9fdmuvKYifuxRn5PmR
TLSH
T1FCC4F16135D381B2D08614331AABCBB22C7A39315B2A5DCB72D0777D6E317C2A6B1367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download